Chapter 5 - SQL-Injection-NK.pdf
•
0 likes•24 views
This document discusses SQL injection, including what it is, real world examples, important SQL syntax, and prevention methods. SQL injection is a code injection technique that exploits security vulnerabilities in user input handlers to expose sensitive data from a database. It provides examples of SQL injection attacks, such as retrieving hidden data or subverting application logic. The document emphasizes that SQL injection is a serious threat and outlines techniques for preventing vulnerabilities like validating user input and using prepared statements.
Report
Share
Report
Share
Download to read offline
Recommended
SQl Injection.ppt
This presentation introduces SQL injection, a code injection technique that exploits security vulnerabilities in user input handlers to target databases. It provides examples of real-world SQL injection attacks, such as the theft of 130 million credit card numbers. The presentation demonstrates how SQL comments, logic statements, and multiple statements can be abused to perform unauthorized actions like dropping tables or updating passwords. It recommends server-side validation of user input and limiting database access to help prevent SQL injection attacks.
SQL Injections - 2016 - Huntington Beach
This document discusses SQL injections and how to prevent them. It begins by defining SQL injections as a code injection technique used to attack data-driven applications by inserting malicious SQL statements. It then covers what SQL injections can do, like retrieve sensitive data, manipulate data, or retrieve system information. The document discusses how SQL injections work through different attack techniques. It provides strategies for preventing SQL injections like using parameterized queries and input validation. It also offers tips for identifying SQL injection attacks.
Php Security - OWASP
This document discusses various cybersecurity topics related to PHP, including hacking, attacks, and recovering from attacks. It provides an overview of general security aspects and the OSI model layers. It then covers specific types of attacks like denial-of-service, spoofing, and man-in-the-middle attacks. It also discusses vulnerabilities, exploits, and the OWASP top 10 security risks. A large portion of the document focuses on SQL injection attacks, how they work, and ways to protect against them. It also briefly discusses other injection attacks and cross-site scripting attacks.
sql-inj_attack.pdf
The document discusses SQL injection attacks and defenses. It describes how SQL injection works by sending malicious SQL code via web form inputs to exploit vulnerabilities in how a website prepares SQL queries. This can allow attackers to steal sensitive data like credit cards or even manipulate databases. The key defense is to use prepared statements or parameterized queries that properly escape all input values to prevent SQL code injection.
How to lose your database and your job
This is a talk geared towards developers who have heard of SQL Injection, but haven’t seen it in action, or are unsure about how to do anything about it. Contains demos of what SQL injection looks like, and why escaping quotes is nowhere near sufficient.
Code injection and green sql
The document discusses SQL injection and GreenSQL. SQL injection is a code injection technique that allows attackers to gain unauthorized access to databases. GreenSQL is a database firewall that works as a proxy for SQL commands, calculates query risks, and supports different protection modes like IDS, IPS, and learning modes. It fingerprints databases and detects risky queries like stack-based and tautological queries. GreenSQL provides a dashboard to monitor queries and configure whitelist rules and alerts.
Greensql2007
The document discusses SQL injection and GreenSQL. SQL injection is a code injection technique that allows attackers to gain unauthorized access to databases. GreenSQL is a database firewall that works as a proxy for SQL commands, calculates query risks, and supports different protection modes like IDS, IPS, and learning modes. It fingerprints databases and detects risky queries like stack-based and tautological queries. GreenSQL provides a dashboard to monitor queries and configure whitelist rules and alerts.
Simple web security
This document provides an overview of simple web security concepts including HTTP, BurpSuite, OWASP Top 10 vulnerabilities, XSS, CSRF, SQL injection, Google hacking, and practice platforms like bWapp and WebGoat. It covers topics like how HTTP and cookies work, vulnerability types like XSS and SQL injection, tools like BurpSuite, and hands-on platforms to practice security skills. The document aims to introduce foundational web security knowledge and next steps one can take to learn more like participating in CTF events or penetration testing.
Recommended
SQl Injection.ppt
This presentation introduces SQL injection, a code injection technique that exploits security vulnerabilities in user input handlers to target databases. It provides examples of real-world SQL injection attacks, such as the theft of 130 million credit card numbers. The presentation demonstrates how SQL comments, logic statements, and multiple statements can be abused to perform unauthorized actions like dropping tables or updating passwords. It recommends server-side validation of user input and limiting database access to help prevent SQL injection attacks.
SQL Injections - 2016 - Huntington Beach
This document discusses SQL injections and how to prevent them. It begins by defining SQL injections as a code injection technique used to attack data-driven applications by inserting malicious SQL statements. It then covers what SQL injections can do, like retrieve sensitive data, manipulate data, or retrieve system information. The document discusses how SQL injections work through different attack techniques. It provides strategies for preventing SQL injections like using parameterized queries and input validation. It also offers tips for identifying SQL injection attacks.
Php Security - OWASP
This document discusses various cybersecurity topics related to PHP, including hacking, attacks, and recovering from attacks. It provides an overview of general security aspects and the OSI model layers. It then covers specific types of attacks like denial-of-service, spoofing, and man-in-the-middle attacks. It also discusses vulnerabilities, exploits, and the OWASP top 10 security risks. A large portion of the document focuses on SQL injection attacks, how they work, and ways to protect against them. It also briefly discusses other injection attacks and cross-site scripting attacks.
sql-inj_attack.pdf
The document discusses SQL injection attacks and defenses. It describes how SQL injection works by sending malicious SQL code via web form inputs to exploit vulnerabilities in how a website prepares SQL queries. This can allow attackers to steal sensitive data like credit cards or even manipulate databases. The key defense is to use prepared statements or parameterized queries that properly escape all input values to prevent SQL code injection.
How to lose your database and your job
This is a talk geared towards developers who have heard of SQL Injection, but haven’t seen it in action, or are unsure about how to do anything about it. Contains demos of what SQL injection looks like, and why escaping quotes is nowhere near sufficient.
Code injection and green sql
The document discusses SQL injection and GreenSQL. SQL injection is a code injection technique that allows attackers to gain unauthorized access to databases. GreenSQL is a database firewall that works as a proxy for SQL commands, calculates query risks, and supports different protection modes like IDS, IPS, and learning modes. It fingerprints databases and detects risky queries like stack-based and tautological queries. GreenSQL provides a dashboard to monitor queries and configure whitelist rules and alerts.
