DB Types and Characteristics
When testing a web application,
we sometimes lack prior knowledge of the underlying database system,
so we should be prepared to interact with different SQL database variants.
There are many DB variants that differ in syntax, function, and features.
In this section we are going to focus on two of the most common database variants,
MySQL and Microsoft SQL Server.
To explore MySQL basics,
we can connect to the remote MySQL instance from our local Kali machine.
Using the mysql command,
we’ll connect to the remote SQL instance by specifying root
as username and password,
along with the default MySQL server port 3306.
From the MySQL console shell,
we can run the version function
to retrieve the version of the running SQL instance.
We’ll clear the output with Control L.
We can also verify the current database user
for the ongoing session via the system_user function,
which returns the current username and hostname for the MySQL connection.
The database query we ran confirmed that we are logged in
as the database root user through a remote connection.
We can now collect a list of all databases running in the MySQL session
by issuing the show command,
followed by the databases keyword.
As an example,
let’s retrieve the password of the offsec user present in the mysql database.
Within the mysql database,
we’ll filter using a SELECT statement for the user and authentication_string value,
belonging to the user table.
Next, we’ll filter all the results
via a WHERE clause that matches only the offsec user.
To improve its security,
the user’s password is stored in the authentication_string field
as a Caching-SHA-256 algorithm.
A password hash is a ciphered representation
of the original plain-text password.
Having covered the basics of MySQL, let’s explore MSSQL.
MSSQL is a database management system
that natively integrates into the Windows ecosystem.
Kali Linux includes Impacket,
a Python framework that enables network protocol interactions.
We can run impacket-mssqlclient
to connect to the remote Windows machine running MSSQL
by providing a username,
a password,
and the remote IP,
together with the -windows-auth keyword.
This forces NTLM authentication (as opposed to Kerberos).
To begin,
let’s inspect the current version of the underlying operating system
by selecting the @@version.
Our query returned valuable information
about the running version of the MSSQL server
along with the Windows Server version,
including its build number.
We can clear the output again with Control L.
To list all the available databases,
we can select all names from the system catalog.
Since master, tempdb,
model, and msdb are default databases,
we want to explore the custom offsec database
because it might contain data belonging to our target.
We can review this database by querying the tables table,
in the corresponding information_schema.
Our query returned the users table as the only one available in the database,
so let’s inspect it by selecting all of its records.
We’ll need to specify the dbo table schema between the database and the table names.
The users table contains two columns, username and password,
and two rows.
Our query returned the clear text password for both usernames.
Having covered the basic syntax peculiarities
for MySQL and MSSQL databases,
next we’ll learn how to manually exploit SQL injection vulnerabilities.