Extracting Useful Data

In order to extract useful data from the database, you normally need to know the names of the tables and columns containing the data you wish to access. The main enterprise DBMS’s contain a rich amount of database metadata that you can query to discover the names of every table and column within the database. The methodology for extracting useful data is the same in each case; however, the details differ on different database platforms. We will examine examples of extracting useful data from Oracle and MS-SQL databases.

An Oracle Hack

Consider an HR application that allows users to perform employee searches. A typical search employs the following URL:


This search returns the following results:

Screenshot from 2020-05-06 22:44:37

We attempt to perform a UNION attack, and so need to determine the required number of columns used in the query (which may differ from the number of columns returned in the application’s reponses). Injecting a query that returns a single column results in an error message:


[Oracle][ODBC][Ora]ORA-01789: query block has incorrect number of result columns

We continue adding additional NULL s to the injected query until no error message is returned, and our query is executed:


Screenshot from 2020-05-06 23:21:01

Note the blank line which has now been added to the table, containing the NULL results from our injected query.

Having determined the number of columns, we now need to find a column which has a string data type. Our first attempt is unsuccessful:


[Oracle][ODBC][Ora]ORA-01790: expression must have same datatype as corresponding expression

We target the second column, and this is successful, returning a row of data containing the input we specified:


Screenshot from 2020-05-06 23:22:36

We now have a means of extracting string data from the database. Our next step is to find out the names of the database tables that may contain interesting information. We can do this by querying the user_objects table, which displays details of user-defined tables and other items:


Screenshot from 2020-05-06 23:24:00

Many of these tables may contain sensitive data, including information about employees that we cannot legitimately access given our privilege level. An obvious point of initial attack is the table called USERS , which may contain credentials. We can discover the names of the columns within this table by querying the user_tab_columns table:


Screenshot from 2020-05-06 23:25:05

This output confirms that the USERS table does indeed contain sensitive data, including passwords and session tokens. We now have everything we need to extract any of this information. For example:


Screenshot from 2020-05-06 23:26:24

An MS-SQL Hack

Let’s take a look at a similar attack being performed against an MS-SQL data- base. Consider a retailing application that allows users to search a product catalog. A typical search uses the following URL:


This search returns the following results:

Screenshot from 2020-05-06 23:29:49

First, we need to determine the required number of columns. Testing for a single column results in an error message:


[Microsoft][ODBC SQL Server Driver][SQL Server]All queries in an SQL statement containing a UNION operator must have an equal number of expressions in their target lists.

We add a second NULL , and our query is executed, generating an additional item in the results table:


Screenshot from 2020-05-06 23:31:17

We now verify that the first column in the query contains string data:


Screenshot from 2020-05-06 23:32:39

Our next step is to find out the names of the database tables that may contain interesting information. We can do this by querying the sysobjects table, which contains details of all objects within the database. To retrieve only the user-defined objects, we specify the type U :


Screenshot from 2020-05-06 23:33:41

Again here, the Users table is an obvious place to begin extracting data. To discover the names of columns within the users table, we can query the syscolumns table:


Screenshot from 2020-05-06 23:34:44

We now have everything we need to extract the information within the Users table. For example:


Screenshot from 2020-05-06 23:35:51

NEXT is..Exploiting ODBC Error Messages (MS-SQL Only)…,,,,,,,,,