How can I decode SQL Server traffic with wireshark? - sql-server

I can capture the packets using wireshark, but I can't decode the stream into anything intelligible.
This item in the WireShark bug database suggests that maybe this isn't possible in SQL Server 2005 or newer. But several people on Stack Overflow claimed this was a good method in answers to this question:
How to validate SQL Server traffic is encrypted?
Any help appreciated.

Edit (2017-05-02): Microsoft Network Monitor - has been replaced by Microsoft Message Analyzer - which serves the same purpose. See also comment below this answer or the answer further down for how to use it!
Note: Microsoft Message Analyzer was deprecated in late 2019, and is no longer available for download.
Original Answer
There is another much underrated tool from Microsoft itself: 'Microsoft Network Monitor'. Basically this is very similar to wireshark with the exception that some specific MS protocols have better parser and visualisation support than wireshark itself and obviously it would only run under windows ;-).
The tool is quite old and looks abandoned (havn't seen a newer release so far) but still does an good job and the grammar for defining new protocols is quite neat/interesting - so this still possess a lot of power for the future.
Analysis Example - Recording is filtered for TDS - so the other packets are discared mostly:
This is also true for sql server connections. The MNM can even visualize the resultsets going over the wire - quite neat. Nonetheless wireshark as mentioned above would be sufficient to validate encryption and applied certificates on the wire itself. Means it can understand the TDS-Protocoll fully.
Handling TLS
Also with an extension (so called experts) 'NmDecrypt' and the right certificates (including private keys) - it is possible to decrypt protocolls - quite nice for TDS which uses TLS INSIDE of TDS - no wonder - no one has really implemented that yet as a fully supported protocoll for wireshark ;)
So far - regarding MSSQL-Traffic - or to be more precice TDS-Protocol this is the best tool I've come across so far. Wireshark is cool - but in this case MNM is 'better'. Have phun! ;)
Links for the tools:
Microsoft Network Monitor: http://www.microsoft.com/en-us/download/details.aspx?id=4865
NMDecrypt: http://nmdecrypt.codeplex.com/releases/view/85581

Not wireshark, but for me the Microsoft Message Analyzer worked great for that.
To get all the sent commands
Start a new session
Add Live Trace as as Data Source
Select Scenario (I chose Local Network Interfaces)
Enter a session filter expression like *address == 10.1.2.129 to filter only traffic to your sql server.
Click start
Right click on column header in the massage table and select Add columns...
Add TDS > SQLBatch > SqlBatchPacketData > SQLText
This should give you something like the following
Unfortunately there is no autoscroll implemented at the moment, but you can sort by timestamp and have the new queries popping up at the top.

The question that you are refering to is how to prove that the traffic is encrypted.
So they were using wireshark to show that you could not read it.
The encryption was weak on earlier versions of SQL server, but I don't think that it is easy to decrypt SQL Server 2005 traffic.

Wireshark decodes and shows you captured data when understand the protocol (and layer). That means the captured data isn't encripted.
If the data is encripted (SSL, ie), WS will only show SSL handshakes and raw data.

Related

Failed to connect MySQL SSL connection to Google Data Studio

I have a customer trying to connect a Google Data Studio data source to MySQL, via SSL connection, however, they are receiving an Error Code: a113b4a0.
What does this error ID represent, and how do I help them resolve this problem?
Found the solution -
Apparently for SSL connection in Data Studio, we need to provide the cert file in .pem file format instead of .crt format.
We can use openssl to convert the cert file.
Perhaps the product team can change the error message to something more meaningful instead of just error ID (the error ID changed for every attempt). Also the documentation is not easy to find pertaining to this issue (didn't come across any)
p/s: will like to vote down whom vote down the question. If the person think the question is of low quality, should at least provide the answer to those whom need it, not just discount others without giving the the solution.
The solution to this problem I was having was to enable TLSv1.1 in MySQL server's configuration. What it looked like was that Google Data Studio's SSL configuration was not capable of connecting via TLSv1.2 or TLSv1.3 versions of the protocol.
This is enabled by including in /etc/my.cnf.d/server.cnf:
[mysqld]
tls_version = TLSv1.1,TLSv1.2,TLSv1.3

node.js sql server driver - is it still being actively developed?

