The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

C O M M O N   M Y T H

Many database administrators assume that it is not

necessary to defend the database against attacks that require authentication to

exploit. They may reason that the database is accessed by only a trusted

application that is owned by the same organization. This ignores the possibility

that a flaw within the application may enable a malicious third party to interact

with the database within the security context of the application. Each of the

possible attacks just described should illustrate why databases need to be

defended against authenticated attackers.

Attacking databases is a huge topic, which is beyond the scope of this book.

In this section, we will point you towards a few key ways in which vulnerabil-

ities and functionality within the main database types can be leveraged to

escalate your attack. The key conclusion to draw is that every database con-

tains ways of escalating privileges. Applying current security patches and

robust hardening can help to mitigate many of these attacks, but not all of

them. For further reading on this highly fruitful area of current research, we

recommend The Database Hacker’s Handbook (Wiley, 2005).

MS-SQL

Perhaps the most notorious piece of database functionality that an attacker can

misuse is the 

xp_cmdshell

stored procedure, which is built into MS-SQL by