Restoring a corrupted master database is one of the most difficult tasks you may have to deal with. If this catastrophic event happens, here's how to proceed.
First, you need to rebuild the master database. Details on this operation depend on the SQL Server version you run. With SQL Server 6.5 the only way is to re-install the program, whereas SQL Server 7.0 provides an utility called Rebuildm.exe, in the \Mssql7\Binn directory.
Set SQL Server on single-user-mode, by starting it with the -m switch. Next, restore the master database from the latest avaible backup. At the end of the restore procedure, after verifying that all databases are working correctly, you can proceed restoring the MSDB database. When this step completes, stop SQL Server and start it again in normal mode. After the restart remember to check that all the user databases are working properly. If they aren't, the action to undertake depends on the SQL Server version.
With SQL Server 6.5, perform a DISK REINIT, which restores the data about the system tables usage in case of an existent device but missing data in the sysusages table.
DISK REINIT
NAME = 'logical name'
PHYSNAME = 'physical name'
VDEVNO = virtual device number
SIZE = number of 2K blocks
[, VSTART = 'virtual address']
SQL Server 7.0 doesn't support DISK REINIT any longer, but the same operation is available through the sp_attach_db system stored procedure, which connect a database to a server:
sp_attach_db [@dbname =] 'database name', [@Filename1 =] 'File 1 name' [, ... 16].
If this sequence of operations can't solve the problem, you'll need to rebuild each device and database and then perform the individual restores. The importance of regular backups, and in particular the master database master, can't be overemphasized enough, as it can assure the server stability and a quick restart in case of problems.
Wednesday, August 10, 2005
IE 7.0 Technical Changes Leave Web Developers, Users in the Lurch
In a recent blog posting , Microsoft Internet Explorer (IE) Lead Program Manager Chris Wilson revealed many of the technical improvements that Microsoft will add to IE 7.0 for its final release. Almost all the improvements are related to bugs in IE's implementation of Cascading Style Sheets (CSS), an HTML-like technology that Web developers use to create Web sites. Many of these bugs aren't fixed in the currently available IE 7.0 Beta 1 release, Wilson noted. Wilson's post raises some serious questions about IE 7.0, not the least of which is this: If IE 7.0 Beta 1 doesn't include the fixes that most Web developers need, why did Microsoft release IE 7.0 Beta 1 only to a small group of Web developers and other testers, not to the general public as originally promised?
Wilson's post is disappointing because Microsoft doesn't plan to fully support the latest CSS standard in IE 7.0. Instead of using well-established Web standards, IE 7.0 will continue to foist proprietary technologies on Web developers, forcing them to choose between two competing ways of creating Web sites. "In IE 7.0, we will fix as many of the worst bugs that Web developers hit as we can, and we will add the critical most-requested features from the standards as well," Wilson said. "Our intent is to build a platform that fully complies with the appropriate Web standards, in particular CSS 2. I think we will make a lot of progress against that in IE 7.0 through our goal of removing the worst painful bugs that make our platform difficult to use for Web developers."
The most critical point in Wilson's post, in my mind, is Microsoft's admission that it will fail the crucial Acid2 browser-compliance test , which the Web Standards Project (WaSP) designed to help browser vendors ensure that their products properly support Web standards. Microsoft apparently disagrees. "Acid2 ... is pointedly not a compliance check," Wilson noted, contradicting the description on the Acid2 Web site. "As a wish list, [Acid2] is really important and useful to my team, but it isn't even intended, in my understanding, as our priority list for IE 7.0." Meanwhile, other browser teams have made significant efforts to comply with Acid2.
Microsoft blames backward-compatibility problems for the stalemate over true Web standards compatibility. Put succinctly, the company has gone its own way for so long and now has to support so many developers who use nonstandard Web technologies that it will be impossible to make IE Web-standards-compliant without breaking half the commercial Web sites on the planet. Furthermore, by halting all IE development for several years before reconstituting the IE team to create IE 7.0, Microsoft has set back Web development by an immeasurable amount of time.
Wilson's post is disappointing because Microsoft doesn't plan to fully support the latest CSS standard in IE 7.0. Instead of using well-established Web standards, IE 7.0 will continue to foist proprietary technologies on Web developers, forcing them to choose between two competing ways of creating Web sites. "In IE 7.0, we will fix as many of the worst bugs that Web developers hit as we can, and we will add the critical most-requested features from the standards as well," Wilson said. "Our intent is to build a platform that fully complies with the appropriate Web standards, in particular CSS 2. I think we will make a lot of progress against that in IE 7.0 through our goal of removing the worst painful bugs that make our platform difficult to use for Web developers."