The Microsoft node.js sql server driver (https://github.com/Azure/node-sqlserver) has not had any commits for 11 months. Anyone know what's going on with this effort? My company is using it actively, but has run across some issues that led me to the repo and the discovery that it seems to have been abandoned. Lots of open bugs also.
Should we give up on this driver and try another? Any recommendations?
Microsoft, please weigh in here.
I emailed the Microsoft main contributor and he was very helpful, although he did admit that officially MS has never declared one way or the other if they were going to continue support. Guess we'll wait and see.
In regards to my original problem - this info may help someone.
I was using queryRaw and listening for events to build the response. This method allows the user to submit multiple sql queries in one request (just separate them with ;). A large text datatype field was getting truncated and I couldn't figure out why. Turns out that the 'more' parameter that is supplied by the driver means that you must concatinate the return data.
Lots of trial and error when figuring out this driver.

Pass file to and from JBossAS to client

I've got client server application, with JBossAS7 and client which uses remote EJB provided by the server. I have to pass file from client to server, where it will be further processed via InputStream. Also have to pass file from server to client, where on server i get OutputStream. File size is not limited, it might be even 5GB. What can I do to implement solution to this case? Passing byte[] array seems not to be a good solution, RMI limits size what I've read. RMIIO is GPL (i need solution free for commercial use). Is http transfer the only reasonable way to do this?
edit: it seems that RMIIO was always LGPL!
You might consider setting up a Netty Server running on JBoss AS as showed in this Netty Tutorial and pass data using bare sockets.
Another option is HTTP by means of a simple HTTP Transfer using a Servlet for example.
I'd exclude EJB since they are transactional component, and admitted you managed to pass this data through RMI-IIOP, you still have to set up a huge Transactional timeout.
Hope it helps.
RMIIO is LGPL (different from just GPL), which is free for commercial use and is not viral (assuming you have not modified the rmiio library).

How to access databases from within Delphi XE Professional IDE?