Greensql2007
The document discusses SQL injection and GreenSQL. SQL injection is a code injection technique that allows attackers to gain unauthorized access to databases. GreenSQL is a database firewall that works as a proxy for SQL commands, calculates query risks, and supports different protection modes like IDS, IPS, and learning modes. It fingerprints databases and detects risky queries like stack-based and tautological queries. GreenSQL provides a dashboard to monitor queries and configure whitelist rules and alerts.
Simple web security
This document provides an overview of simple web security concepts including HTTP, BurpSuite, OWASP Top 10 vulnerabilities, XSS, CSRF, SQL injection, Google hacking, and practice platforms like bWapp and WebGoat. It covers topics like how HTTP and cookies work, vulnerability types like XSS and SQL injection, tools like BurpSuite, and hands-on platforms to practice security skills. The document aims to introduce foundational web security knowledge and next steps one can take to learn more like participating in CTF events or penetration testing.
Sql injection
SQL Injection (SQLi) refers to an injection attack wherein an attacker can execute malicious SQL statements (also commonly referred to as a malicious payload) that control a web application's database server (also commonly referred to as a Relational Database Management System – RDBMS).
Sql injection - security testing
SQL injection is a type of attack where malicious SQL code is injected into an application's database query, potentially exposing or modifying private data. Attackers can bypass logins, access secret data, modify website contents, or shut down databases. SQL injection occurs when user input is not sanitized before being used in SQL queries. Attackers first find vulnerable websites, then check for errors to determine the number of columns. They use "union select" statements to discover which columns are responsive to queries, allowing them to extract data like user credentials or database contents. Developers should sanitize all user inputs to prevent SQL injection attacks.
Hacking Your Way to Better Security - PHP South Africa 2016
This talk educates developers on common security vulnerabilities, how they are exploited, and how to protect against them. We'll explore several of the OWASP Top 10 attack vectors like SQL injection, XSS, CSRF, and more. Each topic will be approached from the perspective of an attacker to see how these vulnerabilities are detected and exploited using several realistic examples. We'll then apply this knowledge to see how web applications can be secured against such vulnerabilities.
Hacking Your Way To Better Security - Dutch PHP Conference 2016
The goal of this talk is to educate developers on common security vulnerabilities, how they are exploited, and how to protect against them. We'll explore several of the OWASP Top 10 attack vectors like SQL injection, XSS, CSRF, session hijacking, and insecure direct object references. Each topic will be approached from the perspective of an attacker to see how these vulnerabilities are detected and exploited using several realistic examples. Once we've established an understanding of how these attacks work, we'll look at concrete steps you can take to secure web applications against such vulnerabilities. The knowledge gained from this talk can also be used for participating in "Capture the Flag" security competitions.
DEF CON 27 -OMER GULL - select code execution from using sq lite
The document discusses gaining code execution using SQLite database queries. It provides background on SQLite, examines its attack surface when querying an untrusted database, and explores previous work exploiting memory corruptions. The author proposes a technique called "Query Oriented Programming" to leverage SQL queries to implement memory leakage and other exploitation primitives to achieve remote code execution without using traditional scripting languages.
Hacking Your Way To Better Security
The goal of this talk is to educate developers on common security vulnerabilities, how they are exploited, and how to protect against them. We'll explore several of the OWASP Top 10 attack vectors like SQL injection, XSS, CSRF, session hijacking, and insecure direct object references. Each topic will be approached from the perspective of an attacker to see how these vulnerabilities are detected and exploited using several realistic examples. Once we've established an understanding of how these attacks work, we'll look at concrete steps you can take to secure web applications against such vulnerabilities. The knowledge gained from this talk can also be used for participating in "Capture the Flag" security competitions.
How to identify and prevent SQL injection
• What is SQL injection ?
• Why is it harmful?
• Types of SQL injection attacks.
• How to identify SQL injection vulnerability.
• Exploiting SQL injection.
• How to protect Web Application from SQL injection.
SQL injection Colombo Cybersecurity Meetup
This document discusses how to identify and prevent SQL injection. It begins with an introduction of the author and their background. It then explains what SQL injection is, how web applications work, and some well-known SQL injection attacks. The document discusses understanding SQL injection by manipulating user input. It demonstrates how SQL injection can be used to extract data, modify data, perform denial of service attacks, bypass authentication, and execute remote commands. Finally, it covers how to prevent SQL injection through code level precautions like parameterized queries and input validation, as well as platform level controls like web application firewalls, intrusion prevention systems, and logging/monitoring.
Advanced Topics On Sql Injection Protection
The document discusses various methods for preventing SQL injection attacks, including input validation, using static query statements, and least privilege approaches. It provides detailed explanations and examples of how to properly implement input validation, including escaping special characters, validating numeric fields, and preventing second-order SQL injection. The document also cautions that approaches like parameterized statements and stored procedures do not automatically prevent SQL injection and can still be vulnerable if not implemented correctly.
Module 14 (sql injection)
SQL injection is a type of security exploit in which the attacker adds Structured Query Language (SQL) code to a Web form input box to gain access to resources or make changes to data. An SQL query is a request for some action to be performed on a database. Typically, on a Web form for user authentication, when a user enters their name and password into the text boxes provided for them, those values are inserted into a SELECT query. If the values entered are found as expected, the user is allowed access; if they aren't found, access is denied. However, most Web forms have no mechanisms in place to block input other than names and passwords. Unless such precautions are taken, an attacker can use the input boxes to send their own request to the database, which could allow them to download the entire database or interact with it in other illicit ways.
Ppt on sql injection
This document discusses SQL injection, which is a security vulnerability that allows attackers to interfere with how a database operates. SQL injection occurs when user input is not sanitized and is used directly in SQL queries, allowing attackers to alter the structure and meaning of queries. The document provides an example of how an attacker could log in without a password by adding SQL code to the username field. It also lists some common SQL injection techniques like using comments, concatenation, and wildcards. Finally, it points to additional online resources for learning more about SQL injection and database security.
SQL Injection 101 : It is not just about ' or '1'='1 - Pichaya Morimoto
Topic: SQL Injection 101 : It is not just about ' or '1'='1
Speaker: Pichaya Morimoto
Event: OWASP Thailand Meeting 3/2014
Date: Auguest 28, 2014
DEFCON 23 - Lance buttars Nemus - sql injection on lamp
The document discusses demonstrating SQL injection vulnerabilities and remote code execution on a LAMP stack. It begins by introducing SQL injection and outlining the lab setup, which includes a vulnerable PHP script interacting with a MySQL database. Testing identifies that the website is vulnerable to numeric SQL injection. Fingerprinting reveals the server is running Apache 2.2.15 on CentOS. The presentation then explores further exploiting the vulnerability.