The most critical point in Wilson's post, in my mind, is Microsoft's admission that it will fail the crucial Acid2 browser-compliance test , which the Web Standards Project (WaSP) designed to help browser vendors ensure that their products properly support Web standards. Microsoft apparently disagrees. "Acid2 ... is pointedly not a compliance check," Wilson noted, contradicting the description on the Acid2 Web site. "As a wish list, [Acid2] is really important and useful to my team, but it isn't even intended, in my understanding, as our priority list for IE 7.0." Meanwhile, other browser teams have made significant efforts to comply with Acid2.
Microsoft blames backward-compatibility problems for the stalemate over true Web standards compatibility. Put succinctly, the company has gone its own way for so long and now has to support so many developers who use nonstandard Web technologies that it will be impossible to make IE Web-standards-compliant without breaking half the commercial Web sites on the planet. Furthermore, by halting all IE development for several years before reconstituting the IE team to create IE 7.0, Microsoft has set back Web development by an immeasurable amount of time.
Tuesday, August 09, 2005
Code war heats up between Microsoft and Adobe
What happens when a smaller software maker enters a collision course with giant Microsoft Corp.? Adobe Systems Inc., a San Jose-based company with a large presence in Fremont, is poised to find out.
Redmond-based Microsoft just announced two products that will compete with offerings from Adobe, and Adobe is about to buy a company with products that challenge Microsoft's.
After that purchase, Adobe will practically own a rich market: software used by photographers, artists and Web developers to manage photos and graphic images and print them or create Web sites incorporating them.
Microsoft is active in just about every market except that one. And, as always, it's seeking ways to tweak its slowing revenue growth.
Microsoft says it's no threat. Some analysts don't believe that.
"For Microsoft to continue to grow at the rate it wants, it needs to be conquering new markets, and Adobe's is the biggest, juiciest prize right now," said Jesse James Garrett, a director at consultancy Adaptive Path.
The potential for a competitive clash began this spring.
In late April, Microsoft demonstrated software code-named Metro and now renamed the XML Paper Specification. It's digital-document software that in some respects competes with Adobe's market-dominating PDF format and its Acrobat family of products that produce or read that format.
Both companies' offerings allow creating documents that retain the quality of the included photographs, graphics and type and allow opening and reading the document dependably in multiple operating systems.
XML Paper Specification is planned as part Microsoft's Windows Vista operating system, released in beta form Wednesday.
Also part of Vista is the Windows Presentation Foundation, which incorporates Microsoft's XAML language for making documents and data automatically readable by multiple programs running on different operating systems.
That software could pose a competitive challenge to Flash, a well-established product from Macromedia Inc. Adobe in mid-April announced plans to spend $3.4 billion in stock to buy San Francisco-based Macromedia, in a deal set to close by this fall.
Vista plus XAML don't add up to Flash, exactly, but "they could obviate the need for Flash," said Gary Hein, an analyst with the Burton Group.
Macromedia also produces Dreamweaver, among the most popular products for building Web sites -- except for Microsoft's FrontPage and more sophisticated Visual Studio.
The fourth and final swerve toward a collision occurred last month, when Microsoft released Acrylic, the code name for a new, free graphics program.
The Acrylic Web site even echoes Adobe's distinctive packaging.
Early users say Acrylic includes some features of three Adobe programs designed for creative professionals: bit-mapped photo manager Photoshop and vector-based graphics managers Illustrator and Freehand.
Summing up these product developments, Hein observed: "It's almost like if you go down the list of products and abbreviations the companies are using, there's nearly a one-to-one mapping of what Adobe and Microsoft are providing."
At the moment, Adobe has a huge competitive advantage, holding between 75 percent and 90 percent of the market with each program it makes.
But that kind of lead alone doesn't ensure continued success, said Piper Jaffray analyst Gene Munster. What will determine when, or whether, Microsoft's software can equal Adobe's, he said, is simply this: "How hard does it want to go after the creative community?"
In the business-software segment, Microsoft is also poised to make inroads.
Whereas Adobe sells printer-makers the right to print documents using its Postscript type technology, Microsoft plans to give its equivalent technology away, Munster said. That gives it a better chance of edging into Adobe's market.
But two Microsoft executives maintain Adobe has nothing to fear from Redmond.
