경북대 보안동아리 KERT에서 주최한 보안 컨퍼런스 Kerference 발표자료 입니다.

1. NEFARIOUS
SQL
일시: 2016-7-23
장소:공대9호관 김동호

2. 1
Explaining what SQL injection really is in depth.
Moreover, why we need to know about SQL Injection
2
What is SQL Injection?
Variety of SQL
Injection Method
Table of
Contents
Explaining different types of SQL Injection method and
how it works.

3. 3
4
5
We are going to go through SQL Injection war game to
explain how SQL injection really works in live
SQL Injection
Tutorial
Ways to prevent
SQL Injection
We will go through how we can prevent SQL Injection
happening to our website
We will just quickly review what we have learned today
Review

4. What is SQL?
SQL Database & SQL Injection

5. What is
SQL?
• Structured Query Language (Standard Language)
• Proprietary extension standard language
• Function
• Select
• Insert
• update,
• Find
• Etc.…
• Variety of Dialects
• T-SQL
• PL/SQL
• JET SQL
• Many more

6. WHY SQL?

7. Reason Why
SQL
1 Allows users to access data
in relational database
management systems
2 Allows to embed within other
language using SQL
modules, libraries & pre-
compiers
3 Allows users to set
permissions on tables,
procedures, And views
4 Tons of more reason to use
SQL!!

8. Process of
SQL
• RDMBS
• SQL Engine
• Components
• Query Dispatcher
• Optimization Engines
• Classic Query Engine
• SQL Query Engine
• Etc.
• Classic Query Engine
• SQL Query Engine

9. History of
SQL
1970 1974 1978 1986
Dr. Edgar F. “Ted” Codd of
IBM is known as the father of
relational databases. He
described a relational model
for databases
Structured Query Language
appeared
IBM worked to develop
Codd’s ideas and released a
product named System/R
IBM developed the first
prototype of relational
database and standardized
by ANSI. The first relational
database was released by
Relational Software and its
later becoming Oracle

10. SQL DIAGRAM

12. Understanding SQL
query statements

13. Different types of
Query statements
1
2
3SELECT Statement
INSERT Statement
UPDATE Statement

14. SELECT
Statements
• Retrieving/selecting certain information from the database
• Commonly used with where statement as well

28. Update
Statements
• To modify one or more existing rows of data within a table
• Changing Value which it already exist(s)
• Similar to INSERT Statements but it usually contains WHERE statement

33. INSERT
Statements
• To create new row of data within a table
• Such as new account, audit log, etc….

37. Additional
Information
• Semicolon
• SQL comment syntax

47. http://mysite.com/color?colorid=4

52. Minimal Presentation

53. What is
SQL Injection?
• Injecting arbitrary pieces of malicious code
• Executed as a piece of code by the back end SQL server
• Giving undesired results
• Executing code through vulnerable input parameters
• Compromising the whole system

54. History of
SQL Injection
1999 2003 2013 cont
Common Vulnerabilities and
Exposures dictionary has
existed to keep track of and
alert consumers and
developers alike of known
software vulnerabilities
Structured Query Language
appeared on top 10 list of
Common Vulnerabilities and
Exposures dictionary
SQL Injection was top 1
vulnerability chosen by
OWASP
SQL Injection continues to be
on top of the list for
vulnerability on many
organizations

55. 2014 WHS Web
Vulnerability Report

57. Richard Alan Clarke
If you spend more on coffee than on IT security, you will be hacked. What’s more, you deserve
to be hacked
“ “

58. HOW SQL
INJECTION WORKS
Attacker Sends data containing SQL Fragments
CUSTOM CODE
Database
1
3 Attackers views unauthorized data
Example: $sql= “SELECT*FORM table WHERE id=‘”.$_REQUEST[‘id’].”’”;
Applications sends modified
queries to get the database and
query return values
2

