分类： BSD
2014-06-06 17:37:33
Whether it is through manual poking and prodding or the use of security testing tools, malicious attackers employ a variety of tricks to break into SQL Server systems, both inside and outside your firewall. It stands to reason then, if the hackers are doing it, you need to carry the same attacks to test the security strength of your systems. Here are 10 hacker tricks to gain access and violate systems running SQL Server. 1. Direct connections via the Internet These connections can be used to attach to SQL Servers sitting naked without firewall protection for the entire world to see (and access). DShield\'s Port Report shows just how many systems are sitting out there waiting to be attacked. I don\'t understand the logic behind making a critical server like this directly accessible from the Internet, but I still find this flaw in my assessments, and we all remember the effect the SQL Slammer worm had on so many vulnerable SQL Server systems. Nevertheless, these direct attacks can lead to denial of service, buffer overflows and more. 2. Vulnerability scanning Vulnerability scanning often reveals weaknesses in the underlying OS, the Web application or the database system itself. Anything from missing SQL Server patches to Internet Information Services (IIS) configuration weaknesses to SNMP exploits can be uncovered by attackers and lead to database server promise. The bad guys may use open source, homegrown or mercial tools. Some are even savvy enough to carry out their hacks manually from a mand prompt. In the interest of time (and minimal wheel spinning), I remend using mercial vulnerability assessment tools like QualysGuard from Qualys Inc. (for general scanning), WebInspect from SPI Dynamics (for Web application scanning) and Next Generation Security Software Ltd.\'s NGSSquirrel for SQL Server (for databasespecific scanning). They\'re easy to use, offer the most prehensive assessment and, in turn, provide the best results. Figure 1 shows some SQL injection vulnerabilities you may be able to uncover.  Figure 1: Common SQL injection vulnerabilities found using WebInspect.3. Enumerating the SQL Server Resolution Service Running on UDP port 1434, this allows you to find hidden database instances and probe deeper into the system. Chip Andrews\' SQLPing v 2.5 is a great tool to use to look for SQL Server system(s) and determine version numbers (somewhat). This works even if your SQL Server instances aren\'t listening on the default ports. Also, a buffer overflow can occur when an overly long request for SQL Servers is sent to the broadcast address for UDP port 1434. 4. Cracking SA passwords Deciphering SA passwords is also used by attackers to get into SQL Server databases. Unfortunately, in many cases, no cracking is needed since no password has been assigned (Oh, logic, where art thou!). Yet another use for the handydandy SQLPing tool mentioned earlier. The mercial products AppDetective from Application Security Inc. and NGSSQLCrack from NGS Software Ltd. also have this capability. 5. Directexploit attacks Direct attacks using tools such as Metasploit, shown in Figure 2, and its mercial equivalents (CANVAS and CORE IMPACT) are used to exploit certain vulnerabilities found during normal vulnerability scanning. This is typically the silverbullet hack for attackers penetrating a system and performing code injection or gaining unauthorized mandline access. 给主人留下些什么吧！~~
|
