SQL Injection Attacks and Defense - 2009

Microsoft SQL Server 2005 Hashes
References • Chapter 10 431
Microsoft SQL Server 2005 does not store a case-insensitive version of the password hash;
however, the mixed-case version is still accessible. The following SQL statement will retrieve
the password hash for the sa account:
SELECT password_hash FROM sys.sql_logins WHERE name='sa'
The following example hash value includes a four-byte constant (0x0100), an eight-byte
salt (4086CEB6), and a 40-byte mixed-case hash (beginning with D8277):
0x01004086CEB6D8277477B39B7130D923F399C6FD3C6BD46A0365
File Read/Write
It is possible to read local files providing you have INSERT and ADMINISTER BULK
OPERATIONS permissions. The following SQL will read the local file c:\boot.ini into the
localfile table:
CREATE TABLE localfile(data varchar(8000));
BULK INSERT localfile FROM 'c:\boot.ini';
You can then extract data back out from the localfile table using a SELECT statement.
If you are extracting table data out via error messages, you may be limited to one row per
query. In this case, you may need a point of reference to select each row one by one. You can
use the ALTER TABLE statement to add an auto-incrementing IDENTITY column to the
localfile table. The following SQL statement will add an IDENTITY column named id with
an initial value of 1, incrementing with each row in the table:
ALTER TABLE localfile ADD id INT IDENTITY(1,1);
Data can now be extracted by referencing the id column. For example:
SELECT data FROM localfile WHERE id = 1;
SELECT data FROM localfile WHERE id = 2;
SELECT data FROM localfile WHERE id = 3;
MySQL Cheat Sheet
MySQL is a popular open source database platform commonly implemented alongside PHP
and Ruby on Rails applications. This section provides a quick reference of common SQL
statements used in SQL injection attacks against MySQL Server.
Enumerating Database
Configuration Information and Schema
Table 10.11 lists SQL statements used to extract key configuration information. Table 10.12
lists the SQL statements used to enumerate schema information from MySQL 5.0 and later.