59. Types of SQL Injection
Union Based
InclusiveError Based
Boolean
Executing
Time
Schema Discovery
Tautology
Single quote

60. Error Based SQL Injection

61. Single Character Injection Test

66. CarsByCylinders?Cylinders=V12
SELECTED Id, Name FROM Supercar WHERE
Cylinders = ‘V12’

67. CarsByCylinders?Cylinders=V12
SELECTED Id, Name FROM Supercar WHERE
Cylinders = ‘V12’‘
‘
‘

68. CarsByCylinders?Cylinders=V12
SELECTED Id, Name FROM Supercar WHERE
Cylinders = ‘V12’‘
‘ or 1=1--
‘

69. CarsByCylinders?Cylinders=V12
SELECTED Id, Name FROM Supercar WHERE
Cylinders = ‘V12’‘ or 1=1--
‘ or 1=1--
‘

72. Tautology
A tautology is a formula that is true in every possible
interpretation

73. Circumventing Access Controls

74. Circumventing Access Controls
UserName = johnsmith
Password = p@ssword

75. Circumventing Access Controls
UserName = johnsmith
Password = p@ssword
SELECT COUNT (*) FROM Users WHERE
UserName=‘johnsmith’ AND Password=‘p@ssword’

76. Circumventing Access Controls
UserName = johnsmith’ or 1=1--
Password = p@ssword
SELECT COUNT (*) FROM Users WHERE
UserName=‘johnsmith’ or 1=1--’ AND Password=‘p@ssword’

77. Circumventing Access Controls
UserName = johnsmith’ and 1=1--
Password = p@ssword
SELECT COUNT (*) FROM Users WHERE
UserName=‘johnsmith’ and 1=1--’ AND
Password=‘p@ssword’

78. Circumventing Access Controls
UserName = johnsmith’--
Password = p@ssword
SELECT COUNT (*) FROM Users WHERE
UserName=‘johnsmith’--’ AND Password=‘p@ssword’

79. Modifying Data and DB Objects
UserName= johnsmith’;update users set password=‘foo’--

80. Modifying Data and DB Objects
UserName= johnsmith’;update users set password=‘foo’--
UserName= johnsmith’;update item set price=price-1--

81. Modifying Data and DB Objects
UserName= johnsmith’;update users set password=‘foo’--
UserName= johnsmith’;update item set price=price-1--
UserName= johnsmith’;insert into….

82. Modifying Data and DB Objects
UserName= johnsmith’;update users set password=‘foo’--
UserName= johnsmith’;update item set price=price-1--
UserName= johnsmith’;insert into….
UserName= johnsmith’;drop table users--

83. Modifying Data and DB Objects
UserName= johnsmith’;update users set password=‘foo’--
UserName= johnsmith’;update item set price=price-1--
UserName= johnsmith’;insert into….
UserName= johnsmith’;drop table users--
UserName= johnsmith’;create login…

84. Union Based SQL Injection

85. Understanding Union Operators

92. Executing Union SQL Injection

114. Querying System Objects for schema
discovery

122. Extracting Schema Details with Union
Injection

131. Blind Based SQL Injection

132. Basic Attack Success Criteria

133. Basic Attack Success Criteria
The app needs to return internal exceptions which bubble up
from the underlying database

134. Basic Attack Success Criteria
The app needs to return internal exceptions which bubble up
from the underlying database
The query structure needs to allow the union operator to be
injected and the vector needs to return results to the app

135. Basic Attack Success Criteria
The command executed on the database can be manipulated
by the attacker

136. Boolean SQL Injection

145. How to prevent SQL Injection

146. Ways to prevent
SQL Injection
1 2
Implement Proper
Error Handling
Validating
Untrusted Data

147. Implementing Proper
Error Handling

152. Validating
Unstructured Data

163. More Prevention
Method
1
2
3
4
Query
Parameterization
Stored Procedures
Object Relational
Mappers
Using an IDS or
WAF

164. Questions?