SQL Injection Attacks and Defense - 2009

312 Chapter 6 • Exploiting the Operating System
Summary
This chapter demonstrated how SQL injection attacks can be used to attack the host on
which the database server is running. The ability to read and write files to the file system
and the ability to execute operating system commands is built into most modern RDBMSs
today, and this by extension means that this functionality is available to most SQL injection
attackers.
The ability to use a single vulnerability such as a discovered SQL injection point as a
beachhead to launch attacks at other hosts is one of those penetration testing techniques
that separates the men from the boys. This chapter covered how simple primitives such as
file reading, file writing, and command execution can be used within SQL injection attacks
against the most prominent application architectures.
With these primitives under your belt, you can move on to Chapter 7, which covers
advanced SQL injection topics.
Solutions Fast Track
Accessing the File System
˛˛ The following pertains to reading files from the file system using SQL injection:
In MySQL, you can use the LOAD DATA INFILE and LOAD_FILE( )
commands to read arbitrary files from the host.
In Microsoft SQL Server, you can read files from the filesystem using BULK
INSERT or OLE Automation. On newer systems (SQL Server 2005 and later),
you can use a quirk in the CREATE ASSEMBLY methods to read files from the
file system.
In Oracle, you can read files using Oracle Directory, Oracle Text, or the utl_ file
method.
˛˛ The following pertains to writing files to the file system using SQL injection:
In MySQL, you can write files to the file system by using the select into outfile
and select into dumpfile commands.
In Microsoft SQL Server, you can use OLE Automation and simple redirection
(through command execution) to create files on the target file system. You can
use debug.exe and BCP from the command line to assist with creating binaries on
the target.
In Oracle, you can accomplish file writing using utl_file, DBMS_ADVISOR,
Java, or operating system commands and standard redirection.