Advanced SQL Injection in Oracle databases

Author: Esteban Martínez Fayó
Contact: secemf@gmail.com
Publish date: February 2005

New Updated Material: In July 2005 a new version of this paper was presented at the Black Hat 2005 security conference in Las Vegas, USA. Click here to view the updated material.

This presentation is about new ways to exploit SQL Injection vulnerabilities in Oracle Databases. It shows, with working examples, many ways in that the Oracle database security could be bypassed and how to protect from these threats.

Topics:

• Introduction
• SQL Injection attacks
  • How to exploit
  • Exploit examples
  • SQL Injection in functions defined with AUTHID CURRENT_USER
  • How to get around the need for CREATE PROCEDURE privilege - Example
  • How to protect
• Buffer overflow attacks
  • How to exploit
  • Exploit examples
  • Detecting an attack
• Remote attacks using SQL Injection in a web application
  • Exploit examples
  • Web application worms
  • How to protect
• Summary
• Conclusions

The presentation includes many proof of concept exploit examples of these topics.

Download:

AdvancedSQLInjectionInOracleDatabases.zip (354 KB)

The zip file includes the presentation (in PDF format) and the example files.

Individual file download:

• AdvancedSQLInjectionInOracleDatabases.pdf (398 KB)
  
  
• BufferOverflowExploit_CreatingSYSDBAUser.sql (2 KB)
• BufferOverflowExploit_GettingOSAdmin.sql (2 KB)
• BufferOverflowExploit_SDO_CODE_SIZE_10g.sql (1 KB)
• SearchEmp.jsp (2 KB)
• SQLInjectionBecomingSYS.sql (2 KB)
• SQLInjectionExecutingOSCommand.sql (2 KB)
• SQLInjectionLimitation.sql (1 KB)
• SQLInjectionUploadingAFile.sql (2 KB)
• SQLInjectionVulCurUsr.sql (1 KB)

UPDATED July 2005

Download:

AdvancedSQLInjectionInOracleDatabases_BH.zip (116 KB)

The zip file includes the presentation (in PDF format) and the example files.

Individual file download:

• BH_US-05-Fayo.pdf (144 KB)

• BOF_BindShell.sql (4 KB)
• BOF_CreatingSYSDBAUser.sql (2 KB)
• BOF_GettingOSAdmin.sql (2 KB)
• BOF_SDO_CODE_SIZE_10g.sql (1 KB)
• SQLI_BecomingDBA.sql (1 KB)
• SQLI_BecomingSYS.sql (2 KB)
• SQLI_Limitation.sql (1 KB)
• SQLI_OSCommand.sql (2 KB)
• SQLI_UploadingAFile.sql (2 KB)
• TableEmp.asp (2 KB)