There's also another interesting variant of fuel injection this method we refer to is known as automated
as fuel injection
several years back manipulating Eskew old queries was not considered prone to optimization.
And the fact that even blind attacks were managed by trial and error seem to support this claim.
And attacker needed to see some returned information and react to it in a correct way.
The procedure would tend to look dissimilar most of the time
this belief proved false.
However when the new type of attack cropped up in 2008 judging from the scale of infection it was extremely
dangerous.
It was less vicious However as far as its results were concerned.
The aim of the attack was not to break into systems but to sniff out credentials to social networking
services or online gaming sites.
At any rate over a million websites were hit in the attack what sites were ripe for this attack.
The sites that were hit were above all written in.
Microsoft technology.
The second factor was that the sites were connected to a Microsoft as Cuil server.
Thirdly the targeted application would dynamically create as Kule commands and forward them to you our
addresses.
If you look at the entire address in a browser you would see their parameter equals parameter value
call to attack a site like this.
It was enough to send it something similar to the string you can see in the slide this method was practically
Fail-Safe.
If some of you haven't yet decoded the above message will try to break it into a more readable format.
We need to find a service that is vulnerable to as kewl injection and constructs queries in the way
that you can see below.
We need to check the responses from a web application to the supplied queries or to the applications
to a web server.
As you probably all noted all of the your addresses contain encoded as Cuil commands.
If we were able to decode them you would see that they look like this.
These are simple as Cuil commands.
Take a look at the server reactions.
If the reactions match your expectations you have found a perfect target for an automated attack.
You can send them the following as Q All command.
This is the long coded fragment you saw before.
We know that we can place eschewed commands inside.
You are right addresses.
This means that we can insert the above command and executed at the end.
As we mentioned over a million Web sites were vulnerable to this attack.
Why was the number so large.
Since an efficient attack technique has been developed why shouldn't it be automated program for this
popped up rather quickly.
As you can see the program's interface is not displaying correctly to be able to see what's written
there.
You need Chinese fonts installed in your system the application works by submitting one of the previously
seen tests into a web search engine of your choice.
Click Search or what we think is search the pain below will list websites that are prone to and ready
for and rescue all injection
Let's now see what the school code looks like.
But before there's a few words of introduction there's two aspects.
First we'll try to see how the information on the database and database structure can be obtained so
that we could execute some commands later.
We'll also move back to a topic that was broached earlier.
Two quotes there are two apostrophes and all commands we saw earlier just like this.
Why is this constructed in this manner.
All presentations here are demonstrated inside the CULE editor window and not in a client application
because of this we had to simulate in some way a code excerpt that was executed by a client application
itself to make it look as close as possible to the real code sent by a client application.
We split it into three rows.
The first and third row are constructed by an application except the double dashes in the third row
the dashes should be at the end of the second row.
But if there were in this case the command would not work for us since the double dashes are an end
of line marker.
What's beyond them is irrelevant to make an attack far less complicated.
It doesn't matter if they're followed by two or three apostrophes or No apostrophes at all.
We don't know what is ahead in the command and we don't need to know that.
All we want is to make sure that it won't be executed.
Let's see what will happen after executing this query.
This function is exclusive to Microsoft as well servers remember that we're again dealing with AS-P
dot net which is sure to be connected to a Microsoft as Cuil server
after the query is executed.
The server introduces itself.
We now know the version of the server will quicken the pace a little.
It's obviously possible to read a table row by row in a way that was shown earlier.
You could look up error messages to see the contents of individual rows but this presentation would
take ages in that case let's speed things up a bit.
Imagine that Rhodes is playing has been factored into the outline techniques will simply read more than
one row at a time.
We know that this version of rescue a server is sure to contain a table named sists tables.
Knowing the version we know that's for sure.
We also know the structure of syste tables.
It's well-known and publicly documented.
So let's try to ask the table for some data.
We still can't enter any arbitrary values but we can add code to part of the command formulated by the
application.
This means that we can for example add something like this.
Call them names and the result are obviously incorrect but we can see that there are some tables contained
in schemas and that they have identifiers as well.
If we were really determined we'd read this row by row until we found a name that draws attention.
Apart from knowing the table name also the names of columns are required.
Let's send a similar query this time referring to system columns.
This made us discover the names of columns and the names of tables in which the columns are contained.
The next part is quite easy.
Let's come back now to one of the queries we could for example focus on employees the identifier of
the table can be inserted in another query once it's executed.
It's visible that there really is a table there that has some specified columns.
You can check birthdate gender and other employee data will anticipate things a little assume that you're
interested in identifier.
Title gender and log in.
This is more than we can take by a general rule.
We can only request three values at a time since the table that is used by the original query has only
three columns.
This can't be changed.
You can instead ask for two or three values in a single column.
The results include identifier title logging and gender all clumped together.
You can't do it in any other way.
An hour or two pass.
After analyzing the database we've realized that additional employee information is contained not only
in the employee table.
It can be found also in the Contact table.
The tables are joined in the employee ID and contact ID fields.
We've discovered this in an interpretive process.
Now we simply wish to read the data since we can't do it in any other way.
This will be done in three columns again.
As it turns out we have the first and last name of passwords hash and the data we've seen before.
This information is pretty interesting and we can work around it.
To be honest we don't need to search any further.
At the end we should only arrange a table that contains a log of our activities if it exists.
This turns out successful.
There's no prompted error message will at last take a look at an automated attack after decoding the
string you've seen in one of the earlier slides.
The following code excerpt will appear two variables and a cursor are declared.
Then the cursor reads names from system tables.
This will be performed exactly like before.
The difference is that other system tables are used here.
Next the code will check whether user table data is read and check if a column is a text data type.
If it is looping through the rows in all found tables all found text data type columns the code will
execute and update command a script is inserted to a current table to a selected text data type column.
We can execute the code because instead of exec we're using print so that the data in the database is
not modified.
All the columns to which the script are injected down contain the following code.
What this means for a web application and its users is that everything that's displayed in their browsers
is now an active element.
By clicking anywhere on the page visitors connect to the site above and execute the code that is added
to it this script is constructed to steal credentials from visitors.
This is the end of planetes fuel injection attack used in conjunction with cross-site scripting and
attacks that will be discussed in a moment.