Hi,

> I am performing a vulnerability test against a web application and would
> like some advice. The application is running IIS 4.0 - all the remote
> exploits are patched.

Wrong : all KNOWNS remote exploits are patched. You are still exposed to
a
lot of remote exploits. IIS will never be safe. Remember the period
before
summer this year ? 3 exploits, all remote exec as Admins, in 6 weeks !
Did someone call Guinness Records ?

IIS is just not choice. For your info, Apache Unix can operate ASP pages
if
you really need them.

> The backend is just a bunch of VB scripts, getting
> info from an oracle8 server on AIX.

So, as soon as a problem will occur on your IIS server, the intruder will
gain full access to your entire system. How soon it is ? For some test,
it can be in 15 minutes...

> Most of the places where input is accepted must strip out unexpected
> characters, but I located one field on a form where input was not
properly
> validated. I've tried posting different strings into the field with
limited
> success. All I'm able to get is errors back. I'd like to take advantage
of
> some stored procedures in oracle.

Using stored procedures is a good thing. When using them, a compromised
front-end server can not do anything he wish against your database... of
course, as long as your stored procedures do not offers to do anything.

> Could you look at the log of my activity
> below and provide advice on where to go next in order to compromise the
> database, or the server itself? I'd even be happy with the ability to
run a
> successful query through injection. It looks like their using a package
or
> stored procedure to post the query, and I'm having trouble breaking out
of
> it. Is it possible, if so, how should I go about it?

Well, its always possible to break through. But when you used stored
procedure,
its a bigger challenge. The last error message just say that nothing
correspond
to your request. I do not conclude that it used stored procedures.

Some others tests can be to satisfy some of the requests from this log
(like
a valid table name) but not all. May be with some valid parameters, your
try
will go deeper in the system and come back with more informations, or at
least,
differents from those one.

Also, all errors being from the line 128 in a single page, may be knowing
this
line will help us to suggest you something to try.

Jacques Bourdeau

> Input: '
> Result:
> Microsoft OLE DB Provider for ODBC Drivers error '80040e14'

> [Microsoft][ODBC driver for Oracle][Oracle]ORA-00907: missing right
> parenthesis

> E:\INETPUB\WEBSITE\CLAIM ENTRY\../systemmonitor/AdoRecordCount.asp, line
128

> Input: ')
> Result:
> Microsoft OLE DB Provider for ODBC Drivers error '80040e14'

> [Microsoft][ODBC driver for Oracle][Oracle]ORA-00923: FROM keyword not
found
> where expected

> E:\INETPUB\WEBSITE\CLAIM ENTRY\../systemmonitor/AdoRecordCount.asp, line
128

> Input: ') from
> Result:
> Microsoft OLE DB Provider for ODBC Drivers error '80040e14'

> [Microsoft][ODBC driver for Oracle][Oracle]ORA-00903: invalid table name

> E:\INETPUB\WEBSITE\CLAIM ENTRY\../systemmonitor/AdoRecordCount.asp, line
128

> Input: ') from policy
> Result:
> Microsoft OLE DB Provider for ODBC Drivers error '80040e14'

> [Microsoft][ODBC driver for Oracle][Oracle]ORA-00933: SQL command not
> properly ended

> E:\INETPUB\WEBSITE\CLAIM ENTRY\../systemmonitor/AdoRecordCount.asp, line
128

> Input: ') from policy -- "'"
> Result:
> Microsoft OLE DB Provider for ODBC Drivers error '80004005'

> [Microsoft][ODBC driver for Oracle][Oracle]ORA-06553: PLS-306: wrong
number
> or types of arguments in call to 'GETPOLICYNUMBER'

> E:\INETPUB\WEBSITE\CLAIM ENTRY\../systemmonitor/AdoRecordCount.asp, line
128

> Input: ') from getpolicynumber -- "'"
> Result:
> Microsoft OLE DB Provider for ODBC Drivers error '80004005'

> [Microsoft][ODBC driver for Oracle][Oracle]ORA-04044: procedure,
function,
> package, or type is not allowed here

> E:\INETPUB\WEBSITE\CLAIM ENTRY\../systemmonitor/AdoRecordCount.asp, line
128

> _________________________________________________________________
> Get your FREE download of MSN Explorer at
http://explorer.msn.com/intl.asp

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]