SQL Injection Attacks and Defense - 2009

Figure 5.13 Extracting Database Login Using BSQL Hacker
Blind SQL Injection Exploitation • Chapter 5 263
SQLBrute
Attackers who are comfortable with the fundamentals behind inference attacks use the
SQLBrute command-line tool due to its lightweight nature and straightforward syntax.
■■
■■
■■
■■
■■
URL: www.gdssecurity.com/l/t.php
Requirements: Python (Windows/Linux/Mac)
Scenarios: Generic error page, controlled output; generic error page, uncontrolled
output; completely blind, no errors
Supported databases: Oracle and SQL Server
Methods: Inference time-based binary search; inference response-based modified
binary search
SQLBrute relies only on a Python interpreter, and at 31 KB it is tiny compared to the
other tools examined. This makes it ideal for focused injection scenarios or where file size is
important, and its thread support boosts speed. A drawback is that it uses a fixed alphabet from
which inference tests are drawn; if a byte in the data is not contained within the alphabet it
cannot be retrieved, which limits the tool to text-based data.
To run the tool, you will need the full path to the vulnerable page along with any data
that must be submitted (either GET or POST parameters). If you’re using the response-based
mode, you must supply a regular expression in the --error argument that indicates when the
inference question returns false; otherwise, the timing-based mode is available. In the example
depicted in Figure 5.14, SQLBrute has been run in response-based mode against a vulnerable
SQL server, and two table names have been extracted from the database. Based on our
exploration, we know that when an inference question returns FALSE, the page contains
“Review count :0”, but this could also be a regular expression instead of a fixed string if
needed. After execution commences, the tool performs a little bit of fingerprinting and starts
to extract data and print it to the screen.