SQL INJECTION Diwakar Kumar Dinkar M.Tech, CS&E Roll Diwakar Kumar Dinkar M.Tech, CS&E Roll

Agenda Introduction Scope Attack Vectors – Query Manipulation – Code Injection What’s Vulnerable? DEMO Testing: Blind Injection Countermeasures Tools Resources References Introduction Scope Attack Vectors – Query Manipulation – Code Injection What’s Vulnerable? DEMO Testing: Blind Injection Countermeasures Tools Resources References

Introduction SQL injection is a basic attack used either to – gain unauthorized access to a database. – retrieve information directly from the database. The basic principles underlying SQL injection are simple and these types of attacks are easy to execute. SQL injection is a basic attack used either to – gain unauthorized access to a database. – retrieve information directly from the database. The basic principles underlying SQL injection are simple and these types of attacks are easy to execute.

Scope of Attack Application Software having data base at the back end such as accounting packages, automation systems etc. Web applications such as online banking, ecommerce systems etc. Application Software having data base at the back end such as accounting packages, automation systems etc. Web applications such as online banking, ecommerce systems etc.

Attack Vectors Query Manipulation Code Injection Query Manipulation Code Injection

Query Manipulation Query manipulation typically involves modifying the SQL statement through set operations (e.g., UNION) or altering the WHERE clause to return a different result. The most well known attack is to modify the WHERE clause of the user authentication statement so the WHERE clause always results in TRUE. Query manipulation typically involves modifying the SQL statement through set operations (e.g., UNION) or altering the WHERE clause to return a different result. The most well known attack is to modify the WHERE clause of the user authentication statement so the WHERE clause always results in TRUE.

Code Injection Code injection is when an attacker inserts new SQL statements The classic code injection attack is to append a SQL query to the vulnerable SQL statement. Code injection is when an attacker inserts new SQL statements The classic code injection attack is to append a SQL query to the vulnerable SQL statement.

What’s Vulnerable? An application is vulnerable to SQL injection for only one reason – end user string input is not properly validated and is passed to a dynamic SQL statement without any such validation. Stateless nature of many web applications, allows the user to write data to the database or store it using some other means between web pages. An application is vulnerable to SQL injection for only one reason – end user string input is not properly validated and is passed to a dynamic SQL statement without any such validation. Stateless nature of many web applications, allows the user to write data to the database or store it using some other means between web pages.

DEMO

Consider the following example A simplistic web application may check user authentication by executing the following query and checking to see if any rows were returned – SELECT * FROM users WHERE username = 'bob' and PASSWORD = 'mypassword' The attacker attempts to manipulate the SQL statement to execute as – SELECT * FROM users WHERE username = 'bob' and PASSWORD = ‘mypassword' or 'a' = 'a' Based on operator precedence, the WHERE clause is true for every row and the attacker has gained access to the application. The set operator UNION is frequently used in SQL injection attacks. The goal is to manipulate a SQL Consider the following example A simplistic web application may check user authentication by executing the following query and checking to see if any rows were returned – SELECT * FROM users WHERE username = 'bob' and PASSWORD = 'mypassword' The attacker attempts to manipulate the SQL statement to execute as – SELECT * FROM users WHERE username = 'bob' and PASSWORD = ‘mypassword' or 'a' = 'a' Based on operator precedence, the WHERE clause is true for every row and the attacker has gained access to the application. The set operator UNION is frequently used in SQL injection attacks. The goal is to manipulate a SQL Example: Query Manipulation

DEMO

Example: Code Injection The attacker may use the following phrase as a code manipulation to delete a account from the database:- SELECT * FROM users WHERE username = 'bob' and PASSWORD = 'mypassword'; DELETE FROM users WHERE username = 'admin'; The attacker may use the following phrase as a code manipulation to delete a account from the database:- SELECT * FROM users WHERE username = 'bob' and PASSWORD = 'mypassword'; DELETE FROM users WHERE username = 'admin';

Testing: Blind Injection The simplest way to confirm that a SQL injection possibilities is there is that use a single quote (‘) in both user name and password field. If you get a error something related to database connectivity like Microsoft OLEDB, [Oracle]ODBC, java.sqlException connection error then it is vulnerable to SQL injection. The simplest way to confirm that a SQL injection possibilities is there is that use a single quote (‘) in both user name and password field. If you get a error something related to database connectivity like Microsoft OLEDB, [Oracle]ODBC, java.sqlException connection error then it is vulnerable to SQL injection.

Countermeasures You as a developer can prevent SQL injection vulnerability by simply rejecting the meta characters such as single quote (‘),double quote (“) = ; (space) in the user input. Another way is that you only allow alphabets (A-Z),(a-z), numbers(0-9), and a dot(.) in the user input, also called as white listing. You as a developer can prevent SQL injection vulnerability by simply rejecting the meta characters such as single quote (‘),double quote (“) = ; (space) in the user input. Another way is that you only allow alphabets (A-Z),(a-z), numbers(0-9), and a dot(.) in the user input, also called as white listing.

Tools There are some tools available that lets the user to attack on a SQL vulnerable sites automatically. SQLNinja, Hexjector, Haviz are few popular tools, generally used by attackers for the automated SQL injection. There are some tools available that lets the user to attack on a SQL vulnerable sites automatically. SQLNinja, Hexjector, Haviz are few popular tools, generally used by attackers for the automated SQL injection.

Resources Following are the demo sites for practising the different type of sql injecton Following are the demo sites for practising the different type of sql injecton

References 1. N.E.H.A.( 2. Software Hacking; Das Patnaik, Nishant N.E.H.A.( 2. Software Hacking; Das Patnaik, Nishant 3.

Thank You! “Always remember, great power comes with great responsibilities. Use it wisely! ” Any questions, btw? ;) “Always remember, great power comes with great responsibilities. Use it wisely! ” Any questions, btw? ;)