Conceiving of the two companies as being on a collision course is "a much more black-and-white way of looking at the world than exists in the space we're in," said John Montgomery, a director in Microsoft's developer division.
"Yes, there's competition -- and there's collaboration. Our relationship with Adobe has many layers. We all need to work together, because what we're all trying to do is advance the state of the art and make money by building better products."
And, he said, Acrylic isn't meant to compete with Adobe products.
"It's less a competitive product than a cooperative product," he said. "You'd probably use them (Acrylic and Photoshop) with each other."
Windows boss Jim Allchin in an earlier interview said Metro isn't intended to challenge Adobe's PDF format, though he acknowledged some will see it that way.
Adobe spokeswoman Katie Juran said no executives were available to comment.
Microsoft's reassurances don't carry much weight to those who remember how encounters with Microsoft have proved hazardous to smaller companies' health.
In the late 1990s, Netscape's once-dominant Navigator browser was savaged by Microsoft's Internet Explorer. Though Navigator still exists, its influence and market share are minuscule. Seattle's RealNetworks Inc. in 2003 sued Microsoft for antitrust violations over including Media Player within Windows. In federal filings, it says such inclusion has "substantially affected" its business.
How can Adobe stave off whatever competitive threat Microsoft might pose?
The company must reconcile itself to some market-share erosion from Microsoft, said Karen Haus, an analyst with WR Hambrecht + Co.
To increase Acrobat's appeal, Adobe could try bundling additional products with it and offering fixed prices over long periods in exchange for buying commitments, because corporate buyers tend to be price-sensitive, she said.
Adobe will have an easier time protecting its lead among creative professionals, she said. That's especially true if it bundles some of those products into "creative suites," as it already has with Photoshop, its Bridge browser and ImageReady, a Web preparation product.
Adobe has the additional advantages of an excellent reputation for quality and the Mac-oriented, anti-Microsoft bent of some in the artistic community, she said.
The biggest risk to Adobe would be getting diverted by the pending purchase of Macromedia, said analyst Garrett.
"I'd say the risk in a merger situation like this is avoiding confusion and disarray and the stagnation of product lines," he said. "Microsoft is not going to wait until Adobe is ready before it starts going after them."
To see more of the Seattle Post-Intelligencer, for online features, or to subscribe, go to http://seattlep-I.com.
Redmond-based Microsoft just announced two products that will compete with offerings from Adobe, and Adobe is about to buy a company with products that challenge Microsoft's.
After that purchase, Adobe will practically own a rich market: software used by photographers, artists and Web developers to manage photos and graphic images and print them or create Web sites incorporating them.
Microsoft is active in just about every market except that one. And, as always, it's seeking ways to tweak its slowing revenue growth.
Microsoft says it's no threat. Some analysts don't believe that.
"For Microsoft to continue to grow at the rate it wants, it needs to be conquering new markets, and Adobe's is the biggest, juiciest prize right now," said Jesse James Garrett, a director at consultancy Adaptive Path.
The potential for a competitive clash began this spring.
In late April, Microsoft demonstrated software code-named Metro and now renamed the XML Paper Specification. It's digital-document software that in some respects competes with Adobe's market-dominating PDF format and its Acrobat family of products that produce or read that format.
Both companies' offerings allow creating documents that retain the quality of the included photographs, graphics and type and allow opening and reading the document dependably in multiple operating systems.
XML Paper Specification is planned as part Microsoft's Windows Vista operating system, released in beta form Wednesday.
Also part of Vista is the Windows Presentation Foundation, which incorporates Microsoft's XAML language for making documents and data automatically readable by multiple programs running on different operating systems.
That software could pose a competitive challenge to Flash, a well-established product from Macromedia Inc. Adobe in mid-April announced plans to spend $3.4 billion in stock to buy San Francisco-based Macromedia, in a deal set to close by this fall.
Vista plus XAML don't add up to Flash, exactly, but "they could obviate the need for Flash," said Gary Hein, an analyst with the Burton Group.
Macromedia also produces Dreamweaver, among the most popular products for building Web sites -- except for Microsoft's FrontPage and more sophisticated Visual Studio.
The fourth and final swerve toward a collision occurred last month, when Microsoft released Acrylic, the code name for a new, free graphics program.
The Acrylic Web site even echoes Adobe's distinctive packaging.
Early users say Acrylic includes some features of three Adobe programs designed for creative professionals: bit-mapped photo manager Photoshop and vector-based graphics managers Illustrator and Freehand.
