I was using this presentation when delivering our meetup about SQL Injections. You can find the video of that event at https://youtu.be/akpe3vKFeoc More information about our professional services (including training and consulting) can be found at https://lifemichael.com

1. SQL Injections
Haim Michael
May 2nd
, 2023
All logos, trade marks and brand names used in this presentation belong
to the respective owners.
life
michae
l

2. © 2008 Haim Michael 20230307
What is SQL Injection?

3. © 2008 Haim Michael 20230307
What is SQL Injection?
 SQL Injection takes place when the attacker succeeds
injecting malicious SQL code into the executed SQL
statements on the attacked server side.

4. © 2008 Haim Michael 20230307
Types of SQL Injections

5. © 2008 Haim Michael 20230307
Retrieving Hidden Data
 This type of attack takes place when the hacker succeeds in
modifying SQL statement in order to get additional hidden
data.

6. © 2008 Haim Michael 20230307
Retrieving Hidden Data
 When the table has the released column we can easily
overcome that column and get all data including of those
products that still weren't released.
SELECT * FROM products WHERE category='food' AND released = 1
https://website.com/products?category=food'--
SELECT * FROM products WHERE category='food'--' AND released = 1

7. © 2008 Haim Michael 20230307
Retrieving Hidden Data
 When the table has the rows of various categories we can
easily bypass the category limitation and get the data of all
products from all categories.
SELECT * FROM products WHERE category='food' AND released = 1
https://website.com/products?category=food'+OR+1=1--
SELECT * FROM products WHERE category='food' OR 1=1--' AND released=1

8. © 2008 Haim Michael 20230307
Modifying Application Logic
 This type of attack takes place when the hacker succeeds in
modifying the application logic through the modification of
SQL statements (e.g. When logging into application without
credentials).
Changing the username into admin'-- and avoid the
password will result in
SELECT * FROM users WHERE username='admin' AND password='ab$80'
SELECT * FROM users WHERE username='admin'--' AND password=

9. © 2008 Haim Michael 20230307
Data from Other Tables
 This type of attack takes place when the hacker succeeds
getting data from other tables.
Changing the category into
' UNION SELECT username, password from users--
will result in the following query:
SELECT * FROM products WHERE category='food'
SELECT * FROM products WHERE category='' UNION
SELECT username, password from users--

10. © 2008 Haim Michael 20230307
Information about The Database
 There are many SQL queries we can use for getting useful
information about the database.
 Web applications that return detailed error messages might
reveal information about the database, and its tables.
SELECT VERSION()

11. © 2008 Haim Michael 20230307
Blind SQL Injections
 Blind SQL Injections take place when the HTTP responses do
not contain the results of the relevant SQL query or the details
of the database errors.

12. © 2008 Haim Michael 20230307
SQL Injections Detection

13. © 2008 Haim Michael 20230307
Detection Tools
 Most of the SQL Injections vulnerabilities can be found using
tools that perform automatic tests.
sqlmap - https://sqlmap.org free open source
invicti - https://invicti.com
burp suite - https://portswigger.net/burp
jsql injection - https://github.com/ron190/jsql-injection free open source
app spider - https://www.rapid7.com/products/appspider
acunetix - https://www.acunetix.com/vulnerability-scanner

14. © 2008 Haim Michael 20230307
Manual Detection
 We can manually detect SQL Injections vulnerabilities by
conducting systematic set of tests in every entry point of the
application.
Submitting single quote character ' and looking for errors or other anomalies.
Submitting boolean conditions, such as OR 2=2 and OR 1=2 and looking for
differences in the responses.

15. © 2008 Haim Michael 20230307
Vulnerable Websites to Practice
 There are many vulnerable web applications you can install
on your server in order to practice SQL Injections. Doing so
will provide you with safe environment to practice your testing
legally.
Buggy Web Application (bWAPP) - http://itsecgames.com
Damn Vulnerable Web Application (DVWA) - https://github.com/digininja/DVWA
Google Gruyere (Gruyere) - https://google-gruyere.appspot.com/
Web Goat (WebGoat) - https://owasp.org/www-project-webgoat/
OWASP Mutillidae II (Multillidae) - https://github.com/webpwnized/mutillidae

16. © 2008 Haim Michael 20230307
Different Parts of The Query

17. © 2008 Haim Michael 20230307
SQL Injections in Different Parts
 Most of the SQL Injections take place within the WHERE
clause of a SELECT query.
 The SQL Injections vulnerabilities can occur at any location
within the query, and within different query types, such as the
following ones:
UPDATE statements - within the WHERE clause or the updated values.
INSERT statements - within the inserted values
SELECT statements - within the name of the table or the column
SELECT statements - within the ORDER BY clause.

18. © 2008 Haim Michael 20230307
Different Contexts

19. © 2008 Haim Michael 20230307
Various Different Contexts
 We can perform the SQL Injection attack using any
controllable input that is processed as a SQL query by the
application.
Query String
Web FORM
Uploaded File
Web Service Response

20. © 2008 Haim Michael 20230307
Various Different Contexts
 The various different formats might provide us with various
possibilities to obfuscate the attack.
SELECT * FROM users

21. © 2008 Haim Michael 20230307
Second Order SQL Injection

22. © 2008 Haim Michael 20230307
First & Second Order SQL Injections
 When a first order SQL Injection takes place, the application
takes the input from a HTTP request, and incorporate that
input into a SQL query in an unsafe way.
 When a second order SQL Injection takes place, the
application takes the input from a HTTP request, and stores it
for a future use. At this point nothing harm happens. Later,
when handling another request, the application retrieves the
stored data and incorporates it into a query.

23. © 2008 Haim Michael 20230307
Database Specific Vulnerabilities

24. © 2008 Haim Michael 20230307
SQL has Variations
 There are many differences between the common databases.
SQL has different dialects. Every database and its dialect. As
a result of that, each and every database might have its own
specific SQL Injections techniques.

25. © 2008 Haim Michael 20230307
How to Prevent SQL Injection

26. © 2008 Haim Michael 20230307
Prepared Statement
 Most of the SQL Injections vulnerabilities can be prevented by
using parameterized queries (prepared statement).
PreparedStatement statement = connection.prepareStatement(
“SELECT * FROM products WHERE category ?“);
ResultSet set = statement.executeQuery();
 Make sure that the string the prepared statement query use is
hard coded. Make sure to avoid the use of variables that hold
those strings. That can lead to the use of malicious code.

27. © 2008 Haim Michael 20230307
White Listing
 Creating a white list of permitted input will successfully
complement the use of prepared statement.

28. © 2008 Haim Michael 20230307
Questions & Answers
Thanks for Your Time!
Haim Michael
haim.michael@lifemichael.com
+972+3+3726013 ext:700
life
michae
l