SQL Injection Attacks and Defense - 2009

Exploiting the Operating System • Chapter 6 281
to SQL injection attacks. This is due in part to its popularity among first-time developers (a
testimony to how Microsoft enables its developers) and in part to the fact that the Microsoft
SQL Server allows for stacked queries. This exponentially increases the options available to a
potential attacker, which can be evidenced by the repercussions of an injection against an
SQL Server box. SensePost alone has built tool sets that will convert an injection point into
full-blown domain name system (DNS) tunnels, remote file servers, and even Transmission
Control Protocol (TCP) connect proxies.
Let’s begin at the beginning, and try to use a vulnerable Web application to read a file
from the remote SQL server. In this case, usually the first function an attacker who has
managed to obtain system administrator privileges finesses is the BULK INSERT statement.
A quick test through Microsoft’s SQL Query Analyzer (shown in Figure 6.5) demonstrates
the use of BULK INSERT by way of example.
Figure 6.5 A BULK INSERT inside SQL Query Analyzer
The ability of the relational database management system (RDBMS) to handle files such
as this, along with the ability to handle batched or stacked queries, should make it fairly
obvious how an attacker can leverage this through his browser. Let’s take one more look at a
simple search application written in ASP with a Microsoft SQL Server back end. Figure 6.6
shows the results of a search on the application for “%”. As you should expect (by now), this
returns all of the users on the system.