Top 10 Tricks to exploit SQL Server Systems

12 January 2008 3 Comments

Suggested Reading Resources(Free of Cost!)

Protection for Mac and Linux Computers: Genuine Need or Nice to Have?
Learn how protecting computers running Linux, UNIX, Mac and the like, can prevent Windows malware being stored and distributed across your IT network reducing the risks to business.....

Vulnerability Management for Dummies
Get all the Facts and See How to Implement a Successful Vulnerability Management Program.....

Whether it is through manual poking and prodding or the use of security testing tools, malicious attackers employ a variety of tricks to break into SQL Server systems, both inside and outside your firewall. It stands to reason then, if the hackers are doing it, you need to carry the same attacks to test the security strength of your systems. Here are 10 hacker tricks to gain access and violate systems running SQL Server.

1. Direct connections via the Internet

These connections can be used to attach to SQL Servers sitting naked without firewall protection for the entire world to see (and access). DShield’s Port Report shows just how many systems are sitting out there waiting to be attacked. I don’t understand the logic behind making a critical server like this directly accessible from the Internet, but I still find this flaw in my assessments, and we all remember the effect the SQL Slammer worm had on so many vulnerable SQL Server systems. Nevertheless, these direct attacks can lead to denial of service, buffer overflows and more.

2. Vulnerability scanning

Vulnerability scanning often reveals weaknesses in the underlying OS, the Web application or the database system itself. Anything from missing SQL Server patches to Internet Information Services (IIS) configuration weaknesses to SNMP exploits can be uncovered by attackers and lead to database server compromise. The bad guys may use open source, home-grown or commercial tools. Some are even savvy enough to carry out their hacks manually from a command prompt. In the interest of time (and minimal wheel spinning), I recommend using commercial vulnerability assessment tools like QualysGuard from Qualys Inc. (for general scanning), WebInspect from SPI Dynamics (for Web application scanning) and Next Generation Security Software Ltd.’s NGSSquirrel for SQL Server (for database-specific scanning). They’re easy to use, offer the most comprehensive assessment and, in turn, provide the best results. Figure 1 shows some SQL injection vulnerabilities you may be able to uncover.

sql hacker fig1

Figure 1: Common SQL injection vulnerabilities found using WebInspect.

Popularity: 3% [?]

3 Comments »

List of all the SQL Injection Strings | Hacking Truths said:

[...] go into detail on why these string work as all these details have been given in my previous article Top 10 Tricks to exploit SQL Server Systems [...]

# 3 October 2008 at 11:15 pm

Top 15 SQL Injection Scanners | Hacking Truths said:

[...] are not aware of SQL Injection Attack and How it works you need to read my previous article “Top 10 Tricks to exploit SQL Server Systems” [...]

# 3 October 2008 at 11:17 pm