• Share
  • Email
  • Embed
  • Like
  • Save
  • Private Content
SQL Injections - A Powerpoint Presentation

SQL Injections - A Powerpoint Presentation



A presentation going over various SQL injections and how to secure your website and server from them. Written by Vadim Gellerman.

A presentation going over various SQL injections and how to secure your website and server from them. Written by Vadim Gellerman.



Total Views
Views on SlideShare
Embed Views



2 Embeds 3

http://ams.activemailservice.com 2
http://www.linkedin.com 1



Upload Details

Uploaded via as Microsoft PowerPoint

Usage Rights

© All Rights Reserved

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.


11 of 1 previous next

  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
  • plz snd slids in this mail
    Are you sure you want to
    Your message goes here
Post Comment
Edit your comment

    SQL Injections - A Powerpoint Presentation SQL Injections - A Powerpoint Presentation Presentation Transcript

    • SQL Injection
      Vadim Gellerman
    • What is SQL Injection?
      SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed. This allows alteration of, for example, a hyperlink, which would then cause a false positive query result from the database and grant you access.
    • 3 Classes of SQL Injection
      SQL Injection can be broken up into 3 classes:
      Inband - data is extracted using the same channel that is used to inject the SQL code.
      This is the most straightforward kind of attack, in which the retrieved data is presented
      directly in the application web page
      2. Out-of-Band - data is retrieved using a different channel (e.g.: an email with the results of
      the query is generated and sent to the tester)‏
      3. Inferential - there is no actual transfer of data, but the tester is able to reconstruct the
      information by sending particular requests and observing the resulting behaviour of the
      website/DB Server.
    • Inband is the most common, so let’s focus on that:
      Assume that you have a website with this existing hyperlink:
      This is a common format, and clicking it would take you to the product with ProductID = 123.
      From a SQL standpoint, this would could look like:
      SELECT ProductName, ProductDescription FROM Products WHERE ProductNumber = 123
      Since the product id is actually visible in the link, it’s not very safe, and is open to alteration and injection.
      Append or 1=1 to the link, to make it:
      http://[sitedomain]/products/products.asp?productid=123 or 1=1
      Now from a SQL standpoint this becomes:
      SELECT ProductName, Product Description FROM Products WHERE ProductNumber = 123 OR 1=1
      Since 1 = 1 is always true, this grants you access to the database, and displays all Product Names and Descriptions.
    • Inband ctd.
      Some other examples of SQL injection through the inbound use of a hyperlink are:
      http://www.mydomain.com/products/products.asp?productid=123; DROP TABLE Products
      http://www.mydomain.com/products/products.asp?productid=123 UNION SELECT user-name, password FROM USERS
      The first will drop the products table, while the second while return two tables, the productID, and the union joined table with a list of user names and passwords.
    • SQL Injection for Login Credential Manipulation
      SQL injection can also be used to grant login access onto a website, or online database GUI.
      In order to do this, you use true statements to bypass security, or in some cases by using the administrative rights account.
      When logging onto a site, or server, the user name and password you put in is compared to an encrypted list in order to determine what type of access, if any, you have.
      By using a true statement, such as ‘or 1=1’ will cause the database to believe you input proper credentials.
    • Defending against SQL Injection
      URL based injection:
      Avoid using clear text when coding in SQL.
      If your database and webpage are constructed in a way where you can view the data, it’s open to injection.
      As in prior example, you could add a drop, or other command, to alter the database.
      Passwords, and other sensitive information need to be either encrypted or one way hashed. There is no full proof way to defend from injection, but by limiting sensitive information, you can insure that your information is at least somewhat protected.
    • Defending Against Injection ctd.
      Login based injection:
      Restrict input field length. Instead of allowing an unlimited amount of characters to be entered for user name and password, restricting them will make it more difficult for someone to run a malicious query. While it may not prevent direct read access, it can prevent statements like drop.
      User privileges:
      Have a “Superuser/Admin” with full rights, but limit other users to only the things they need to do. This way, if someone accesses the database, they’ll have a restricted amount of privileges.
      Use proper escapes strings, generally created through PHP.
      $SQL = "SELECT * FROM users where username = "mysql_real_escape_string($POST['user']);
      When someone tries to access the database using a command like OR 1’”;, their query would return ’ OR 1’, because your query was created to have a defined escape string.
    • FIN