[Autogenerated] for this section.
We will be moving back into our demonstration environment and showing how
to interact with a remote my SQL Server and how this can be used to collect
information as a network security engineer.
This will include the initial connection,
displaying tables and fields that exist as well as examples of various queries.
So now let's move into our demonstration environment and see
how we can communicate with a my SQL Server So if we look at
the beginning of this module,
the first thing we're going to import is the my sequel dot connector
module and these other two modules listed here.
We are going to use a little bit later and the first thing we're going to look
at here is this little code block and this uses the connect method of that
module to try to connect into that targeted my SQL Server and in this case that
my SQL Server sits at 10.10 dot 10.1 oh one.
The my sequel user name and password is main and password super
secure here and you can also specify a database here.
If you're going to only be sending commands to it which are targeted at a
specific database and or if your permissions on that.
My SQL Server are very limited and you're only allowed to query
to a specific table that's located on this.
My SQL Server once that's done then we can the second
line that uses the cursor method.
So what the cursor method allows you to do is it allows you to
retrieve information from the connected.
My SQL Server and it is using this,
my cursor variable that you're going to be querying using the different SQL
statements that we're going to review through this script.
So the first part of this script is this going to be
doing something rather simple?
We're connecting to it with the connect method,
we are setting the cursor with the cursor method and then
we are going to off of that cursor,
we're going to execute a couple of commands using SQL onto that.
My SQL Server So the first code block that we're going to be taking a
look at is this one and what this specific one does is it's going to
return the different username and hostname information that is
contained for each one of the users.
So it's going to list all of the users for each one of the
different databases that exist on the my sequel server.
And then it's going to print them out.
And then the second little code block we're going to do here is we're going
to show all the databases that are returned from that.
My SQL Server Now keep in mind whenever you do a
command like the show databases,
it's only going to show you the databases that your
specific user is allowed to see.
So if we execute this we'll see the first output that has returned here.
Now this first one here, this is the first code block,
it'll give you the user names that exist on this server.
So main and then there's a user for info schema,
the session one, the sys one and then route.
Then it'll show you what hostname or host address that is
assigned for each one of those specific users.
In this case we have three different username entries for the
main username and one is for everything,
one is for only for a specific I.
P.
Address and the last one is for the local host.
The second piece here, this is the database piece.
So this is all of the different databases that exist on the my sequel
server and in this case we have five different databases,
four of which are system databases that come installed.
If you just install my SQL including information schema
performance scheme of my SQL insists.
And then one last database that we just sort of added in
there with some sort of _____ data.
So we can show it displayed,
that's called test database Now if we return back to our code here,
let's just sort of quickly comment out this block and show this second block and
with the second block of code is going to do so that this whole block here is
we're going to be specifying a specific database.
So we're going to be collecting information from
only one of those five databases.
And what we're going to do is we're going to list the tables
that exist within that specific database.
So in this case we're only going to show the tables that come
from the database named test database one.
So if we run this it'll be pretty simple.
There's only one table.
So here we can list that.
There's only one table that exists in this database and it's called Test Table
one that gives you the information of the tables that exist.
So now if we we're gonna leave that one on we're gonna show this code now
what this code is going to do is it's going to dig in and it's going to
display fields that exist within that test table.
So we run that we got a whole bunch of information because
we just threw some _____ data in here so we'd have
something to return and display.
So in this case we have three different test fields we have test field one,
field two and field three.
So why would you want to do this?
From a security standpoint?
Obviously you know why a database administrator would want to have this
information but why would you as a network security person care keep in
mind that a lot of different products use a my sequel back end to hold
the information that they collect.
So if that information that they're collecting is just
sort of something that's low security and it's irrelevant
then it doesn't really matter.
But most of these systems contain some information in there.
My sequel databases that can be used to exploit the system further.
This can include real user names, their addresses,
their information, their telephone numbers,
email addresses slack I.
D.
S.
Teams I.
D.
S potential passwords although usually they would be salted
and hashed as well as traffic records, you know,
problem reports and some of these databases may include a list of all
of the different equipment names and management I.
P.
Addresses and and so on.
All of that information can be used to further exploit the system and
whenever you're hunting around either from a preventative standpoint or
from an offensive standpoint you can use as much data as possible and
how you use that will sort of depend on what information it is you're
actually collecting.
So as with any of these things,
if you're coming from a defensive standpoint from security you're trying
to make sure that this data is not easily accessible.
So obviously if you're able to use a script similar to this and gather
information from my SQL Server without having proper permissions or using a
username that's not normally allowed to access it,
then you need to perform additional steps in order to secure it further.
And you could as the network security person in Globomantics For example,
if there was one of the systems that's running my SQL as the back end and you
were able to write a little script that says just probe it,
See if you can probe it,
see if you can gather information if you can get simple information can you get
more detailed information and it can just run through and sort of hit it just
sort of like n map would be used to you know check for ports on a machine and
see what what information can I collect.
Can I get this far?
Oh I can can I get a little bit further?
And obviously that's important from a defensive standpoint because
you can sort of say this is where your system is weak and that's
where we need to add additional security.
And from an offensive standpoint this is where we can sort of push at that
pinch point of whatever system we're targeting and try to gain additional
information in order to gain additional access.
So now with that let's move on from this demonstration
section and move into our summary.