SQL Injection Attacks and Defense - 2009

SELECT name,spare4 FROM sys.user$ where type#>0 and length(spare4)=62
SYS
S:1336FB26ACF58354164952E502B4F726FF8B5D382012D2E7B1EC99C426A7
SYSTEM
S:38968E8CEC12026112B0010BCBA3ECC2FD278AFA17AE363FDD74674F2651
Exploiting SQL Injection • Chapter 4 183
If the current user is a privileged one, or access as a privileged user has been obtained,
you can look for a number of other interesting pieces of information in the database
structure. Since Oracle 10g Rel. 2, Oracle offers the capability of transparently encrypting
columns in the database. Normally, only the most important or sensitive tables will be
encrypted, and therefore you are interested in finding these tables as follows:
select table_name,column_name,encryption_alg,salt from
dba_encrypted_columns;
TABLE_NAME COLUMN_NAME ENCRYPTION_ALG SAL
---------------------------------------------------------------------------
CREDITCARD CCNR AES256 NO
CREDITCARD CVE AES256 NO
CREDITCARD VALID AES256 NO
Another piece of information that could be useful, if you have a privileged account,
is to know what database administrator (DBA) accounts exist within the database, as follows:
Select grantee,granted_role,admin_option,default_role from dba_role_privs
where granted_role='DBA';
Tip
Enumerating a full database by hand can be a very tedious task. Although
it can be fairly easy to quickly code a small program to perform the task for
you (using your favorite scripting language), several free tools are available
that automate the process. At the end of this chapter, three of them: sqlmap,
Bobcat, and bsql will be illustrated.
Escalating Privileges
All modern DBMSs provide their administrators with very granular control over the actions
that users can perform. You can carefully manage and control access to the stored
information by giving each user very specific rights, such as the ability to access only
specific databases and perform only specific actions on it. Maybe the back-end DBMS that
you are attacking has several databases, but the user who performs your queries might have
access to only one of them, which might not contain the most interesting information.