SQL Injection Josh Mann

What is SQL Injection  SQL injection is a technique for exploiting web applications that use client-supplied data in SQL queries without stripping potentially harmful characters first.

What applications are at risk  CGI  PHP  ASP  JSP  etc

Viewing the Source   'COSC 1200 '   Checking Grades   Username:   Password:   Submit 

Some SQL Injection True Statements  ' or 1=1--  " or 1=1--  or 1=1--  ' or 'a'='a  " or "a"="a  ') or ('a'='a  And many more I am sure

Remote Execution Example  '; exec master..xp_cmdshell 'ping '-- The ‘; will end the current statement allowing what ever else follows to be executed (shutdown, delete, update, etc)

Value of error statements  No Table named ‘Users’ Useful when trying to learn about the database and how it is built (describe and show)

Company vulnerabilities  Over 50% of companies may be vulnerable to this type of attack  Easy to protect against  Easy to learn

Why Do We Care  Allows access to protected and private information  Cost to business  Possible loss of information

Inspiration for this topic  COSC 1200 website for displaying students grades. Designed in PHP Using regular expression matching for password verification Not validating user input before attempting to use it in SQL query

Known Exploit  Attempted to produce my own SQL injection statements to break this application but ran short on time. Found 1 known exploit in the password matcher (used a regular expression as password)

Good point to the Application  The application does not display any user information even when compromised

References  html html  er.pdf er.pdf    ection/default.aspx ection/default.aspx  _papers/sql_injection_signatures_evasion.html _papers/sql_injection_signatures_evasion.html

Q&A