Summing up these product developments, Hein observed: "It's almost like if you go down the list of products and abbreviations the companies are using, there's nearly a one-to-one mapping of what Adobe and Microsoft are providing."
At the moment, Adobe has a huge competitive advantage, holding between 75 percent and 90 percent of the market with each program it makes.
But that kind of lead alone doesn't ensure continued success, said Piper Jaffray analyst Gene Munster. What will determine when, or whether, Microsoft's software can equal Adobe's, he said, is simply this: "How hard does it want to go after the creative community?"
In the business-software segment, Microsoft is also poised to make inroads.
Whereas Adobe sells printer-makers the right to print documents using its Postscript type technology, Microsoft plans to give its equivalent technology away, Munster said. That gives it a better chance of edging into Adobe's market.
But two Microsoft executives maintain Adobe has nothing to fear from Redmond.
Conceiving of the two companies as being on a collision course is "a much more black-and-white way of looking at the world than exists in the space we're in," said John Montgomery, a director in Microsoft's developer division.
"Yes, there's competition -- and there's collaboration. Our relationship with Adobe has many layers. We all need to work together, because what we're all trying to do is advance the state of the art and make money by building better products."
And, he said, Acrylic isn't meant to compete with Adobe products.
"It's less a competitive product than a cooperative product," he said. "You'd probably use them (Acrylic and Photoshop) with each other."
Windows boss Jim Allchin in an earlier interview said Metro isn't intended to challenge Adobe's PDF format, though he acknowledged some will see it that way.
Adobe spokeswoman Katie Juran said no executives were available to comment.
Microsoft's reassurances don't carry much weight to those who remember how encounters with Microsoft have proved hazardous to smaller companies' health.
In the late 1990s, Netscape's once-dominant Navigator browser was savaged by Microsoft's Internet Explorer. Though Navigator still exists, its influence and market share are minuscule. Seattle's RealNetworks Inc. in 2003 sued Microsoft for antitrust violations over including Media Player within Windows. In federal filings, it says such inclusion has "substantially affected" its business.
How can Adobe stave off whatever competitive threat Microsoft might pose?
The company must reconcile itself to some market-share erosion from Microsoft, said Karen Haus, an analyst with WR Hambrecht + Co.
To increase Acrobat's appeal, Adobe could try bundling additional products with it and offering fixed prices over long periods in exchange for buying commitments, because corporate buyers tend to be price-sensitive, she said.
Adobe will have an easier time protecting its lead among creative professionals, she said. That's especially true if it bundles some of those products into "creative suites," as it already has with Photoshop, its Bridge browser and ImageReady, a Web preparation product.
Adobe has the additional advantages of an excellent reputation for quality and the Mac-oriented, anti-Microsoft bent of some in the artistic community, she said.
The biggest risk to Adobe would be getting diverted by the pending purchase of Macromedia, said analyst Garrett.
"I'd say the risk in a merger situation like this is avoiding confusion and disarray and the stagnation of product lines," he said. "Microsoft is not going to wait until Adobe is ready before it starts going after them."
To see more of the Seattle Post-Intelligencer, for online features, or to subscribe, go to http://seattlep-I.com.
Yahoo Introduces Upgraded Instant Messaging Service
Yahoo Inc has revealed that it has started to enable users to make telephone calls and surf the Internet through its "Yahoo Messenger with Voice" service, an upgrade of its instant messaging (IM) system.
The new service is said to enable high-quality voice calling, allowing users to make phone calls to family and friends anywhere in the world between PCs. According to Yahoo, IM is very popular amongst children aged 9-12 years old and teenagers and often accounts for the main part of their online time. The company is reported to have upgraded its IM service with the aim of drawing a young audience familiar with broadband web connections and with the intention of keeping rival voice-calling services at bay.
Yahoo is said to be attempting to fend off the increasing popularity of services such as Skype, an Internet phone calling service with around 48m registered users worldwide. Yahoo's service, to include free spam protection, photo-sharing and voicemail, is available at http://messenger.yahoo.com/ in 18 localised versions and is claimed to have attracted millions of users for the final testing.
The new service is said to enable high-quality voice calling, allowing users to make phone calls to family and friends anywhere in the world between PCs. According to Yahoo, IM is very popular amongst children aged 9-12 years old and teenagers and often accounts for the main part of their online time. The company is reported to have upgraded its IM service with the aim of drawing a young audience familiar with broadband web connections and with the intention of keeping rival voice-calling services at bay.