Hacking Your Way To Better Security - php[tek] 2016
This talk educates developers on common security vulnerabilities, how they are exploited, and how to protect against them. We will explore several of the OWASP top 10 attack vectors, such as SQL injection, XSS, CSRF, and session hijacking. Each topic will be approached from the perspective of an attacker to learn how these vulnerabilities are detected and exploited using several realistic examples. We will then apply this knowledge to learn how web applications can be secured against such vulnerabilities.
D:\Technical\Ppt\Sql Injection
SQL injection is a type of attack where malicious SQL statements are inserted into an entry field for execution behind the scenes. It can be used to read or modify data in the database without authorization. Attackers can exploit vulnerabilities in an application's use of dynamic SQL queries constructed from user input. Common techniques for SQL injection include altering queries to return additional records or modify database content. Developers can prevent SQL injection by sanitizing all user input, using parameterized queries, and granting only necessary privileges to database users.
How "·$% developers defeat the web vulnerability scanners
Share Favorite
Favorited X
Download More...
Favorited! Want to add tags? Have an opinion? Make a quick comment as well. Cancel
Edit your favorites Cancel
Send to your Group / Event Select Group / Event
Add your message Cancel
Post toBlogger WordPress Twitter Facebook Deliciousmore share options .Embed For WordPress.com
Without related presentations
0 commentsPost a comment
Post a comment
..
Embed Video Subscribe to follow-up comments Unsubscribe from followup comments .
Edit your comment Cancel .Notes on slide 1
no notes for slide #1
no notes for slide #1
..Favorites, Groups & Events
more
How "·$% developers defeat the web vulnerability scanners - Presentation Transcript
1.How ?¿$·& developers defeat the most famous web vulnerability scanners …or how to recognize old friends Chema Alonso Informática64 José Parada Microsoft Ibérica
2.Agenda
1.- Introduction
2.- Inverted Queries
3.- Arithmetic Blind SQL Injection
4.- Time-Based Blind SQL Injection using Heavey Queries
5.- Conclusions
3.1.-Introduction
4.SQL Injection is still here among us
5.Web Application Security Consortium: Comparision http://projects.webappsec.org/Web-Application-Security-Statistics 12.186 sites 97.554 bugs
6.Need to Improve Automatic Scanning
Not always a manual scanning is possible
Time
Confidentiality
Money, money, money…
Need to study new ways to recognize old fashion vulnerabilities to improve automatic scanning tools.
7.2.-Inverted Queries
8.
9.Homers, how are they?
Lazy
Bad trainined
Poor Experience in security stuff
Don´t like working
Don´t like computing
Don´t like coding
Don´t like you!
10.Flanders are Left-handed
11.Right
SELECT UID
FROM USERS
WHERE NAME=‘V_NAME’
AND
PASSWORD=‘V_PASSW’;
12.Wrong?
SELECT UID
FROM USERS
WHERE ‘V_NAME’=NAME AND
‘ V_PASSW’=PASSWORD
13.Login Inverted Query
Select uid
From users where ‘v_name’=name and ‘v_pass’=password
http://www.web.com/login.php?v_name=Robert&v_pass=Kubica’ or '1'='1
Select uid
From users where ‘Robert’=name and ‘Kubica’ or ‘1’=‘1’=password
FAIL
14.Login Inverted SQL Injection an example
Select uid
From users where ‘v_name’=name and ‘v_pass’=password
http://www.web.com/login.php?v_name=Robert&v_pass=’=‘’ or ‘1’=‘1’ or ‘Kubica
Select uid
From users where ‘Robert’=name and ’’=‘’ or ‘1’=‘1’ or ‘Kubica’=password
Success
15.Blind Attacks
Attacker injects code but can´t access directly to the data.
However this injection changes the behavior of the web application.
Then the attacker looks for differences between true code injections (1=1) and false code injections (1=2) in the response pages to extract data.
Blind SQL Injection
Biind Xpath Injection
Blind LDAP Injection
16.Blind SQL Injection Attacks
Attacker injects:
“ True where clauses”
“ False where clauses“
Ex:
Program.php?id=1 and 1=1
Program.php?id=1 and 1=2
Program doesn’t return any visible data from database or data in error messages.
The attacker can´t see any data extracted from the database.
17.Blind SQL Injection Attacks
Attacker analyzes the response pages looking for differences between “True-Answer Page” and “False-Answer Page”:
Different hashes
Different html structure
Different patterns (keywords)
Different linear ASCII sums
“ Different behavior”
By example: Response Time
18.Blind SQL Injection Attacks
If any difference exists, then:
Attacker can extract all information from database
How? Using “booleanization”
MySQL:
Program.php?id=1 and 100>(ASCII(Substring(user(),1,1)))
“ True-Answer Page” or “False-Answer Page”?
MSSQL:
Program.php?id=1 and 100>(Select top 1 ASCII(Substring(name,1,1))) from sysusers)
Oracle:
Program.php?id=1 and 100>(Select ASCII(Sub
Out-of-band SQL Injection Attacks (#cypsec'17)
This document discusses SQL injection attacks, including in-band, indirect inference, and out-of-band attacks. It provides examples of error-based, boolean-based, and blind SQL injection techniques. The presentation demonstrates an out-of-band SQL injection attack that uses DNS queries to exfiltrate data like user passwords from a vulnerable web application to an external DNS server controlled by the attacker.
03. sql and other injection module v17
This document discusses SQL injection and ways to prevent it. SQL injection occurs when malicious SQL statements are inserted into an insufficiently validated string that is later executed as a database command. It can allow attackers to read or modify data in the database. The document outlines different types of SQL injection attacks and provides examples of how input validation and prepared statements can prevent injection. It also discusses command injection and file path traversal attacks.
PHP Secure Programming
The document discusses various PHP security vulnerabilities like code injection, SQL injection, cross-site scripting (XSS), session hijacking, and remote code execution. It provides examples of each vulnerability and methods to prevent them, such as input validation, output encoding, secure session management, and restricting shell commands. The goal is to teach secure PHP programming practices to avoid security issues and defend against common attacks.
Prevention of SQL Injection Attack in Web Application with Host Language
This document discusses SQL injection attacks and methods to prevent them when building web applications. It begins by defining SQL injection attacks and describing common types like tautology, union queries, and blind injection. It then presents approaches to prevent SQL injection using host languages like PHP and Java. These include prepared statements, escaping strings, and stripping tags when handling user inputs in PHP. For Java, it recommends prepared statements to protect against attackers modifying queries. The key message is that input validation and using features like prepared statements in PHP and Java can help secure databases and prevent unauthorized access during SQL queries.
Programming Foundation Models with DSPy - Meetup Slides
Prompting language models is hard, while programming language models is easy. In this talk, I will discuss the state-of-the-art framework DSPy for programming foundation models with its powerful optimizers and runtime constraint system.
FREE A4 Cyber Security Awareness Posters-Social Engineering part 3
Free A4 downloadable and printable Cyber Security, Social Engineering Safety and security Training Posters . Promote security awareness in the home or workplace. Lock them Out From training providers datahops.com
More Related Content
Similar to Chapter 5 - SQL-Injection-NK.pdf
Sql injection
SQL Injection (SQLi) refers to an injection attack wherein an attacker can execute malicious SQL statements (also commonly referred to as a malicious payload) that control a web application's database server (also commonly referred to as a Relational Database Management System – RDBMS).
Sql injection - security testing
SQL injection is a type of attack where malicious SQL code is injected into an application's database query, potentially exposing or modifying private data. Attackers can bypass logins, access secret data, modify website contents, or shut down databases. SQL injection occurs when user input is not sanitized before being used in SQL queries. Attackers first find vulnerable websites, then check for errors to determine the number of columns. They use "union select" statements to discover which columns are responsive to queries, allowing them to extract data like user credentials or database contents. Developers should sanitize all user inputs to prevent SQL injection attacks.
Hacking Your Way to Better Security - PHP South Africa 2016
This talk educates developers on common security vulnerabilities, how they are exploited, and how to protect against them. We'll explore several of the OWASP Top 10 attack vectors like SQL injection, XSS, CSRF, and more. Each topic will be approached from the perspective of an attacker to see how these vulnerabilities are detected and exploited using several realistic examples. We'll then apply this knowledge to see how web applications can be secured against such vulnerabilities.
Hacking Your Way To Better Security - Dutch PHP Conference 2016
The goal of this talk is to educate developers on common security vulnerabilities, how they are exploited, and how to protect against them. We'll explore several of the OWASP Top 10 attack vectors like SQL injection, XSS, CSRF, session hijacking, and insecure direct object references. Each topic will be approached from the perspective of an attacker to see how these vulnerabilities are detected and exploited using several realistic examples. Once we've established an understanding of how these attacks work, we'll look at concrete steps you can take to secure web applications against such vulnerabilities. The knowledge gained from this talk can also be used for participating in "Capture the Flag" security competitions.
DEF CON 27 -OMER GULL - select code execution from using sq lite
The document discusses gaining code execution using SQLite database queries. It provides background on SQLite, examines its attack surface when querying an untrusted database, and explores previous work exploiting memory corruptions. The author proposes a technique called "Query Oriented Programming" to leverage SQL queries to implement memory leakage and other exploitation primitives to achieve remote code execution without using traditional scripting languages.
Hacking Your Way To Better Security
The goal of this talk is to educate developers on common security vulnerabilities, how they are exploited, and how to protect against them. We'll explore several of the OWASP Top 10 attack vectors like SQL injection, XSS, CSRF, session hijacking, and insecure direct object references. Each topic will be approached from the perspective of an attacker to see how these vulnerabilities are detected and exploited using several realistic examples. Once we've established an understanding of how these attacks work, we'll look at concrete steps you can take to secure web applications against such vulnerabilities. The knowledge gained from this talk can also be used for participating in "Capture the Flag" security competitions.
How to identify and prevent SQL injection
• What is SQL injection ?
• Why is it harmful?
• Types of SQL injection attacks.
• How to identify SQL injection vulnerability.
• Exploiting SQL injection.
• How to protect Web Application from SQL injection.
SQL injection Colombo Cybersecurity Meetup
This document discusses how to identify and prevent SQL injection. It begins with an introduction of the author and their background. It then explains what SQL injection is, how web applications work, and some well-known SQL injection attacks. The document discusses understanding SQL injection by manipulating user input. It demonstrates how SQL injection can be used to extract data, modify data, perform denial of service attacks, bypass authentication, and execute remote commands. Finally, it covers how to prevent SQL injection through code level precautions like parameterized queries and input validation, as well as platform level controls like web application firewalls, intrusion prevention systems, and logging/monitoring.
Advanced Topics On Sql Injection Protection
The document discusses various methods for preventing SQL injection attacks, including input validation, using static query statements, and least privilege approaches. It provides detailed explanations and examples of how to properly implement input validation, including escaping special characters, validating numeric fields, and preventing second-order SQL injection. The document also cautions that approaches like parameterized statements and stored procedures do not automatically prevent SQL injection and can still be vulnerable if not implemented correctly.
Module 14 (sql injection)
SQL injection is a type of security exploit in which the attacker adds Structured Query Language (SQL) code to a Web form input box to gain access to resources or make changes to data. An SQL query is a request for some action to be performed on a database. Typically, on a Web form for user authentication, when a user enters their name and password into the text boxes provided for them, those values are inserted into a SELECT query. If the values entered are found as expected, the user is allowed access; if they aren't found, access is denied. However, most Web forms have no mechanisms in place to block input other than names and passwords. Unless such precautions are taken, an attacker can use the input boxes to send their own request to the database, which could allow them to download the entire database or interact with it in other illicit ways.
Ppt on sql injection
This document discusses SQL injection, which is a security vulnerability that allows attackers to interfere with how a database operates. SQL injection occurs when user input is not sanitized and is used directly in SQL queries, allowing attackers to alter the structure and meaning of queries. The document provides an example of how an attacker could log in without a password by adding SQL code to the username field. It also lists some common SQL injection techniques like using comments, concatenation, and wildcards. Finally, it points to additional online resources for learning more about SQL injection and database security.
