RE: Oracle SQL Injection vulnerability

I am also not too familiar with SQL injection techniques but found the
following site very useful:
http://www.unixwiz.net/techtips/sql-injection.html

It has straightforward steps on what each statement is testing, but be
careful if they are sharing live oracle databases with the test
environment you are using, as what may seem like simple requests to the
db could bring the server down, especially if you have v.large data sets


e.g. a statement such as (anything' OR 'x'='x )in a large data set could
take a couple of days for the oracle server to work out, run this two or
3 times and the server will be running at 100% load - so if possible
keep an eye on the oracle server's load whilst running these tests and
kill any requests you know 'you' have made or get your DBA to check for
you.

Hope this helps in some way

Regards

Dave C

-----Original Message-----
From: listbounce@xxxxxxxxxxxxxxxxx [mailto:listbounce@xxxxxxxxxxxxxxxxx]
On Behalf Of Attari Attari
Sent: 19 November 2007 09:32
To: pen-test@xxxxxxxxxxxxxxxxx
Subject: Oracle SQL Injection vulnerability

Hi Group,

I'm doing a penetration test for a client on their web
portal. When I give ' on the username field I was
received with an error from the server:

Unspecified error
ORA-01756: quoted string not properly terminated

Does that mean the site is vulnerable to SQL
Injection? I tried ' OR 1=1-- and ' OR '1'='1'-- but I
get same error message.

Any help would be much appreciated.

Clone


Meet people who discuss and share your passions. Go to
http://in.promos.yahoo.com/groups


------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------



--

AWD Moneyextra and AWD Chase de Vere are trading names of AWD Moneyextra Limited, which is authorised and regulated by the Financial Services Authority (FSA). AWD Moneyextra Limited is a wholly-owned subsidiary of AWD Group plc, a member of AWD Holding AG, Europe's premier independent financial services group.

Registered Office: 1 King Street, Manchester, M2 6AW.
Registered in England No. 3685041.
VAT Registration No. 50337 4571
Please visit our website at www.moneyextra.com

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------

Relevant Pages

  • [NEWS] Oracle Database and Report Engine Multiple Vulnerabilities
    ... Oracle Database and Report Engine Multiple Vulnerabilities ... allows attackers to cause SQL injection, directory traversal, gather ... Oracle Reports, a component of the Oracle Application ...
    (Securiteam)
  • sqlninja 0.2.3 released
    ... Fancy going from a SQL Injection to a full GUI access on the DB server? ... Take a few SQL Injection tricks, add a couple of remote shots in the registry to disable Data Execution Prevention, mix with a little Perl that automatically generates a debug script, put all this in a shaker with a Metasploit wrapper, shake well and you have the latest release of sqlninja! ...
    (Pen-Test)
  • Re: Our 2000 Server was compromised and it has all the security patches.
    ... SQL injection - thats pretty easy to avoid (even though ... Anyone who has a server should do this before ... from Korea I believe attempted manually hacking into the ... one last note for you Symantec customers - I ran ...
    (microsoft.public.security)
  • RE: Oracle SQL Injection vulnerability
    ... and is executing the input as a statement. ... When I give ' on the username field I was received ... Does that mean the site is vulnerable to SQL Injection? ... Cenzic finds more, "real" vulnerabilities fast. ...
    (Pen-Test)
  • Re: SQL Injection prevention
    ... >company than a hosting company. ... this client is a long time client of ... >danger to my sites/DB's on the server. ... >do sql injection and therefor concerned about the site going live on my ...
    (microsoft.public.sqlserver.security)