Yahoo is said to be attempting to fend off the increasing popularity of services such as Skype, an Internet phone calling service with around 48m registered users worldwide. Yahoo's service, to include free spam protection, photo-sharing and voicemail, is available at http://messenger.yahoo.com/ in 18 localised versions and is claimed to have attracted millions of users for the final testing.
Internet Explorer 7 User Agent String
Internet Explorer 7 Beta 1 is fast approaching. A tiny but significant code change was checked in this week: Internet Explorer's new User-Agent string.
The User-Agent (or UA) string is sent along in the headers of every HTTP request so the server knows what type of browser is making the request. For a quick introduction on handling of the User-Agent string, check out George Shephard's article in MSDN Magazine.
Internet Explorer 7 User-Agent
As we updated the User-Agent, we considered application-compatibility issues, historical precedent, and feedback from the community. We arrived at a very simple string.
IE7 running on Longhorn will send the following User-Agent header: Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 6.0)
There are three points of interest in this string:
The User-Agent (or UA) string is sent along in the headers of every HTTP request so the server knows what type of browser is making the request. For a quick introduction on handling of the User-Agent string, check out George Shephard's article in MSDN Magazine.
Internet Explorer 7 User-Agent
As we updated the User-Agent, we considered application-compatibility issues, historical precedent, and feedback from the community. We arrived at a very simple string.
IE7 running on Longhorn will send the following User-Agent header: Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 6.0)
There are three points of interest in this string:
- We updated from 6.0 to 7.0 to reflect the new application version.
- Consistent with prior betas, a "b" was added following the 7.0, in order to flag this as a beta release. This "b" will be removed for RTM.
- The "SV1" token was removed. As predicted by the community, this token becomes redundant with the release of IE7.
What does this mean for web developers?
If you use ASP.NET's HTTPBrowserCapabilities class on your pages, you'll find that it is already able to correctly interpret the new UA string. The class will return 7 for the MajorVersion property, and True for the Beta property.
Checks for the IE security features introduced in XP SP2 can be updated as follows:
System.Web.HttpBrowserCapabilities browser = Request.Browser;
bool isIESecurityEnhanced = (browser.Browser == "IE" && (browser.MajorVersion > 6 (browser.MajorVersion == 6 && Request.Headers["User-Agent"] != null && Request.Headers["User-Agent"].IndexOf("SV1")>-1)));
Can web developers test the new string out before IE7 Beta ships?
My first suggestion was to use a simple rule in Fiddler to change the outbound User-Agent header:
static function OnBeforeRequest(oSession:Fiddler.Session){ oSession.oRequest["User-Agent"] = "Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 6.0)";}
However, this will only report the new User-Agent to the web server; any script in the webpage that calls the navigator object to check the browser version will never notice this change. Rats.
Fortunately, IE5.0 and later allow you to override the user-agent string used by scripting and sent by the browser.
Simply save the following as IE7UA.REG. Double-click the file to merge it into your registry and restart the browser to see the change.
Windows Registry Editor Version 5.00
Thursday, August 04, 2005
SQL Injection Walkthrough
The following article will try to help beginners with grasping the problems facing them while trying to utilize SQL Injection techniques, to successfully utilize them, and to protect themselves from such attacks.
1.0 Introduction
When a machine has only port 80 opened, your most trusted vulnerability scanner cannot return anything useful, and you know that the admin always patch his server, we have to turn to web hacking. SQL injection is one of type of web hacking that require nothing but port 80 and it might just work even if the admin is patch-happy. It attacks on the web application (like ASP, JSP, PHP, CGI, etc) itself rather than on the web server or services running in the OS.This article does not introduce anything new, SQL injection has been widely written and used in the wild. We wrote the article because we would like to document some of our pen-test using SQL injection and hope that it may be of some use to others. You may find a trick or two but please check out the "9.0 Where can I get more info?" for people who truly deserve credit for developing many techniques in SQL injection.
1.1 What is SQL Injection?
It is a trick to inject SQL query/command as an input possibly via web pages. Many web pages take parameters from web user, and make SQL query to the database. Take for instance when a user login, web page that user name and password and make SQL query to the database to check if a user has valid name and password. With SQL Injection, it is possible for us to send crafted user name and/or password field that will change the SQL query and thus grant us something else.
1.2 What do you need?
Any web browser.
2.0 What you should look for?
Try to look for pages that allow you to submit data, i.e: login page, search page, feedback, etc. Sometimes, HTML pages use POST command to send parameters to another ASP page. Therefore, you may not see the parameters in the URL. However, you can check the source code of the HTML, and look for "FORM" tag in the HTML code. You may find something like this in some HTML codes:
Everything between the have potential parameters that might be useful (exploit wise).