SQL Injection 101 : It is not just about ' or '1'='1 - Pichaya Morimoto
Topic: SQL Injection 101 : It is not just about ' or '1'='1
Speaker: Pichaya Morimoto
Event: OWASP Thailand Meeting 3/2014
Date: Auguest 28, 2014
DEFCON 23 - Lance buttars Nemus - sql injection on lamp
The document discusses demonstrating SQL injection vulnerabilities and remote code execution on a LAMP stack. It begins by introducing SQL injection and outlining the lab setup, which includes a vulnerable PHP script interacting with a MySQL database. Testing identifies that the website is vulnerable to numeric SQL injection. Fingerprinting reveals the server is running Apache 2.2.15 on CentOS. The presentation then explores further exploiting the vulnerability.
Hacking Your Way To Better Security - php[tek] 2016
This talk educates developers on common security vulnerabilities, how they are exploited, and how to protect against them. We will explore several of the OWASP top 10 attack vectors, such as SQL injection, XSS, CSRF, and session hijacking. Each topic will be approached from the perspective of an attacker to learn how these vulnerabilities are detected and exploited using several realistic examples. We will then apply this knowledge to learn how web applications can be secured against such vulnerabilities.
D:\Technical\Ppt\Sql Injection
SQL injection is a type of attack where malicious SQL statements are inserted into an entry field for execution behind the scenes. It can be used to read or modify data in the database without authorization. Attackers can exploit vulnerabilities in an application's use of dynamic SQL queries constructed from user input. Common techniques for SQL injection include altering queries to return additional records or modify database content. Developers can prevent SQL injection by sanitizing all user input, using parameterized queries, and granting only necessary privileges to database users.
How "·$% developers defeat the web vulnerability scanners
Share Favorite
Favorited X
Download More...
Favorited! Want to add tags? Have an opinion? Make a quick comment as well. Cancel
Edit your favorites Cancel
Send to your Group / Event Select Group / Event
Add your message Cancel
Post toBlogger WordPress Twitter Facebook Deliciousmore share options .Embed For WordPress.com
Without related presentations
0 commentsPost a comment
Post a comment
..
Embed Video Subscribe to follow-up comments Unsubscribe from followup comments .
Edit your comment Cancel .Notes on slide 1
no notes for slide #1
no notes for slide #1
..Favorites, Groups & Events
more
How "·$% developers defeat the web vulnerability scanners - Presentation Transcript
1.How ?¿$·& developers defeat the most famous web vulnerability scanners …or how to recognize old friends Chema Alonso Informática64 José Parada Microsoft Ibérica
2.Agenda
1.- Introduction
2.- Inverted Queries
3.- Arithmetic Blind SQL Injection
4.- Time-Based Blind SQL Injection using Heavey Queries
5.- Conclusions
3.1.-Introduction
4.SQL Injection is still here among us
5.Web Application Security Consortium: Comparision http://projects.webappsec.org/Web-Application-Security-Statistics 12.186 sites 97.554 bugs
6.Need to Improve Automatic Scanning
Not always a manual scanning is possible
Time
Confidentiality
Money, money, money…
Need to study new ways to recognize old fashion vulnerabilities to improve automatic scanning tools.
7.2.-Inverted Queries
8.
9.Homers, how are they?
Lazy
Bad trainined
Poor Experience in security stuff
Don´t like working
Don´t like computing
Don´t like coding
Don´t like you!
10.Flanders are Left-handed
11.Right
SELECT UID
FROM USERS
WHERE NAME=‘V_NAME’
AND
PASSWORD=‘V_PASSW’;
12.Wrong?
SELECT UID
FROM USERS
WHERE ‘V_NAME’=NAME AND
‘ V_PASSW’=PASSWORD
13.Login Inverted Query
Select uid
From users where ‘v_name’=name and ‘v_pass’=password
http://www.web.com/login.php?v_name=Robert&v_pass=Kubica’ or '1'='1
Select uid
From users where ‘Robert’=name and ‘Kubica’ or ‘1’=‘1’=password
FAIL
14.Login Inverted SQL Injection an example
Select uid
From users where ‘v_name’=name and ‘v_pass’=password
http://www.web.com/login.php?v_name=Robert&v_pass=’=‘’ or ‘1’=‘1’ or ‘Kubica
Select uid
From users where ‘Robert’=name and ’’=‘’ or ‘1’=‘1’ or ‘Kubica’=password
Success
15.Blind Attacks
Attacker injects code but can´t access directly to the data.
However this injection changes the behavior of the web application.
Then the attacker looks for differences between true code injections (1=1) and false code injections (1=2) in the response pages to extract data.
Blind SQL Injection
Biind Xpath Injection
Blind LDAP Injection
16.Blind SQL Injection Attacks
Attacker injects:
“ True where clauses”
“ False where clauses“
Ex:
Program.php?id=1 and 1=1
Program.php?id=1 and 1=2
Program doesn’t return any visible data from database or data in error messages.
The attacker can´t see any data extracted from the database.
17.Blind SQL Injection Attacks
Attacker analyzes the response pages looking for differences between “True-Answer Page” and “False-Answer Page”:
Different hashes
Different html structure
Different patterns (keywords)
Different linear ASCII sums
“ Different behavior”
By example: Response Time
18.Blind SQL Injection Attacks
If any difference exists, then:
Attacker can extract all information from database
How? Using “booleanization”
MySQL:
Program.php?id=1 and 100>(ASCII(Substring(user(),1,1)))
“ True-Answer Page” or “False-Answer Page”?
MSSQL:
Program.php?id=1 and 100>(Select top 1 ASCII(Substring(name,1,1))) from sysusers)
Oracle:
Program.php?id=1 and 100>(Select ASCII(Sub
Out-of-band SQL Injection Attacks (#cypsec'17)
This document discusses SQL injection attacks, including in-band, indirect inference, and out-of-band attacks. It provides examples of error-based, boolean-based, and blind SQL injection techniques. The presentation demonstrates an out-of-band SQL injection attack that uses DNS queries to exfiltrate data like user passwords from a vulnerable web application to an external DNS server controlled by the attacker.
03. sql and other injection module v17
This document discusses SQL injection and ways to prevent it. SQL injection occurs when malicious SQL statements are inserted into an insufficiently validated string that is later executed as a database command. It can allow attackers to read or modify data in the database. The document outlines different types of SQL injection attacks and provides examples of how input validation and prepared statements can prevent injection. It also discusses command injection and file path traversal attacks.