I cannot access ANY database by ANY means from within Delphi XE Professional. What I mean by accessing the data base is:
having the live database appear via
components in the Object Inspector,
when the connected property is set
to true
using the Data Explorer to create
and explore database connections
EDIT:
SORTED !!
The core problem is that communication into the database, including specifically the communication generated by the IDE and any code built using the drivers was problematic.
Confounding and masking sub-issues were:
Missing or misplaced DLLs.
The Data Explorer does not fully support dbExpress drivers.
There is a bug within the 2009 IDE code, found by Chee-Yang Chau when writing the dbxFirebird driver, which limits static linking of drivers into Delphi. It is not known if this bug extends to 2010 or XE.
When using the Object Inspector, it is easy to cause the IDE to revert changed connection parameters to their default values.
Some drivers had incorrect default values (eg assuming the client dll was always gdb32.dll irrespective of whether the database was Interbase or Firebird).
Installation of two versions of Interbase led to some clashes in database communication - server names generated by the tools were odd; and the view of the databases depended on which installation of the Interbase tools were used.
The documentation available is of varying dates; refers to different versions; and as a result often appears contradictory.
END EDIT:
Approaches tried:
Multiple databases
Multiple different drivers/components
Accessing the database through other external tools, such as IBSQL and Flame Robin.
Raising questions (here and here) on SO.
Raising questions on the support forums for Firebird, Embarcardo, and Flame Robin.
Environment:
OS: Windows 7 Ultimate 64bit:
Delphi Embarcadero® RAD Studio XE Professional Version 15.0.3953.35171
Database: W1-V2.5.0.26074 Firebird 2.5 (64 bit)
Connection technology: dbExpress
Delphi Professional does not support Firebird with the native dbExpress drivers that come with Delphi. You need the Enterprise or Architect version of Delphi in order for the native firebird dbExpress driver to work.
I have Delphi 2010 Professional. I didn't want to spend the extra money on the E or A version and I failed to read the feature matrix to see that the Firebird dbExpress driver is not available with the Pro version.
I have found a few really nice videos that show how to connect to Firebird using Delphi. However, when I tried to follow along with my Professonal version nothing worked.
Shame on me and more shame on Embarcadero for touting that Delphi supports Firebird in big bold print but not mentioning that you need the Enterprise or Architect version except in the tiny fine print.
I can now write code to access Firebird within the IDE. I have (limited, but sufficient) access to the drivers within the IDE. Specifically, the drivers appear in the Data Explorer, which can be used to generate default values for the SQLConnection (dbExpress component). These can be accessed and used within the Object Inspector. The workaround to the IDE bug quoted below is necessary to ensure the communication parameters are correct. When writing database code, it is necessary to compile in the source for the dbExpress driver.
The following code is the minimum, with minimum parameter set, necessary to establish and test a database connection:
unit Unit2;
interface
uses Classes, SqlExpr, Dialogs, dbxDevartInterbase;
var SQLConnection1 : TSQLConnection;
implementation
{$R *.dfm}
begin
SQLConnection1 := TSQLConnection.Create(nil);
with SQLConnection1 do
begin
ConnectionName := 'TestConnection';
DriverName := 'DevartInterBase';
LibraryName := 'dbexpida40.dll';
VendorLib := 'fbclient.dll';
GetDriverFunc := 'getSQLDriverInterBase';
Params.Clear;
Params.Add('User_Name=SYSDBA');
Params.Add('Password=masterkey');
Params.Add('Database=localhost:C:\Program Files\Firebird\Firebird_2_5\examples\empbuild\employee.fdb');
Open;
If Connected then ShowMessage('Connection is active');
Free;
end;
end.
The workaround, courtesy of Bob Swart on one of the Codegear forums is:
The trick is to select a
ConnectionName value, which will then
assign a value to the Driver property
and all other properties like
LibraryName, VendorLib and
GetDriverFunc.
Then, make changes - if needed - to
the subproperties of the Driver
property, and finally clear the name
of the Driver property.
This will leave all your changes in
the Params list (which you can also
manually edit if you wish).
Note: leave the ConnectionName set -
if you clear that one, the parameters
will be cleared again.
Now you can compile your application
and deploy it without the need for
dbxdrivers.exe or dbxconnections.ini
(but you need to deploy the DLLs
specified in the LibraryName and
VendorLib, of course).
Also make sure to set LoginPrompt to
False and leave LoadParamsOnConnect
set to False, too.
BOUNTY AWARD
I have awarded the bounty to this answer as it was the one that pointed me away from investigation of the IDE, its installation and configuration, to investigation of the connection into the database.
END
DK about Firebird 64 bit - -no experience. But I've always had a lot of trouble with dbExpress. Never any problem with the included IB components suite. But there is a lot of confusion with IB versions...
But IMO you're best served using the ADO ('DBGo') components as opposed to any proprietary IB or Delphi specific drivers. What you need is an ADO provider for IB, available #:
http://www.ibprovider.com/eng/ - and as others have said, avoid using localhost, use 127.0.0.1, or better still, determine the true IP address of your workstation (ping machine-name...) And are you sure you don't have some kind of firewall or intrustion protection that may be involved?
