business articles
Upcoming SlideShare
Loading in...5

business articles



business article,article for business,business articles,articles for business

business article,article for business,business articles,articles for business



Total Views
Slideshare-icon Views on SlideShare
Embed Views



0 Embeds 0

No embeds



Upload Details

Uploaded via as Adobe PDF

Usage Rights

© All Rights Reserved

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
Post Comment
Edit your comment

    business articles business articles Document Transcript

    • How Bad Guys Hack Into Websites Using Sql InjectionSQL Injection is one of the most common security vulnerabilities on the web. Here Ill try to explainin detail this kind of vulnerabilities with examples of bugs in PHP and possible solutions.If you are not so confident with programming languages and web technologies you may bewondering what SQL stay for. Well, its an acronym for Structured Query Language (pronouncedsequel). Its de facto the standard language to access and manipulate data in databases.Nowadays most websites rely on a database (usually MySQL) to store and access data.Our example will be a common login form. Internet surfers see those login forms every day, youput your username and password in and then the server checks the credentials you supplied. Ok,thats simple, but what happens exactly on the server when he checks your credentials?The client (or user) sends to the server two strings, the username and the password.Usually the server will have a database with a table where the users data are stored. This tablehas at least two columns, one to store the username and one for the password. When the serverreceives the username and password strings he will query the database to see if the suppliedcredentials are valid. He will use an SQL statement for that that may look like this:SELECT * FROM users WHERE username=SUPPLIED_USER ANDpassword=SUPPLIED_PASSFor those of you who are not familiar with the SQL language, in SQL the character is used as adelimiter for string variables. Here we use it to delimit the username and password strings suppliedby the user.In this example we see that the username and password supplied are inserted into the querybetween the and the entire query is then executed by the database engine. If the query returnsany rows, then the supplied credentials are valid (that user exists in the database and has thepassword that was supplied).Now, what happens if a user types a character into the username or password field? Well, byputting only a into the username field and living the password field blank, the query wouldbecome:SELECT * FROM users WHERE username= AND password=This would trigger an error, since the database engine would consider the end of the string at thesecond and then it would trigger a parsing error at the third character. Lets now what would
    • happen if we would send this input data:Username: OR a=aPassword: OR a=aThe query would becomeSELECT * FROM users WHERE username= OR a=a AND password= OR a=aSince a is always equal to a, this query will return all the rows from the table users and the serverwill think we supplied him with valid credentials and let as in the SQL injection was successful .Now we are going to see some more advanced techniques.. My example will be based on a PHPand MySQL platform. In my MySQL database I created the following table:CREATE TABLE users (username VARCHAR(128),password VARCHAR(128),email VARCHAR(128))Theres a single row in that table with data:username: testuserpassword: testingemail: testuser@testing.comTo check the credentials I made the following query in the PHP code:$query=select username, password from users where username=.$user. and password=.$pass.;The server is also configured to print out errors triggered by MySQL (this is useful for debugging,but should be avoided on a production server).So, last time I showed you how SQL injection basically works. Now Ill show you how can we makemore complex queries and how to use the MySQL error messages to get more information about
    • the database structure.Lets get started! So, if we put just an character in the username field we get an error message likeYou have an error in your SQL syntax; check the manual that corresponds to your MySQL serverversion for the right syntax to use near and password= at line 1Thats because the query becameselect username, password from users where username= and password=What happens now if we try to put into the username field a string like or user=abc ?The query becomesselect username, password from users where username= or user=abc and password=And this give us the error messageUnknown column user in where clauseThats fine! Using these error messages we can guess the columns in the table. We can try to putin the username field or email= and since we get no error message, we know that the emailcolumn exists in that table. If we know the email address of a user, we can now just try with in both the username and password fields and our query becomesselect username, password from users where username= or andpassword= or email=testuser@testing.comwhich is a valid query and if that email address exists in the table we will successfully login!You can also use the error messages to guess the table name. Since in SQL you can use thetable.column notation, you can try to put in the username field or user.test= and you will see anerror message likeUnknown table user in where clauseFine! Lets try with or users.test= and we haveUnknown column users.test in where clause
    • so logically theres a table named users .Basically, if the server is configured to give out the error messages, you can use them toenumerate the database structure and then you may be able to use these informations in anattack.Copied with permission from: