SQL INJECTION ATTACKS

Sql injection is the ability to inject sql commands into the database engine through an existing application. The SQL Injection attack is possible when the programmers who write the code behind the page neglect to properly escape strings that are used in SQL queries. Programs common build SQL queries such to check values. For example the SQL statement: will return one row if the given user/password combination exists in the table users.

How to find out which server is on work before breaking in to the site for access, an attacker needs to know which SQL engine is at the back end. If the site has web page extensions like .asp, .aspx etc. then there is a high chance of SQL Server or MS Access. If the pages end as .jsp it could be an Oracle system at your end. If the pages are ending as.php, I guess it will be MySQL.

For example, if the web application is not well designed (not coded well) the attackers may read and alter the data present in the database. Instead of entering the username and password, the attackers enter some query to get the information from the database.

Ex: If you enter the string ( ' OR ''=‘ ) as both user name and password you can ensure that the WHERE clause always returns true. Without knowing any user names or passwords you can by-pass the log in screen. In this example you get the user name of the first person in the table. SELECT name from users WHERE name='name' AND password='password (ACTUAL) SELECT name from users WHERE name='' OR ''='' AND password='' OR ''='' [  this always returns true and allows him to access].

In some cases we don’t know the name of the table or the column names, but we can use the same techniques to find these out. We need to find out the name of the database that they are using. The function DATABASE() will give that value (but you have to guess at it as before). When we know the name of the database being used we can get the names of the tables.

Known real-world examples: On November 1, 2005, a high school student used SQL injection to break into the site of a Taiwanese information security magazine from the Tech Target group and steal customers' information. On August 17, 2009, the United States Justice Department charged an American citizen Albert Gonzalez and two unnamed Russians with the theft of 130 million credit card numbers using an SQL injection attack. On July 24-26, 2010, attackers from within Japan and China used an SQL injection to gain access to customers' credit card data from Neo Beat (an Osaka-based company) that runs a large online supermarket site

One more cause for injection: Metadata: Almost all SQL databases are based on the RDBM (Relational Database Model) . One important fact for SQL Injection Amongst Codd's 12 rules for a Truly Relational Database System: Metadata (data about the database) must be stored in the database just as regular data . Therefore, database structure can also be read and altered with SQL queries .

The common attacks are: Finding out the tables in a database. Finding out the column names in a database. Using the ORDER BY clause to find out the number of columns used in the database.

Preventing SQL injection: The various techniques used to prevent SQL injections are: Parameterized query Stored procedure Regular expression to discard input string . Hiding detailed error messages to the user. Have a less privileged user/role of your application in database etc.

Conclusion Protecting against SQL Injection requires Strong Design, correct input validation etc.