xviii
Contents
Other Scenarios .....................................................................193
Escalating Privileges ................................................................... 194
SQL Server ............................................................................194
Privilege Escalation on Unpatched Servers ......................199
Oracle ....................................................................................200
SYS.LT .............................................................................201
SYS.DBMS_CDC_PUBLISH .........................................202
Getting Past the CREATE PROCEDURE Privilege ..............202
Cursor Injection ................................................................202
SYS.KUPP$PROC ........................................................... 203
Weak Permissions .............................................................203
Stealing the Password Hashes .....................................................204
SQL Server ............................................................................204
MySQL .................................................................................. 206
PostgreSQL ............................................................................206
Oracle ....................................................................................207
Oracle Components ..........................................................209
Out-of-Band Communication .....................................................211
E-mail ....................................................................................211
Microsoft SQL Server ......................................................211
Oracle ...............................................................................214
HTTP/DNS ............................................................................ 215
File System ............................................................................215
SQL Server .......................................................................216
MySQL .............................................................................218
Oracle ...............................................................................219
SQL Injection on Mobile Devices ..............................................219
Automating SQL Injection Exploitation .....................................223
sqlmap ....................................................................................224
Bobcat ....................................................................................225
BSQL ..................................................................................... 226
Other Tools ............................................................................ 227
Summary .....................................................................................228
Solutions Fast Track....................................................................229
Frequently Asked Questions .......................................................231
CHAPTER 5 Blind SQL Injection Exploitation ......................................233
Introduction .................................................................................233
Finding and Conrming Blind SQL Injection ............................ 234
Forcing Generic Errors ..........................................................235
Injecting Queries with Side Effects ....................................... 235