1. Analysis of SQL injection prevention using a proxy server By: David Rowe Supervisor: Barry Irwin

2. Presentation Outline Introduction to the problem (SQL injection) Motivation for the project (example) Block diagram of work focus Current status Timeline Concluding remarks Questions

3. SQL injection SQL Injection is a method by which the parameters of a Web-based application are modified in order to change the SQL statements that are passed to a database. An attacker is able to insert a series of SQL statements into a 'query' by manipulating data input.

4. SQL injection

5. Example Vulnerable web page

6. In ASP, a critical vulnerability is the way in which the query string is created. example: var SQL = "select * from users where username = ' "+ username +" ' and password = ' "+ password +" '"; Example

7. Username: ‘;drop table users-- the 'users' table will be deleted, denying access to the application for all users

8. Example Query executed: select * from users where username = “ drop table users

9. Example

10. Implementation Step

11. Current Status Analyse the structure of SQL query commands Build a filter that will check allowable patterns of SQL statements Create a proxy server that will filter SQL commands. Prevent a SQL injection attack to a database using this proxy server. Prove that SQL injection can be prevented using the filter developed to work on the proxy server. Produce a list of best practices for –Web design –Database administration

12. Current Status Working proxy server –Extracts the SQL from a TDS packet –Prevents SQL injection attacks White list Black list Gray list –Logs Extracted SQL queries Halted SQL Work in progress: –Benchmarking –Error reporting to database administrator –Project write up

13. Results - Filter

14. diagrams; : ; Sql injection attempt with: “diagrams; in design - in this section we design the class diagrams; this is because the class” Found with search signature: ; found match using black list by : by Sql injection attempt with: “by in diagrams define the data structure required by an application. We also look at” Found with search signature: by found match using white list, so this query is safe Query Count: 950 bad query count: 150 took 45.4673 seconds average time to process a query: 0.0478603 seconds

15. Performance issues Advantages –Independent of flaws in application coding and database privileges –Separate server with real time analysis Disadvantages –False positives also filtered out too –Won’t work if data is encrypted –May turn out to be resource intensive

16. Timeline First semester: –Project proposal –Presentation 1 –Literature survey –Project website and Honours Blog –Design and implementation Second Semester –Benchmarking –Final write up thesis short paper –Project poster

17. Questions