Module 5 - SQL Injections

Question 1

Principle exploitable issues with SQL Servers

Answer 1

• web form that does not perform error checking
• SQL server runs any type of query or command passed to it
• SQL server where the service account has elevated permissions
• SQL server which is capable of having the service account run commands

Question 2

SQL injection result

Answer 2

• disclosure of private information

- SQL server performs unauthorized functions

Question 3

Forensic examination of SQL injection should involve:

Answer 3

• The logs from the server hosting the web application
• The logs captured by the web application service
• The logs from the server running SQL
• The SQL application logs (Typically, SQL will retain a record of queries and commands run.)
• Firewall and IDS logs

Question 4

SQL over TCP Port

Answer 4

TCP 1433

Question 5

SQL Probe

Answer 5

UDP 1434

Question 6

DMZ Firewall - protection?

Answer 6

s

Question 7

DMZ Firewall - protection?

Answer 7

firewalls don’t protect against SQL injection

Question 8

SQL injection result

Answer 8

• disclosure of private information (from database/table)

- SQL server performs unauthorized functions (run commands)

Question 9

SQL Server Account

Answer 9

Service account - when compromise, take on same permissions as service account. Can run commands from SQL Server.

Question 10

SQL xp_cmdshell

Answer 10

• spawns Windows command shell and passes string for execution. Output is text.

Question 11

SQL xp_cmdshell

Answer 11

• spawns Windows command shell and passes string for execution. Output is text.
• disabled by default

Question 12

SQL Injection Input

Answer 12

GET or POST commands

Forms can be ASP, PHP, CGI, etc. (no requirement)

Question 13

GETS vs. POSTS

Answer 13

as

Question 14

GETS vs. POSTS

Answer 14

difference in the artifacts we see

Question 15

Artifacts for SQL Injections (4)

Answer 15

Web Server logs
firewalls
ids
SQL server

Question 16

SQL value examples

Answer 16

‘or’1’=’1’–’
‘or’1’=’1’({‘
‘or’1’=’1’/*’

Question 17

Keywords in Log Files

Answer 17

keyword or reps

--
execute
select *
@@version
varchar
char
exec
execute
cast
declare

Question 18

Keywords in Log Files

Answer 18

keyword or greps:

--
execute
select *
@@version
varchar
char
exec
execute
cast
declare