4.0

129
Web Application Penetration Testing
The LIMIT operator is not implemented in MS Access, however it
is possible to limit the number of results by using the TOP or LAST
operators instead.
http: /www.example.com/page.app?id=2’+UNION+SE-
LECT+TOP+3+name+FROM+appsTable%00
By combining both operators, it is possible to select specific results.
String concatenation is possible by using & (%26) and + (%2b)
characters.
There are also many other functions that can be used while testing
SQL injection, including but not limited to:
• ASC: Obtain the ASCII value of a character passed as input
• CHR: Obtain the character of the ASCII value passed as input
• LEN: Return the length of the string passed as parameter
• IIF: Is the IF construct, for example the following statement
IIF(1=1, ‘a’, ‘b’) return ‘a’
• MID: This function allows you to extract substring, for example
the following statement mid(‘abc’,1,1) return ‘a’
• TOP: This function allows you to specify the maximum number
of results that the query should return from the top. For example
TOP 1 will return only 1 row.
• LAST: This function is used to select only the last row of a set of
rows. For example the following query SELECT last(*) FROM users
will return only the last row of the result.
Some of these operators are essential to exploit blind SQL injections.
For other advanced operators, please refer to the documents in the
references.
Attributes Enumeration
In order to enumerate the column of a database table, it is possible
to use a common error-based technique. In short, we can obtain the
attributes name by analyzing error messages and repeating the query
with different selectors. For example, assuming that we know the
existence of a column, we can also obtain the name of the remaining
attributes with the following query:
‘ GROUP BY Id%00
the following query:
‘ UNION SELECT Name FROM MSysObjects WHERE Type =
1%00
Alternatively, it is always possible to bruteforce the database schema
by using a standard wordlist (e.g. FuzzDb).
In some cases, developers or system administrators do not realize
that including the actual .mdb file within the application webroot can
allow to download the entire database. Database filenames can be inferred
with the following query:
http: /www.example.com/page.app?id=1’+UNION+SE-
LECT+1+FROM+name.table%00
where name is the .mdb filename and table is a valid database table. In
case of password protected databases, multiple software utilities can
be used to crack the password. Please refer to the references.
Blind SQL Injection Testing
Blind SQL Injection vulnerabilities are by no means the most easily exploitable
SQL injections while testing real-life applications. In case of
recent versions of MS Access, it is also not feasible to execute shell
commands or read/write arbitrary files.
In case of blind SQL injections, the attacker can only infer the result of
the query by evaluating time differences or application responses. It is
supposed that the reader already knows the theory behind blind SQL
injection attacks, as the remaining part of this section will focus on MS
Access specific details.
The following example is used:
http: /www.example.com/index.php?myId=[sql]
where the id parameter is used within the following query:
SELECT * FROM orders WHERE [id]=$myId
In the error message received, it is possible to observe the name of the
next column. At this point, we can iterate the method until we obtain
the name of all attributes. If we don’t know the name of the first attribute,
we can still insert a fictitious column name and obtain the name
of the first attribute within the error message.
Obtaining Database Schema
Various system tables exist by default in MS Access that can be potentially
used to obtain table names and columns. Unfortunately, in the
default configuration of recent MS Access database releases, these
tables are not accessible. Nevertheless, it is always worth trying:
• MSysObjects
• MSysACEs
• MSysAccessXML
For example, if a union SQL injection vulnerability exists, you can use
Let’s consider the myId parameter vulnerable to blind SQL injection.
As an attacker, we want to extract the content of column ‘username’
in the table ‘users’, assuming that we have already disclosed the database
schema.
A typical query that can be used to infer the first character of the username
of the 10th rows is:
http: /www.example.com/index.php?id=IIF((select%20
MID(LAST(username),1,1)%20from%20(select%20TOP%20
10%20username%20from%20users))=’a’,0,’no’)
If the first character is ‘a’, the query will return 0 or otherwise the string
‘no’.
By using a combination of the IFF, MID, LAST and TOP functions, it is