2.1 What if you can't find any page that takes input?
You should look for pages like ASP, JSP, CGI, or PHP web pages. Try to look especially for URL that takes parameters, like:http://duck/index.asp?id=10
3.0 How do you test if it is vulnerable?
Start with a single quote trick. Input something like:
hi' or 1=1--
Into login, or password, or even in the URL.
Example:
- Login: hi' or 1=1--
- Pass: hi' or 1=1--
- http://duck/index.asp?id=hi' or 1=1--
If you must do this with a hidden field, just download the source HTML from the site, save it in your hard disk, modify the URL and hidden field accordingly.
Example:
If luck is on your side, you will get login without any login name or password.
3.1 But why ' or 1=1--?
Let us look at another example why ' or 1=1-- is important. Other than bypassing login, it is also possible to view extra information that is not normally available. Take an asp page that will link you to another page with the following URL:http://duck/index.asp?category=foodIn the URL, 'category' is the variable name, and 'food' is the value assigned to the variable. In order to do that, an ASP might contain the following code (OK, this is the actual code that we created for this exercise):v_cat = request("category")sqlstr="
SELECT * FROM product WHERE PCategory='" & v_cat & "'"set rs=conn.execute(sqlstr)
As we can see, our variable will be wrapped into v_cat and thus the SQL statement should become:SELECT * FROM product WHERE PCategory='food'
The query should return a resultset containing one or more rows that match the WHERE condition, in this case, 'food'.Now, assume that we change the URL into something like this:http://duck/index.asp?category=food' or 1=1--Now, our variable v_cat equals to "food' or 1=1-- ", if we substitute this in the SQL query, we will have:
SELECT * FROM product WHERE PCategory='food' or 1=1--'
The query now should now select everything from the product table regardless if PCategory is equal to 'food' or not. A double dash "--" tell MS SQL server ignore the rest of the query, which will get rid of the last hanging single quote ('). Sometimes, it may be possible to replace double dash with single hash "#".
However, if it is not an SQL server, or you simply cannot ignore the rest of the query, you also may try' or 'a'='a
The SQL query will now become:
SELECT * FROM product WHERE PCategory='food' or 'a'='a'It should return the same result.Depending on the actual SQL query, you may have to try some of these possibilities:' or 1=1--" or 1=1--or 1=1--' or 'a'='a" or "a"="a') or ('a'='a
Where can I get more info?One of the earliest works on SQL Injection we have encountered should be the paper from Rain Forest Puppy about how he hacked
PacketStorm.http://www.wiretrip.net/rfp/p/doc.asp?id=42&iface=6
Great article on gathering information from ODBC error messages:http://www.blackhat.com/presentations/win-usa-01/Litchfield/BHWin01Litchfield.doc
A good summary of SQL Injection on various SQL Server on http://www.owasp.org/asac/input_validation/sql.shtml
Senseport's article on reading SQL Injection:http://www.sensepost.com/misc/SQLinsertion.htm
Other worth readings:
http://www.digitaloffense.net/wargames01/IOWargames.ppt
http://www.wiretrip.net/rfp/p/doc.asp?id=7&iface=6
http://www.wiretrip.net/rfp/p/doc.asp?id=60&iface=6
http://www.spidynamics.com/whitepapers/WhitepaperSQLInjection.pdf
1.0 Introduction
When a machine has only port 80 opened, your most trusted vulnerability scanner cannot return anything useful, and you know that the admin always patch his server, we have to turn to web hacking. SQL injection is one of type of web hacking that require nothing but port 80 and it might just work even if the admin is patch-happy. It attacks on the web application (like ASP, JSP, PHP, CGI, etc) itself rather than on the web server or services running in the OS.This article does not introduce anything new, SQL injection has been widely written and used in the wild. We wrote the article because we would like to document some of our pen-test using SQL injection and hope that it may be of some use to others. You may find a trick or two but please check out the "9.0 Where can I get more info?" for people who truly deserve credit for developing many techniques in SQL injection.
1.1 What is SQL Injection?
It is a trick to inject SQL query/command as an input possibly via web pages. Many web pages take parameters from web user, and make SQL query to the database. Take for instance when a user login, web page that user name and password and make SQL query to the database to check if a user has valid name and password. With SQL Injection, it is possible for us to send crafted user name and/or password field that will change the SQL query and thus grant us something else.
