Attacking Applications: SQL Injection & Buffer Overflows

 AKA: Code Injection  Common Issues  Both used to attack applications  Both generally caused by programming flaws  Both usually delivered via user input field  Both caused by invalid parameters (not verified)  Countermeasures for both  Utilize secure programming methods

 Occurs when an app processes user-provided data to create an SQL statement without first validating the input.  Read or modify a database by compromising the meaning of the original query  Results  1. Attacker gets to remotely execute system commands, or  2. Attacker takes control of database server

 1. Search for websites with login page or other input or query fields  2. Test using single quotes  3. Use SELECT to retrieve data, or  Use automated tool: Absinthe    Why it works:

 Identifying vulnerabilities  Database Finger-Printing  Determine Database Schema  Extract / Add / Modify Data  Perform DoS  Evade Detection  Bypass Authentication  Execute Remote Commands  Perform Privilege Escalation  Install Malware

 Practice Defensive Coding  Change default admin login information  Disable default admin login account  Validate / Sanitize user input  Use strong firewall rules  Block ports: 1434 (SQL & mysql); (Oracle)  Don’t display error messages  Remove Stored Procedures, but rather use Prepared Statements  Session encryption

 Use escape commands  escapeshellcmd(): decreases risks involved in allowing user input to be passed to the shell  escapeshellarg(): convert scalar value into single- quote delimited string  Mysql_real-escape-string()  Sanitizes data before sending to MYSQL

  How it works:  

 Types  Stack based  Static locations for memory address space  Heap based  Dynamic memory address spaces  Countermeasures  IDS should look for NOP (No Operation) instructions  Don’t use: C or C++ commands that don’t provide argument checking. (C & C++ leave data integrity checking to programmer):  eg) strcpy(), strcat(), streadd()  Use functions that check buffer size – eg) strncopy()  DO use: Java or Perl or Lisp