Show Menu
Cheatography
  1. Home >
  2. Cheat Sheets >

Database Fingerprinting Cheat Sheet (DRAFT) by

This is a draft cheat sheet. It is a work in progress and is not finished yet.

Purpose

Determine type of backend DB to guide injection crafting, sometimes an educated guess based on inform­ation and config­uration reconn­ais­sance or error messages.
Use special function parameters such as SELECT @@ version (MySQL and SQL Server)
Unique numeric functions:
MySQL - connne­cti­on_id()
MSSQL - @@pack­_re­ceived
Oracle - BITAND­(1,1)

(Meta) Database Inform­ation

The RDBMS being used will affect metadata and schema inform­ation, which will be used to determine tables, columns, users and passwords
inform­ati­on_­schema is an ANSI SQL92 standard database that can provide us with relevant metadata negating the need for finger­pri­nting, though implem­ent­ations vary.
MySQL's inform­ati­on_­schema includes inform­ation for every DB, while MSSQL only shows inform­ation for the current DB.
Oracle, DB2, and SQLite do NOT support inform­ati­on_­schema.

inform­ati­on_­schema Databases

RDBMS
Databases
Tables
Columns
MySQL
schema­_name FROM inform­ati­on_­sch­ema.sc­hemata
table_name FROM inform­ato­n_s­che­ma.t­ables
column­_name FROM inform­ati­on_­sch­ema.co­lumns
SQL Server or Azure SQL*
name FROM sys.da­tabases
name FROM sys.tables
name FROM sys.co­lumns
Oracle DB
**...owner FROM all_tables
table_name FROM all_tables
column­_name FROM all_ta­b_c­olumns
*Depre­cated syntax master..s­yso­bjects system tables

Exploiting In-Ban­d/I­n-line SQLi

With a SELECT query we can see all data contained in columns employed, but we are confined to the table the query SELECTs FROM.
To see beyond the current table we can use Stacked Queries if they are supported.
Stacked Queries are multiple SQL queries submitted by splitting them with a ;.
Example: SELECT * FROM Users WHERE lname=­'John'; CREATE TABLE exfil(data varcha­r(1­000­));--';
Most often support with MSSQL.
MySQL support is compli­cated because will the DB supports it the way the app interfaces with MySQL limiting the abilities.
Oracle does NOT support Stacked Queries.
Stacked Queries are not required for data retrie­val­/ex­fil­tration but make it easier.
Stacked Queries are important when we want to do more than SELECT. Enables us to do INSERTs, UPDATEs, DROPs, SHUTDOWNs with ease.

Unionizing SQLi

UNION allows us to move beyond the confines of the table so we can access arbitrary data from the DB.
Example: SELECT * FROM Users WHERE lname=­'John' UNION SELECT * FROM Custom­ers­;--';
Prereq­uests:
# of columns being pulled must match in the original and injected SELECT
Column data must be compatible
Know table names to target

FROMless SELECT

SELECT Statements do NOT require an associated FROM
When the FROM is left out the result is an interp­reted form of the supplied input.
SELECT 1; -- returns 1
ORACLE DB requires FROM for all SELECT statements but provides a built-in DUAL table that acts as a dumby

NULL

NULL is compatible with any data type.
Couple with FROMless SELECT with NULL to prevent mismatch of data types.

UNION and NULL

Use NULL with UNION SELECT to determine number of columns by increasing the number of NULLs until an error is presented.
Example: SELECT * FROM Users WHERE lname=­'John' UNION SELECT NULL, NULL, NULL;--';
This approach also works for INSERT statem­ents.
Note: Another method is to determine column numbers with an ORDER BY clause.
  

Data Types

Require at least 1 column that accomm­odates strings to accept data we exfiltrate
Tweak previous column number injection changing each NULL to a string until the query is succes­sful.
Example: SELECT * FROM Users WHERE lname=­'John' UNION SELECT 'string', NULL, NULL;--';

Data Exfilt­ration

Using UNION and having establish the number of columns and at least one column that accepts strings we can iterate through all columns of intere­sting tables to return data.
Blind data exfilt­ration is the same approach as UNION but encumbered by having to use inference techni­ques.
Tools make this more efficient and in the case of blind data exfilt­ration make it easier.

SQLi Potential attacks

While data exfilt­ration is the most commonly performed exploit again SQLi flaws in some cases the data holds little value. Attackers can still perform other attacks.
Deleting or altering valuable data.
Injecting data used as stored XSS payloads
Reading files
MySQL - LOAD_F­ILE()
SQL Server BULK INSERT
Writing files MySQL - INTO OUTFILE
OS intera­ction beyond files because stored procedures used to interact with the OS may be on the DB

SQLi Shell Access

Writing files can be used to achieve intera­ctive shells (file writing similar to file uploading)
Requir­ements:
DB server also running web server
DB account needs privileges to write to web root
Have the ability to browse web root
Altern­ative approaches require Stacked Queries.
More viable during internal penetr­ation test or in a pivoted SQLi.

SQLi Cheat Sheets

WebSec SQL Injection Knowledge Base -https­://­web­sec.ca­/kb­/sq­l_i­nje­ction
pentes­tmonkey SQL Injection Cheat Sheet -http:­//p­ent­est­mon­key.ne­t/c­hea­t-s­hee­t/s­ql-­inj­ect­ion­/my­sql­-sq­l-i­nje­cti­on-­che­at-­sheet
SQL Injection Wiki Cheat Sheet -http:­//w­ww.s­ql­inj­ect­ion­wik­i.com/
Defensive: OWASP SQL Injection Prevention Cheat Sheet -https­://­www.ow­asp.or­g/i­nde­x.p­hp/­SQL­_In­jec­tio­n_P­rev­ent­ion­_Ch­eat­_Sheet