SQL Injection Attacks and Defense - 2009

Blind SQL Injection Exploitation • Chapter 5 265
lookups by prefixing the supplied domain with the output. These DNS queries will arrive
at the attacker’s address and are decoded by sqlninja and displayed. Sqlninja includes a
stand-alone DNS server component which answers queries for the purposes of eliminating
timeouts. Figure 5.15 shows an instance of sqlninja that was used to retrieve the account
under which SQL Server was running using the whoami command. Because sqlninja relies
on both xp_cmdshell and file creation, privileged database access is a must.
Figure 5.15 Executing sqlninja to Extract a Username via DNS
Squeeza
The final tool examined for automating blind SQL injection exploitation, squeeza is
a command-line tool that supports multiple methods for extracting information from
SQL Server databases, with particular emphasis placed on the DNS channel where
a reliability layer is added.
■■
■■
■■
■■
■■
URL: www.sensepost.com/research/squeeza
Requirements: Ruby, tcpdump for DNS channel (Linux/Mac), authoritative
DNS server for any domain
Scenarios: Generic error page, controlled output; generic error page, uncontrolled
output; completely blind, no errors
Supported database: SQL Server
Methods: Inference time-based bit-by-bit; alternative channel = DNS
Squeeza takes a slightly different approach to SQL injection in general by dividing injection
into data creation (e.g., command execution, a file from the database’s file system, or an SQL
query) and data extraction (e.g., using classic errors, timing inference, and DNS). This enables
the attacker to mix and match to a large degree: command execution using timing as the return
channel, or file copy over DNS. We will focus solely on the DNS extraction channel combined
with command execution for data generation for brevity’s sake.