PHP Secure Programming
The document discusses various PHP security vulnerabilities like code injection, SQL injection, cross-site scripting (XSS), session hijacking, and remote code execution. It provides examples of each vulnerability and methods to prevent them, such as input validation, output encoding, secure session management, and restricting shell commands. The goal is to teach secure PHP programming practices to avoid security issues and defend against common attacks.
Prevention of SQL Injection Attack in Web Application with Host Language
This document discusses SQL injection attacks and methods to prevent them when building web applications. It begins by defining SQL injection attacks and describing common types like tautology, union queries, and blind injection. It then presents approaches to prevent SQL injection using host languages like PHP and Java. These include prepared statements, escaping strings, and stripping tags when handling user inputs in PHP. For Java, it recommends prepared statements to protect against attackers modifying queries. The key message is that input validation and using features like prepared statements in PHP and Java can help secure databases and prevent unauthorized access during SQL queries.
Similar to Chapter 5 - SQL-Injection-NK.pdf (20)
Hacking Your Way to Better Security - PHP South Africa 2016
Hacking Your Way to Better Security - PHP South Africa 2016
Hacking Your Way To Better Security - Dutch PHP Conference 2016
Hacking Your Way To Better Security - Dutch PHP Conference 2016
DEF CON 27 -OMER GULL - select code execution from using sq lite
DEF CON 27 -OMER GULL - select code execution from using sq lite
SQL Injection 101 : It is not just about ' or '1'='1 - Pichaya Morimoto
SQL Injection 101 : It is not just about ' or '1'='1 - Pichaya Morimoto
DEFCON 23 - Lance buttars Nemus - sql injection on lamp
DEFCON 23 - Lance buttars Nemus - sql injection on lamp
Hacking Your Way To Better Security - php[tek] 2016
Hacking Your Way To Better Security - php[tek] 2016
How "·$% developers defeat the web vulnerability scanners
How "·$% developers defeat the web vulnerability scanners
Prevention of SQL Injection Attack in Web Application with Host Language
Prevention of SQL Injection Attack in Web Application with Host Language
Recently uploaded
Programming Foundation Models with DSPy - Meetup Slides
Prompting language models is hard, while programming language models is easy. In this talk, I will discuss the state-of-the-art framework DSPy for programming foundation models with its powerful optimizers and runtime constraint system.
FREE A4 Cyber Security Awareness Posters-Social Engineering part 3
Free A4 downloadable and printable Cyber Security, Social Engineering Safety and security Training Posters . Promote security awareness in the home or workplace. Lock them Out From training providers datahops.com
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
Folding is a recent technique for building efficient recursive SNARKs. Several elegant folding protocols have been proposed, such as Nova, Supernova, Hypernova, Protostar, and others. However, all of them rely on an additively homomorphic commitment scheme based on discrete log, and are therefore not post-quantum secure. In this work we present LatticeFold, the first lattice-based folding protocol based on the Module SIS problem. This folding protocol naturally leads to an efficient recursive lattice-based SNARK and an efficient PCD scheme. LatticeFold supports folding low-degree relations, such as R1CS, as well as high-degree relations, such as CCS. The key challenge is to construct a secure folding protocol that works with the Ajtai commitment scheme. The difficulty, is ensuring that extracted witnesses are low norm through many rounds of folding. We present a novel technique using the sumcheck protocol to ensure that extracted witnesses are always low norm no matter how many rounds of folding are used. Our evaluation of the final proof system suggests that it is as performant as Hypernova, while providing post-quantum security.
Paper Link: https://eprint.iacr.org/2024/257
Building Production Ready Search Pipelines with Spark and Milvus
Spark is the widely used ETL tool for processing, indexing and ingesting data to serving stack for search. Milvus is the production-ready open-source vector database. In this talk we will show how to use Spark to process unstructured data to extract vector representations, and push the vectors to Milvus vector database for search serving.
Energy Efficient Video Encoding for Cloud and Edge Computing Instances
Energy Efficient Video Encoding for Cloud and Edge Computing Instances
Generating privacy-protected synthetic data using Secludy and Milvus
During this demo, the founders of Secludy will demonstrate how their system utilizes Milvus to store and manipulate embeddings for generating privacy-protected synthetic data. Their approach not only maintains the confidentiality of the original data but also enhances the utility and scalability of LLMs under privacy constraints. Attendees, including machine learning engineers, data scientists, and data managers, will witness first-hand how Secludy's integration with Milvus empowers organizations to harness the power of LLMs securely and efficiently.
Astute Business Solutions | Oracle Cloud Partner |
Your goto partner for Oracle Cloud, PeopleSoft, E-Business Suite, and Ellucian Banner. We are a firm specialized in managed services and consulting.
Introduction of Cybersecurity with OSS at Code Europe 2024
I develop the Ruby programming language, RubyGems, and Bundler, which are package managers for Ruby. Today, I will introduce how to enhance the security of your application using open-source software (OSS) examples from Ruby and RubyGems.
The first topic is CVE (Common Vulnerabilities and Exposures). I have published CVEs many times. But what exactly is a CVE? I'll provide a basic understanding of CVEs and explain how to detect and handle vulnerabilities in OSS.
Next, let's discuss package managers. Package managers play a critical role in the OSS ecosystem. I'll explain how to manage library dependencies in your application.
I'll share insights into how the Ruby and RubyGems core team works to keep our ecosystem safe. By the end of this talk, you'll have a better understanding of how to safeguard your code.
Fueling AI with Great Data with Airbyte Webinar
This talk will focus on how to collect data from a variety of sources, leveraging this data for RAG and other GenAI use cases, and finally charting your course to productionalization.
Your One-Stop Shop for Python Success: Top 10 US Python Development Providers
Simplify your search for a reliable Python development partner! This list presents the top 10 trusted US providers offering comprehensive Python development services, ensuring your project's success from conception to completion.
What is an RPA CoE? Session 1 – CoE Vision
In the first session, we will review the organization's vision and how this has an impact on the COE Structure.
Topics covered:
• The role of a steering committee
• How do the organization’s priorities determine CoE Structure?
Speaker:
Chris Bolin, Senior Intelligent Automation Architect Anika Systems
5th LF Energy Power Grid Model Meet-up Slides
5th Power Grid Model Meet-up
It is with great pleasure that we extend to you an invitation to the 5th Power Grid Model Meet-up, scheduled for 6th June 2024. This event will adopt a hybrid format, allowing participants to join us either through an online Mircosoft Teams session or in person at TU/e located at Den Dolech 2, Eindhoven, Netherlands. The meet-up will be hosted by Eindhoven University of Technology (TU/e), a research university specializing in engineering science & technology.
