Your SlideShare is downloading. ×
0
SQL Injections - A Powerpoint Presentation
SQL Injections - A Powerpoint Presentation
SQL Injections - A Powerpoint Presentation
SQL Injections - A Powerpoint Presentation
SQL Injections - A Powerpoint Presentation
SQL Injections - A Powerpoint Presentation
SQL Injections - A Powerpoint Presentation
SQL Injections - A Powerpoint Presentation
SQL Injections - A Powerpoint Presentation
Upcoming SlideShare
Loading in...5
×

Thanks for flagging this SlideShare!

Oops! An error has occurred.

×
Saving this for later? Get the SlideShare app to save on your phone or tablet. Read anywhere, anytime – even offline.
Text the download link to your phone
Standard text messaging rates apply

SQL Injections - A Powerpoint Presentation

10,556

Published on

A presentation going over various SQL injections and how to secure your website and server from them. Written by Vadim Gellerman.

A presentation going over various SQL injections and how to secure your website and server from them. Written by Vadim Gellerman.

Published in: Technology
1 Comment
4 Likes
Statistics
Notes
  • plz snd slids in this mail
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
No Downloads
Views
Total Views
10,556
On Slideshare
0
From Embeds
0
Number of Embeds
1
Actions
Shares
0
Downloads
493
Comments
1
Likes
4
Embeds 0
No embeds

Report content
Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
No notes for slide

Transcript

  • 1. SQL Injection
    Vadim Gellerman
  • 2. What is SQL Injection?
    SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed. This allows alteration of, for example, a hyperlink, which would then cause a false positive query result from the database and grant you access.
  • 3. 3 Classes of SQL Injection
    SQL Injection can be broken up into 3 classes:
    Inband - data is extracted using the same channel that is used to inject the SQL code.
    This is the most straightforward kind of attack, in which the retrieved data is presented
    directly in the application web page
    2. Out-of-Band - data is retrieved using a different channel (e.g.: an email with the results of
    the query is generated and sent to the tester)‏
    3. Inferential - there is no actual transfer of data, but the tester is able to reconstruct the
    information by sending particular requests and observing the resulting behaviour of the
    website/DB Server.
  • 4. Inband is the most common, so let’s focus on that:
    Assume that you have a website with this existing hyperlink:
    http://[sitedomain]/products/products.asp?productid=123
    This is a common format, and clicking it would take you to the product with ProductID = 123.
    From a SQL standpoint, this would could look like:
    SELECT ProductName, ProductDescription FROM Products WHERE ProductNumber = 123
    Since the product id is actually visible in the link, it’s not very safe, and is open to alteration and injection.
    Append or 1=1 to the link, to make it:
    http://[sitedomain]/products/products.asp?productid=123 or 1=1
    Now from a SQL standpoint this becomes:
    SELECT ProductName, Product Description FROM Products WHERE ProductNumber = 123 OR 1=1
    Since 1 = 1 is always true, this grants you access to the database, and displays all Product Names and Descriptions.
  • 5. Inband ctd.
    Some other examples of SQL injection through the inbound use of a hyperlink are:
    http://www.mydomain.com/products/products.asp?productid=123; DROP TABLE Products
    http://www.mydomain.com/products/products.asp?productid=123 UNION SELECT user-name, password FROM USERS
    The first will drop the products table, while the second while return two tables, the productID, and the union joined table with a list of user names and passwords.
  • 6. SQL Injection for Login Credential Manipulation
    SQL injection can also be used to grant login access onto a website, or online database GUI.
    In order to do this, you use true statements to bypass security, or in some cases by using the administrative rights account.
    When logging onto a site, or server, the user name and password you put in is compared to an encrypted list in order to determine what type of access, if any, you have.
    By using a true statement, such as ‘or 1=1’ will cause the database to believe you input proper credentials.
  • 7. Defending against SQL Injection
    URL based injection:
    Avoid using clear text when coding in SQL.
    If your database and webpage are constructed in a way where you can view the data, it’s open to injection.
    http://mysite.com/listauthordetails.aspx?SSN=172-32-9999
    As in prior example, you could add a drop, or other command, to alter the database.
    Passwords, and other sensitive information need to be either encrypted or one way hashed. There is no full proof way to defend from injection, but by limiting sensitive information, you can insure that your information is at least somewhat protected.
  • 8. Defending Against Injection ctd.
    Login based injection:
    Restrict input field length. Instead of allowing an unlimited amount of characters to be entered for user name and password, restricting them will make it more difficult for someone to run a malicious query. While it may not prevent direct read access, it can prevent statements like drop.
    User privileges:
    Have a “Superuser/Admin” with full rights, but limit other users to only the things they need to do. This way, if someone accesses the database, they’ll have a restricted amount of privileges.
    Use proper escapes strings, generally created through PHP.
    $SQL = "SELECT * FROM users where username = "mysql_real_escape_string($POST['user']);
    When someone tries to access the database using a command like OR 1’”;, their query would return ’ OR 1’, because your query was created to have a defined escape string.
  • 9. FIN

×