1.2 What do you need?
Any web browser.
2.0 What you should look for?
Try to look for pages that allow you to submit data, i.e: login page, search page, feedback, etc. Sometimes, HTML pages use POST command to send parameters to another ASP page. Therefore, you may not see the parameters in the URL. However, you can check the source code of the HTML, and look for "FORM" tag in the HTML code. You may find something like this in some HTML codes:
Everything between the have potential parameters that might be useful (exploit wise).
2.1 What if you can't find any page that takes input?
You should look for pages like ASP, JSP, CGI, or PHP web pages. Try to look especially for URL that takes parameters, like:http://duck/index.asp?id=10
3.0 How do you test if it is vulnerable?
Start with a single quote trick. Input something like:
hi' or 1=1--
Into login, or password, or even in the URL.
Example:
- Login: hi' or 1=1--
- Pass: hi' or 1=1--
- http://duck/index.asp?id=hi' or 1=1--
If you must do this with a hidden field, just download the source HTML from the site, save it in your hard disk, modify the URL and hidden field accordingly.
Example:
If luck is on your side, you will get login without any login name or password.
3.1 But why ' or 1=1--?
Let us look at another example why ' or 1=1-- is important. Other than bypassing login, it is also possible to view extra information that is not normally available. Take an asp page that will link you to another page with the following URL:http://duck/index.asp?category=foodIn the URL, 'category' is the variable name, and 'food' is the value assigned to the variable. In order to do that, an ASP might contain the following code (OK, this is the actual code that we created for this exercise):v_cat = request("category")sqlstr="
SELECT * FROM product WHERE PCategory='" & v_cat & "'"set rs=conn.execute(sqlstr)
As we can see, our variable will be wrapped into v_cat and thus the SQL statement should become:SELECT * FROM product WHERE PCategory='food'
The query should return a resultset containing one or more rows that match the WHERE condition, in this case, 'food'.Now, assume that we change the URL into something like this:http://duck/index.asp?category=food' or 1=1--Now, our variable v_cat equals to "food' or 1=1-- ", if we substitute this in the SQL query, we will have:
SELECT * FROM product WHERE PCategory='food' or 1=1--'
The query now should now select everything from the product table regardless if PCategory is equal to 'food' or not. A double dash "--" tell MS SQL server ignore the rest of the query, which will get rid of the last hanging single quote ('). Sometimes, it may be possible to replace double dash with single hash "#".
However, if it is not an SQL server, or you simply cannot ignore the rest of the query, you also may try' or 'a'='a
The SQL query will now become:
SELECT * FROM product WHERE PCategory='food' or 'a'='a'It should return the same result.Depending on the actual SQL query, you may have to try some of these possibilities:' or 1=1--" or 1=1--or 1=1--' or 'a'='a" or "a"="a') or ('a'='a
Where can I get more info?One of the earliest works on SQL Injection we have encountered should be the paper from Rain Forest Puppy about how he hacked
PacketStorm.http://www.wiretrip.net/rfp/p/doc.asp?id=42&iface=6
Great article on gathering information from ODBC error messages:http://www.blackhat.com/presentations/win-usa-01/Litchfield/BHWin01Litchfield.doc
A good summary of SQL Injection on various SQL Server on http://www.owasp.org/asac/input_validation/sql.shtml
Senseport's article on reading SQL Injection:http://www.sensepost.com/misc/SQLinsertion.htm
Other worth readings:
http://www.digitaloffense.net/wargames01/IOWargames.ppt
http://www.wiretrip.net/rfp/p/doc.asp?id=7&iface=6
http://www.wiretrip.net/rfp/p/doc.asp?id=60&iface=6
http://www.spidynamics.com/whitepapers/WhitepaperSQLInjection.pdf
SQL Server June 2005 Community Technology Preview
SQL Server 2005 is Microsoft's next-generation data management and analysis software designed to deliver increased scalability, availability, and security to enterprise data and analytical applications while making them easier to create, deploy, and manage.
SQL Server June 2005 Community Technology Preview (CTP) is the first version of SQL Server 2005 made available for general testing. Previous versions have been available only to customers enrolled in the SQL Server 2005 beta program or those with an MSDN subscription. Please note that you cannot deploy SQL Server June 2005 Community Technology Preview in production environments. Also, peer-to-peer support is available through the SQL Server 2005 newsgroups listed in the Resources section below. SQL Server June 2005 Community Technology Preview is available from these locations:
• DVDs. This Web page lets you order both a DVD containing the SQL Server June 2005 CTP and a DVD containing the SQL Server 2005 Readiness Kit that provides additional information such as white papers and hands-on labs. You can also order Visual Studio 2005 Beta 2.