You also need to make sure that your IB connection is configured properly - local or TCP, and no, don't use quotation marks for your names, pwrds, etc. The error message you got seems to indicate that you're trying to connect via TCP and it's not properly configured. What happened between the time it worked and the time it didn't work? Shut down Delphi? Reboot the machine? Explain please....
No 'special permissions' are needed - you simply need to ensure that your database server and client are properly installed and configured. In terms of functionality you can do everything with the pro version - just that the drivers etc aren't included in the package.
Again, IMO go for ADO and you'll never look back.
HTH,
MNG
Have you tried Paradox via the Borland Database Engine (BDE) and related components: TTable TQuery TStoredProc TDatabase and TSession?
If memory serves me correctly, at least as far back as Delphi 3, the distinguishing factor between "professional" and the "higher-level" editions has been the type of database development "out the box".
In Delphi 1, the BDE was the only way to do out-the-box database development.
Delphi 2 permitted a custom database layer by abstracting parts of the database component hierarchy.
Delphi 3 Professional provided BDE and drivers for file-based databases and Interbase.
One level up (Enterprise?*) they provided BDE drivers for typical client-server database access: SQL Server, Sybase, Interbase, Oracle,... (and native drivers for Interbase)
Another level up (Architect?*) introduced multi-tier development with Midas. Unfortunately, Borland took a step back with Midas, because the multi-tier components were again hard-wired to the BDE. (This was resolved in Delphi 4.)
?* Please note, I may be mistaken about the exact naming of these editions. Around about that time I formed the opinion that Borland was merely coming up with "grander" names in order to charge more for features that didn't really offer as much benefit as the 'big-cheque-writing-CIOs' came to believe - leaving developers to deal with the fallout. (Yes, I have battle-scars from Midas I.)
Rant aside, the theory was....
If one embarked on entry-level database development, you would purchase Delphi ?? Professional. Develop your system against a file-based database or Interbase via the BDE.
If you later needed to scale-up: you would upgrade Delphi, purchase your chosen SQL RDBMS, switch your connectivity via the TDatabase component, and apply the few necessary tweaks.
NOTE: In Delphi 3, you could switch to Native Interbase (personally not recommended) or use third-party components for non-Midas development. From Delphi 4 up, ADO and DevExpress started receiving more attention and nowdays, the BDE seems to be pretty much forgotten.
Of course theory & practice seldom frequent the same pubs. However, with a few cautionary pointers, you should be able to develop a significant file based solution that can be upgraded relatively painlessly.
Keep your business logic out of the database. This is quite possibly the biggest and most frequently encountered error. Huge chunks of systems are often written in triggers and stored procedures, making it more difficult to maintain or migrate a system.
Avoid platform-specific database techniques. This should go without saying, but if you don't explicitly look out for them, you will encounter problems.
Particularly relevant to file based database systems, many support special locking mechanisms - avoid them! They don't scale well to large multi-user systems in any case.
Generating of artificial keys often varies by platform: Generators, IDENTITY columns, how you get the new value.
Plan your system for large volumes of data. Identify the high-transaction tables, and avoid using uncontrolled retrieval of all records. I'd also avoid the TTable in this situation - BDE does a lot of interesting background things with TTable, and behaviour can vary according to driver and platform.
Disclaimer: All this was a long time ago, so some of the details may be a bit sketchy.
Disclaimer2: I don't have any experience with Delphi XE specifically. I currently use D5 professionally, and D2009 in my personal capacity.

Determining DB in use from http query

Is there a simple way to determine what database is in use behind a website from an external HTTP request? i.e., I make an HTTP request, get back whatever data is going to come from the webserver - can I inspect any of that and reliably determine that DB in use? I am thinking not, but figured I would ask this group.
No. The same answer could come from a static file, a SQL database, or a martian telepath.
No and for a good reason. If there were it would be a security hole. Unless it is a part of the application functionality.
For most websites, the answer is no, however, you may find security holes which reveal this information. For example, it's possible to get this information if the site isn't coded against sql injection attacks. For example, try entering the following as your user name:
'; select version();
On shared hosting system, they often don't have a firewall protecting the database from external connections.
Try the following:
telnet localhost 3306
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
5
5.0.51a—Bjb-W
This tells you that the server is running MySQL version 5.0.51a. MSSQL and Sybase also identify their version number before the client attempts to login.
Probably the easiest way is just to ask the webmaster. If your not a hacker, and the site isn't a bank, they will likely tell you.

Resources