1. SQL Injection Josh Mann

2. What is SQL Injection  SQL injection is a technique for exploiting web applications that use client-supplied data in SQL queries without stripping potentially harmful characters first.

3. What applications are at risk  CGI  PHP  ASP  JSP  etc

4. Viewing the Source   'COSC 1200 '   Checking Grades   Username:   Password:   Submit 

5. Some SQL Injection True Statements  ' or 1=1--  " or 1=1--  or 1=1--  ' or 'a'='a  " or "a"="a  ') or ('a'='a  And many more I am sure

6. Remote Execution Example  '; exec master..xp_cmdshell 'ping 10.10.1.2'-- The ‘; will end the current statement allowing what ever else follows to be executed (shutdown, delete, update, etc)

7. Value of error statements  No Table named ‘Users’ Useful when trying to learn about the database and how it is built (describe and show)

8. Company vulnerabilities  Over 50% of companies may be vulnerable to this type of attack  Easy to protect against  Easy to learn

9. Why Do We Care  Allows access to protected and private information  Cost to business  Possible loss of information

10. Inspiration for this topic  COSC 1200 website for displaying students grades. Designed in PHP Using regular expression matching for password verification Not validating user input before attempting to use it in SQL query

11. Known Exploit  Attempted to produce my own SQL injection statements to break this application but ran short on time. Found 1 known exploit in the password matcher (used a regular expression as password)

15. Good point to the Application  The application does not display any user information even when compromised

16. References  http://www.securiteam.com/securityreviews/5DP0N1P76E. html http://www.securiteam.com/securityreviews/5DP0N1P76E. html  http://www.spidynamics.com/papers/SQLInjectionWhitePap er.pdf http://www.spidynamics.com/papers/SQLInjectionWhitePap er.pdf  http://www.unixwiz.net/techtips/sql-injection.html http://www.unixwiz.net/techtips/sql-injection.html  http://www.4guysfromrolla.com/webtech/061902-1.shtml http://www.4guysfromrolla.com/webtech/061902-1.shtml  http://msdn.microsoft.com/msdnmag/issues/04/09/SQLInj ection/default.aspx http://msdn.microsoft.com/msdnmag/issues/04/09/SQLInj ection/default.aspx  http://www.imperva.com/application_defense_center/white _papers/sql_injection_signatures_evasion.html http://www.imperva.com/application_defense_center/white _papers/sql_injection_signatures_evasion.html

17. Q&A