SharingSec

In my last post I have talked about how to explore SQL injection flaws to perform port scanner when the database is Oracle. Now I am sharing with you a way to perform brute force attack to enumerate users from Microsoft AD (or other LDAP repository). Oracle provides a package called DBMS_LDAP since 9i version and this can help us with such task. It seems that even in Oracle 11g there is no special ACL assigned to such resource. What does it mean? It means we can use it in our SQL injection attacks with most of the Oracle users. Let's take a look at a practical example performed on a penetration testing: http://target/index_target.php?id=15||DBMS_LDAP.simple_bind_s((dbms_ldap.init('targetdomain.com',389)),'admin@targetdomain.com','password')-- In this case, the value of the vulnerable parameter id is concatenated with the result of DBMS_LDAP.simple_bind_s function. We can manipulate the target domain and its port as well user names and passwords. If the LD...

Have you ever used an SQL Injection flaw to perform a port scanner? It's known that common databases such as Oracle and SQLServer have special packages that can perform HTTP connections, build sockets, get host names and other information about networks. How about to use such resources to perform a port scanner exploiting a SQL injection flaw? It's useful to discover other assets in the network and to help us to map the environment. In our case, the DBMS was Oracle 10g. Usually we use the package URL_HTTP package to perform out of band SQL injection attack, however we are going to use it to perform a port scanner. Let's take a look at a practical example performed on a penetration testing: http://target/index_content. php?id=163447||utl_http. request('10.1.0.141:445')-- In this case, the value of the vulnerable parameter id is concatenated with the result of utl_http.request. We can manipulate the IP address as well the ports numbers. When the co...

Hello all! For the most of you there is nothing new talking about SQL Injection and exploitation techniques. As I friend of mine says: "SQL Injection is the pop star of the vulnerabilities". What I will show here is how SQLMap can help you to exploit tricky SQL injection vulnerabilities. Just the other day performing a penetration testing on a web application I’ve found a SQL injection flaw. In order to find such vulnerability I was only browsing the application (doing some recognition) and by changing the ID parameter in the follow URL it was enough to give me some clue about the flaw: https://target.com.br/index.php?a=info&ID=32 ' Result: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'' at line 1 Well, I was happy to have found it and I started the process to find a way to exploit it. First of all I decided for the UNION techni...