SQL Injection - enumerating Microsoft AD users using Oracle resources
In my last post I have talked about how to explore SQL injection flaws to perform port scanner when the database is Oracle. Now I am sharing with you a way to perform brute force attack to enumerate users from Microsoft AD (or other LDAP repository). Oracle provides a package called DBMS_LDAP since 9i version and this can help us with such task. It seems that even in Oracle 11g there is no special ACL assigned to such resource. What does it mean? It means we can use it in our SQL injection attacks with most of the Oracle users. Let's take a look at a practical example performed on a penetration testing: http://target/index_target.php?id=15||DBMS_LDAP.simple_bind_s((dbms_ldap.init('targetdomain.com',389)),'admin@targetdomain.com','password')-- In this case, the value of the vulnerable parameter id is concatenated with the result of DBMS_LDAP.simple_bind_s function. We can manipulate the target domain and its port as well user names and passwords. If the LD