Chapter 13 Security Methods Part 3

SQL Injection Attack Many web applications take user input from a form Often this user input is used literally in the construction of a SQL query submitted to a database. For example: SELECT user FROM table WHERE name = ‘user_input’; An SQL injection attack involves placing SQL statements in the user input 12/27/2018 Web Security

Login Authentication Query Standard query to authenticate users: select * from users where user='$usern' AND pwd='$password' Classic SQL injection attacks Server side code sets variables $username and $passwd from user input to web form Variables passed to SQL query select * from users where user='$username' AND pwd='$passwd' Special strings can be entered by attacker select * from users where user='M' OR '1=1' AND pwd='M' OR '1=1' Result: access obtained without password 12/27/2018 Web Security

Some improvements … Query modify: select user,pwd from users where user='$usern‘ $usern=“M' OR '1=1”; Result: the entire table We can check: only one tuple result formal correctness of the result $usern=“M' ; drop table user;”? 12/27/2018 Web Security

CIT 380: Securing Computer Systems SQL Injection Attacker App sends form to user. Attacker submits form with SQL exploit data. Application builds string with exploit data. Application sends SQL query to DB. DB executes query, including exploit, sends data back to application. Application returns data to user. User ‘ or 1=1-- Pass Firewall Web Server DB Server CIT 380: Securing Computer Systems

SQL Injection in PHP $query = "select count(*) from users where username = '$username' and password = '$password'"; $result = @mysqli_query($dbc, $query); CIT 380: Securing Computer Systems

SQL Injection Attack #1 Unauthorized Access Attempt: password = ’ or 1=1 -- SQL statement becomes: select count(*) from users where username = ‘user’ and password = ‘’ or 1=1 -- Checks if password is empty OR 1=1, which is always true, permitting access. CIT 380: Securing Computer Systems

SQL Injection Attack #2 Database Modification Attack: password = foo’; delete from table users where username like ‘% Database executes two SQL statements: select count(*) from users where username = ‘user’ and password = ‘foo’ delete from table users where username like ‘%’ Principle of Least Privilege likely violated as web server user needs privileges to do all operators permitted on users, including deleting them. CIT 380: Securing Computer Systems

Preventing SQL Injection Attacks mysqli_real_escape_string() Prepared statements

post_message.php Script 13.6 on pages 444-5 http://csweb.hh.nku.edu/csc301/frank/ch13/post_message.php ch13\post_message.php

Assignment #22 http://csweb.hh.nku.edu/csc301/frank/bookorama/insert_bookPS.php