Power Grid Model
The global energy transition is placing new and unprecedented demands on Distribution System Operators (DSOs). Alongside upgrades to grid capacity, processes such as digitization, capacity optimization, and congestion management are becoming vital for delivering reliable services.
Power Grid Model is an open source project from Linux Foundation Energy and provides a calculation engine that is increasingly essential for DSOs. It offers a standards-based foundation enabling real-time power systems analysis, simulations of electrical power grids, and sophisticated what-if analysis. In addition, it enables in-depth studies and analysis of the electrical power grid’s behavior and performance. This comprehensive model incorporates essential factors such as power generation capacity, electrical losses, voltage levels, power flows, and system stability.
Power Grid Model is currently being applied in a wide variety of use cases, including grid planning, expansion, reliability, and congestion studies. It can also help in analyzing the impact of renewable energy integration, assessing the effects of disturbances or faults, and developing strategies for grid control and optimization.
What to expect
For the upcoming meetup we are organizing, we have an exciting lineup of activities planned:
-Insightful presentations covering two practical applications of the Power Grid Model.
-An update on the latest advancements in Power Grid -Model technology during the first and second quarters of 2024.
-An interactive brainstorming session to discuss and propose new feature requests.
-An opportunity to connect with fellow Power Grid Model enthusiasts and users.
“How Axelera AI Uses Digital Compute-in-memory to Deliver Fast and Energy-eff...
“How Axelera AI Uses Digital Compute-in-memory to Deliver Fast and Energy-eff...Edge AI and Vision Alliance
For the full video of this presentation, please visit: https://www.edge-ai-vision.com/2024/06/how-axelera-ai-uses-digital-compute-in-memory-to-deliver-fast-and-energy-efficient-computer-vision-a-presentation-from-axelera-ai/
Bram Verhoef, Head of Machine Learning at Axelera AI, presents the “How Axelera AI Uses Digital Compute-in-memory to Deliver Fast and Energy-efficient Computer Vision” tutorial at the May 2024 Embedded Vision Summit.
As artificial intelligence inference transitions from cloud environments to edge locations, computer vision applications achieve heightened responsiveness, reliability and privacy. This migration, however, introduces the challenge of operating within the stringent confines of resource constraints typical at the edge, including small form factors, low energy budgets and diminished memory and computational capacities. Axelera AI addresses these challenges through an innovative approach of performing digital computations within memory itself. This technique facilitates the realization of high-performance, energy-efficient and cost-effective computer vision capabilities at the thin and thick edge, extending the frontier of what is achievable with current technologies.
In this presentation, Verhoef unveils his company’s pioneering chip technology and demonstrates its capacity to deliver exceptional frames-per-second performance across a range of standard computer vision networks typical of applications in security, surveillance and the industrial sector. This shows that advanced computer vision can be accessible and efficient, even at the very edge of our technological ecosystem.Best 20 SEO Techniques To Improve Website Visibility In SERP
Boost your website's visibility with proven SEO techniques! Our latest blog dives into essential strategies to enhance your online presence, increase traffic, and rank higher on search engines. From keyword optimization to quality content creation, learn how to make your site stand out in the crowded digital landscape. Discover actionable tips and expert insights to elevate your SEO game.
Leveraging the Graph for Clinical Trials and Standards
Katja Glaß
OpenStudyBuilder Community Manager - Katja Glaß Consulting
Marius Conjeaud
Principal Consultant - Neo4j
Connector Corner: Seamlessly power UiPath Apps, GenAI with prebuilt connectors
Join us to learn how UiPath Apps can directly and easily interact with prebuilt connectors via Integration Service--including Salesforce, ServiceNow, Open GenAI, and more.
The best part is you can achieve this without building a custom workflow! Say goodbye to the hassle of using separate automations to call APIs. By seamlessly integrating within App Studio, you can now easily streamline your workflow, while gaining direct access to our Connector Catalog of popular applications.
We’ll discuss and demo the benefits of UiPath Apps and connectors including:
Creating a compelling user experience for any software, without the limitations of APIs.
Accelerating the app creation process, saving time and effort
Enjoying high-performance CRUD (create, read, update, delete) operations, for
seamless data management.
Speakers:
Russell Alfeche, Technology Leader, RPA at qBotic and UiPath MVP
Charlie Greenberg, host
Driving Business Innovation: Latest Generative AI Advancements & Success Story
Are you ready to revolutionize how you handle data? Join us for a webinar where we’ll bring you up to speed with the latest advancements in Generative AI technology and discover how leveraging FME with tools from giants like Google Gemini, Amazon, and Microsoft OpenAI can supercharge your workflow efficiency.
During the hour, we’ll take you through:
Guest Speaker Segment with Hannah Barrington: Dive into the world of dynamic real estate marketing with Hannah, the Marketing Manager at Workspace Group. Hear firsthand how their team generates engaging descriptions for thousands of office units by integrating diverse data sources—from PDF floorplans to web pages—using FME transformers, like OpenAIVisionConnector and AnthropicVisionConnector. This use case will show you how GenAI can streamline content creation for marketing across the board.
Ollama Use Case: Learn how Scenario Specialist Dmitri Bagh has utilized Ollama within FME to input data, create custom models, and enhance security protocols. This segment will include demos to illustrate the full capabilities of FME in AI-driven processes.
Custom AI Models: Discover how to leverage FME to build personalized AI models using your data. Whether it’s populating a model with local data for added security or integrating public AI tools, find out how FME facilitates a versatile and secure approach to AI.
We’ll wrap up with a live Q&A session where you can engage with our experts on your specific use cases, and learn more about optimizing your data workflows with AI.
This webinar is ideal for professionals seeking to harness the power of AI within their data management systems while ensuring high levels of customization and security. Whether you're a novice or an expert, gain actionable insights and strategies to elevate your data processes. Join us to see how FME and AI can revolutionize how you work with data!
Recently uploaded (20)
Programming Foundation Models with DSPy - Meetup Slides
Programming Foundation Models with DSPy - Meetup Slides
FREE A4 Cyber Security Awareness Posters-Social Engineering part 3
FREE A4 Cyber Security Awareness Posters-Social Engineering part 3
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
zkStudyClub - LatticeFold: A Lattice-based Folding Scheme and its Application...