• Downloads. To download an edition of SQL Server 2005, please select an edition in the Downloads box in the upper right and click Go.
• BetaPlace. If you are enrolled in the SQL Server 2005 beta program, SQL Server June 2005 CTP downloads are available from the BetaPlace Web site.
• MSDN Subscription. SQL Server June 2005 CTP is also available if you subscribe to MSDN Universal, Enterprise, or Professional.
SQL Server June 2005 Community Technology Preview (CTP) is the first version of SQL Server 2005 made available for general testing. Previous versions have been available only to customers enrolled in the SQL Server 2005 beta program or those with an MSDN subscription. Please note that you cannot deploy SQL Server June 2005 Community Technology Preview in production environments. Also, peer-to-peer support is available through the SQL Server 2005 newsgroups listed in the Resources section below. SQL Server June 2005 Community Technology Preview is available from these locations:
• DVDs. This Web page lets you order both a DVD containing the SQL Server June 2005 CTP and a DVD containing the SQL Server 2005 Readiness Kit that provides additional information such as white papers and hands-on labs. You can also order Visual Studio 2005 Beta 2.
• Downloads. To download an edition of SQL Server 2005, please select an edition in the Downloads box in the upper right and click Go.
• BetaPlace. If you are enrolled in the SQL Server 2005 beta program, SQL Server June 2005 CTP downloads are available from the BetaPlace Web site.
• MSDN Subscription. SQL Server June 2005 CTP is also available if you subscribe to MSDN Universal, Enterprise, or Professional.
Editions Available in this CTP
The following editions of SQL Server 2005 are available for download in the SQL Server June 2005 CTP:
Enterprise Edition Enterprise
Edition scales to the performance levels required to support the largest enterprise online transaction processing (OLTP), highly complex data analysis, data warehousing systems, and Web sites. Enterprise Edition's comprehensive business intelligence and analytics capabilities and its high-availability features such as failover clustering and database mirroring allow it to handle the most critical enterprise workloads. Enterprise Edition is the most comprehensive edition of SQL Server and is ideal for the largest organizations and the most complex requirements. Note: To evaluate 64-bit edition features, please download the Developer Edition.
Standard Edition (32-bit and 64-bit)
Standard Edition is the data management and analysis platform for small and medium-sized organizations. It includes the essential functionality needed for e-commerce, data warehousing, and line-of-business solutions. Standard Edition's integrated business intelligence and high-availability features provide organizations with the essential capabilities needed to support their operations. Standard Edition is ideal for the small- to medium-sized organization that needs a complete data management and analysis platform.
Workgroup Edition Workgroup
Edition is the data management solution for small organizations that need a database with no limits on size or number of users. Workgroup Edition can serve as a front-end Web server or for departmental or branch office operations. It includes the core database features of the SQL Server product line and is easily upgradeable to Standard or Enterprise Edition. Workgroup Edition is an ideal entry-level database that is reliable, robust, and easy to manage.
Developer Edition (32-bit and 64-bit)
Developer Edition allows developers to build any type of application on top of SQL Server. It includes all of the functionality of Enterprise Edition, but is licensed for use as a development and test system, not as a production server. Developer Edition is an ideal choice for independent software vendors, consultants, system integrators, solution providers, and corporate developers who build and test applications. Developer Edition can be upgraded to SQL Server Enterprise Edition for production use.
Express Edition
Express Edition is a free, easy-to-use, and simple-to-manage database. Integrated with Microsoft Visual Studio 2005, Express Edition makes it easy to develop data-driven applications that are rich in capability, more secure in storage, and fast to deploy. Express Edition is free and can be redistributed (subject to agreement), and functions as the client database as well as a basic server database. Express Edition is an ideal choice for low-end independent software vendors, low-end server users, nonprofessional developers building Web applications, and hobbyists building client applications.
Express Manager
SQL Server 2005 Express Manager is a new and free database management tool designed for ease of use with SQL Server Express Edition. Express Manager includes numerous features to simplify, automate, and reduce the complexity of database support and administration.
For more information about the differences in features and capabilities of the SQL Server 2005 editions, please review the SQL Server 2005 Features Comparison.
Subscribe to:
Posts (Atom)
Posts
