SQL Injection Attacks and Defense - 2009

References • Chapter 10 453
Table 10.31 Extracting Ingres Database Configuration
Data
Current database
List tables
List columns
Query
SELECT dbmsinfo('database');
SELECT relid, relowner, relloc FROM iirelation WHERE
relowner != '$ingres';
SELECT column_name, column_datatype, table_name,
table_owner FROM iicolumns;
Blind SQL Injection Functions: Ingres
Table 10.32 lists functions that are useful when performing blind SQL injection attacks.
Table 10.32 Blind SQL Injection Functions
Data
String length
Query
LENGTH()
Extract substring from a given string SELECT substr(string, offset, length); --
String (‘ABC’) representation with no
single quotes
SELECT chr(65)||chr(66)||chr(67)
Microsoft Access
Microsoft Access databases do not scale well with enterprise applications, and therefore
are usually encountered only when the application has minimal database requirements.
Brett Moore of insomniasec.com has published an excellent paper on SQL injection with
Microsoft Access which you can find here:
■■
www.insomniasec.com/publications/Access-Through-Access.pdf
Resources
This section provides a list of links to further reading materials and tools to assist you in
discovering, exploiting, and preventing SQL injection vulnerabilities.
SQL Injection White Papers
■■
“Advanced SQL Injection” by Victor Chapela:
www.owasp.org/index.php/Image:Advanced_SQL_Injection.ppt