1. SQL injection Figure 1 By Kaveri Bhasin

2. Motive of SQL Injection Obtain data from database Modify system functions Insert data in the backend database

3. Figure 2.

4. Victims Mostly Web applications with user input facilities.

6. Simplest Procedure 1.Guess field names. 2.Construct a query and check for SQL status 3.If server gives error, field name is incorrect, else lets proceed…

7. Cont. With the correct field, construct SQL query and inject Example: 101 AND Len(( SELECT first_name FROM user_data WHERE userid =15613)) = 6

8. Paper overview Types of Vulnerabilities Measures Tools (Webgoat)

9. Types of vulnerabilities Database system vulnerability Type handling Injected filtered escape characters

10. Measures Web application design: Analyze against vulnerabilities Use strongly defined types and validation for user input Use parameterized queries

11. Tools Webgoat Developed by OWASP.org Free source to experiment and learnt about SQL injection

12. Conclusion SQL injection is a serious concern A single design error can be disastrous for the security of sensitive information

13. References Figure 1. http://ocliteracy.com/techtips/sql-injection.htmlhttp://ocliteracy.com/techtips/sql-injection.html Figure 2. “Towards an Aspect-Oriented Intrusion Detection Framework” Zhi Jian Zhu and Mohammad Zulkernine http://www.owasp.org/ http://www.spidynamics.com/papers/SQLInjectionWhitePaper.pdfhttp://www.spidynamics.com/papers/SQLInjectionWhitePaper.pdf