Building Production Ready Search Pipelines with Spark and Milvus
Building Production Ready Search Pipelines with Spark and Milvus
Deep Dive: AI-Powered Marketing to Get More Leads and Customers with HyperGro...
Deep Dive: AI-Powered Marketing to Get More Leads and Customers with HyperGro...
Energy Efficient Video Encoding for Cloud and Edge Computing Instances
Energy Efficient Video Encoding for Cloud and Edge Computing Instances
Generating privacy-protected synthetic data using Secludy and Milvus
Generating privacy-protected synthetic data using Secludy and Milvus
Astute Business Solutions | Oracle Cloud Partner |
Astute Business Solutions | Oracle Cloud Partner |
Introduction of Cybersecurity with OSS at Code Europe 2024
Introduction of Cybersecurity with OSS at Code Europe 2024
Nordic Marketo Engage User Group_June 13_ 2024.pptx
Nordic Marketo Engage User Group_June 13_ 2024.pptx
Your One-Stop Shop for Python Success: Top 10 US Python Development Providers
Your One-Stop Shop for Python Success: Top 10 US Python Development Providers
“How Axelera AI Uses Digital Compute-in-memory to Deliver Fast and Energy-eff...
“How Axelera AI Uses Digital Compute-in-memory to Deliver Fast and Energy-eff...
Best 20 SEO Techniques To Improve Website Visibility In SERP
Best 20 SEO Techniques To Improve Website Visibility In SERP
Leveraging the Graph for Clinical Trials and Standards
Leveraging the Graph for Clinical Trials and Standards
Connector Corner: Seamlessly power UiPath Apps, GenAI with prebuilt connectors
Connector Corner: Seamlessly power UiPath Apps, GenAI with prebuilt connectors
Driving Business Innovation: Latest Generative AI Advancements & Success Story
Driving Business Innovation: Latest Generative AI Advancements & Success Story
Chapter 5 - SQL-Injection-NK.pdf
- 1. Database Security Chapter 5 -2: SQL Injection Prof. Naoufel Kraiem 2022 1
- 2. Introduction What is SQL Injection? Real World Examples Important SQL Syntax Example Website Prevention 2
- 3. What is SQL Injection? Code Injection Technique Exploits Security Vulnerability Targets User Input Handlers 3
- 4. Real World Examples On August 17, 2009, the United States Justice Department charged an American citizen Albert Gonzalez and two unnamed Russians with the theft of 130 million credit card numbers using an SQL injection attack. In 2008 a sweep of attacks began exploiting the SQL injection vulnerabilities of Microsoft's IIS web server and SQL database server. Over 500,000 sites were exploited. 4
- 5. 5
- 7. 7
- 8. 8
- 9. 9
- 10. 10
- 11. 11
- 12. 12 d d d d d
- 13. SQL injection examples There are a wide variety of SQL injection vulnerabilities, attacks, and techniques, which arise in different situations. Some common SQL injection examples include: Retrieving hidden data, where you can modify an SQL query to return additional results. Subverting application logic, where you can change a query to interfere with the application's logic. UNION attacks, where you can retrieve data from different database tables. Examining the database, where you can extract information about the version and structure of the database. Blind SQL injection, where the results of a query you control are not returned in the application's responses. https://portswigger.net/web-security/sql-injection 13
- 14. Important Syntax COMMENTS: -- Example: SELECT * FROM `table` --selects everything LOGIC: ‘a’=‘a’ Example: SELECT * FROM `table` WHERE ‘a’=‘a’ MULTI STATEMENTS: S1; S2 Example: SELECT * FROM `table`; DROP TABLE `table`; 14
- 16. 16
- 17. Example Website timbo317 cse7330 SELECT * FROM `login` WHERE `user`=‘timbo317’ AND `pass`=‘cse7330’ 17
- 18. Login Database Table user pass timbo317 cse7330 What Could Go Wrong?? 18
- 19. Example Hack ’ OR ‘a’=‘a ’ OR ‘a’=‘a SELECT * FROM `login` WHERE `user`=‘’ OR ‘a’=‘a’ AND `pass`=‘’ OR ‘a’=‘a’ 19
- 20. It Gets Worse! ’; DROP TABLE `login`; -- SELECT * FROM `login` WHERE `user`=‘’; DROP TABLE `login`; --’ AND `pass`=‘’ 20
- 21. All Queries are Possible SELECT * FROM `login` WHERE `user`=‘’; INSERT INTO `login` ('user','pass') VALUES ('haxor','whatever');--’ AND `pass`=‘’ SELECT * FROM `login` WHERE `user`=‘’; UPDATE `login` SET `pass`=‘pass123’ WHERE `user`=‘timbo317’;--’ AND `pass`=‘’ 21
- 22. 22
- 23. 23
- 24. 24
- 25. 25
- 26. 26
- 27. 27
- 28. 28
- 29. 29
- 30. 30
- 31. 31
- 32. 32
- 33. 33
- 34. 34
- 35. Live Demonstration How Can You Prevent This?? 35
- 36. Prevention Logic to allow only numbers / letters in username and password. How should you enforce the constraint? SERVER SIDE. ‘ESCAPE’ bad characters. ’ becomes ’ READ ONLY database access. Remember this is NOT just for login areas! NOT just for websites!! 36
- 37. Works Cited (SQL Injection Walkthrough)(SQL Injection)(SQL Injection) Friedl, S. (2009, 10 26). SQL Injection Attacks by Example. Retrieved from Steve Friedl's Unixwiz.net Tech Tips: http://unixwiz.net/techtips/sql-injection.html IBM Informix Guide to SQL: Syntax. (n.d.). Retrieved 10 26, 2009, from IBM.COM: http://publib.boulder.ibm.com/infocenter/idshelp/v10/index.jsp?t opic=/com.ibm.sqls.doc/sqls36.htm SQL Injection. (n.d.). Retrieved 10 26, 2009, from SQL Server 2008 Books Online: http://msdn.microsoft.com/en- us/library/ms161953.aspx SQL Injection. (n.d.). Retrieved 10 26, 2009, from php.net: http://php.net/manual/en/security.database.sql-injection.php SQL Injection Walkthrough. (n.d.). Retrieved 10 26, 2009, from Securiteam: http://www.securiteam.com/securityreviews/5DP0N1P76E.html 37