How to Hack Your App Using SQL Injection

Copyright © 2017, Oracle and/or its affiliates. All rights reserved. |
How to Hack Your App
Using SQL
Chris Saxon, Oracle Developer Advocate, @ChrisRSaxon, @SQLDaily
www.youtube.com/c/TheMagicofSQL
blogs.oracle.com/sql
blogs.oracle.com/sql www.youtube.com/c/TheMagicOfSQL @ChrisRSaxon

It's2018!
...do we really need to talk about this?

https://krebsonsecurity.com/2015/07/online-cheating-site-ashleymadison-hacked/

https://www.nytimes.com/2017/09/07/business/equifax-cyberattack.html

http://www.bbc.co.uk/news/technology-34963686

https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2016/10/talktalk-gets-record-
400-000-fine-for-failing-to-prevent-october-2015-attack/

SQL Vulnerabilities
Wordpress Jan 2017
https://wordpress.org/news/2017/01/wordpress-4-7-2-security-release/
Jul 2017
https://www.scmagazineuk.com/sql-injection-vulnerability-found-in-popular-wordppress-plug-in-again/article/672839/
Oct 2017
https://www.theregister.co.uk/2017/10/31/wordpress_security_fix_4_8_3/

codecurmudgeon.com/wp/sql-injection-hall-of-shame/

Copyright © 2017, Oracle and/or its affiliates. All rights reserved. | blogs.oracle.com/sql www.youtube.com/c/TheMagicOfSQL @ChrisRSaxon
https://haveibeenpwned.com/

DEMO

Pixabay

Principle of
Least
Privilege

Pixabay
Least Privilege

Data
Red*****n

Data
Red*****n
Can still

Use Bind Variables!

String sql =
"select * from users
where username = '" + name + "'
and password = '" + pass + "'";

select full_name from users
where username = 'chris'
and password = 'chris';

where username = '' or 1 = 1 --'

where username = '' or 1 = 1 --'
Always
true!

and password = '' union all
select owner || '.' || table_name
from all_tables where 1='1';

and password = '' union all
select owner || '.' || table_name
from all_tables where 1='1';
Everything you
can select

String sql =
where username = ?
and password = ?";

String sql =
where username = ?
and password = ?";
Value
placeholder

String sql =
where username = ?
and password = ?";
Value
placeholder
Inputs never part of SQL =>

PL/SQL is
automatically bound

begin
select *
into user_rec
from sqlinjection.users u
where u.username = l_name
and u.password = l_pass;
end;
These are
bind variables

execute
Pixabay
Least Privilege
plsql f (x)

I write dynamic
SQL

String sql =
"select * from users where 1 = 1 ";
if param_1 is not null then
sql = sql + " and c1 = ? ";
end if;
if param_2 is not null then
sql = sql + " and c2 = ? ";
end if;
can still bind

…but I accept
identifiers

Sanitize input!
Pixabay

Sanitize input!
Pixabay
DBMS_assert

Change User Passwords
execute immediate 'alter user ' ||
dbms_assert.schema_name ( user ) ||
' identified by "' ||
replace(
dbms_assert.enquote_literal ( pass ), ''''
) || '"';
Can't have single
quotes (') in password!

I develop an
internal app

Gratisography
employees
can has
your dataz?

Pixabay
How secure is
your network?

Web Browser Web Server Database
SSL
TDE
Native
Encryption
See doc for more details

I don't have time
to review all
code

Virtual Private Database
Restrict access at source
Employee Name Manager Name Salary SSN
Kevin Mourgos Steven King 5800 650-123-5234
Shanta Vollman Steven King 6500 650-123-4234
Payam Kaufling Steven King 7900 650-123-3234
Adam Fripp Steven King 8200 650-123-2234
Matthew Weiss Steven King 8000 650-123-1234
Girard Geoni Matthew Weiss 2800 650-507-9879
Martha Sullivan Matthew Weiss 2500 650-507-9878
Jean Fleaur Matthew Weiss 3100 650-507-9877
Winston Taylor Matthew Weiss 3200 650-507-9876
Steven Markle Matthew Weiss 2200 650-124-1434

Virtual Private Database
Restrict access at source
Employee Name Manager Name Salary SSN
Kevin Mourgos Steven King
Shanta Vollman Steven King
Payam Kaufling Steven King
Adam Fripp Steven King
Matthew Weiss Steven King 8000 650-123-1234
Girard Geoni Matthew Weiss 2800
Martha Sullivan Matthew Weiss 2500
Jean Fleaur Matthew Weiss 3100
Winston Taylor Matthew Weiss 3200
Steven Markle Matthew Weiss 2200

How at risk am I?

DBSAT

DBSAT
My Oracle Support 2138254.1

Pixabay
PL/SQL
Least Privilege
Data R*******n
Bind Variables
Sanitize inputs
Security Layers

It's2018!
no excuses...
... your data!

Gratisography
sqlmap.org
#MakeDataGreatAgain

How to Hack Your App Using SQL Injection

More Related Content

What's hot

Similar to How to Hack Your App Using SQL Injection

Recently uploaded

How to Hack Your App Using SQL Injection