This is a short introduction to SQL Injection. It was presented to students in the SMU Computer Security Club. It was meant to be an introduction, but it is here for posterity and for any future students who need a very quick primer.

1. @hon1nbo
Security Consultant

2. SQL Injection
 SQLi Attack Vectors
 Web Applications
 Mobile Applications
 Thick Clients
 Two primary types
 Visible SQLi
 Blind SQLi
 Impact
 Compromise of info.
 Tampering with
database
 Destruction of info.
 Compromise of other
server components

3. Cause
 Unsafe Concatenation (usually)
 $query = "SELECT userid, username FROM users
WHERE username = '$input'";
 What happens if…
 $input = bob
 Returns userid ,username of bob.
 $input = ‘bob
 SQL Error. Why?

4. What happened?
 Sequence:
 $query = “SELECT userid,username FROM users
WHERE username = ‘$input’”;
 $input = ‘ bob’
 $query => “SELECT userid,username FROM users
WHERE username = ‘’ bob’’ ”;
 i_see_what_you_did_there.jpg

5. What now?
 If we can manipulate the quotes, or similar characters,
we can alter the SQL query
 $query = “SELECT userid,username FROM users
WHERE username = ‘$input’”;
 $input = ‘ <malicious SQL Command>
 $query => “SELECT userid,username FROM users
WHERE username = ‘’ <malicious SQL command>’”;

6. Manipulating Control
 Insertion of conditionals and modifiers
 OR, UNION, % (SQL wildcard) are the most common
 How can these help us?
Demo Time!

7. Cool Stuff… for a Kiddie
 When ‘or ‘1’=1 works there are limitations…
 Always returns every valid answer.
 Not useful if the system only reads one value, i.e. the first.
 Not useful if you need to extract information from
alternate columns
 Consider the following:
 $query = “SELECT userid,username FROM users
WHERE username = ‘$input’”
 Goal is to obtain the password of the user ‘joe’

8. SELECT Modifiers
 The most glorious of all:
 UNION SELECT
 Consider the following:
 $input = ‘ UNION SELECT 1, password FROM users
WHERE username = ‘joe
 $query = “SELECT userid,username FROM users
WHERE username = ‘’ UNION SELECT 1,password
FROM users WHERE username = ‘joe’”;
 Demo Time!

9. Is SQL Broken?
 No.
 Remediation
 NEVER trust user input
 ALWAYS escape bad characters
 ALWAYS use parameter based queries where possible
(Prepared Statements)
 See OWASP guide on SQL Injection Prevention for more
details

10. Advanced Techniques
 Abusing obscure privileges
CREATE Create_priv databases, tables, or indexes
DROP Drop_priv databases, tables, or views
GRANT OPTION Grant_priv databases, tables, or stored routines
LOCK TABLES Lock_tables_priv databases
REFERENCES References_priv databases or tables
EVENT Event_priv databases
ALTER Alter_priv tables
DELETE Delete_priv tables
INDEX Index_priv tables
INSERT Insert_priv tables or columns
SELECT Select_priv tables or columns
UPDATE Update_priv tables or columns
CREATE TEMPORARY TABLES Create_tmp_table_priv tables
TRIGGER Trigger_priv tables
CREATE VIEW Create_view_priv views
SHOW VIEW Show_view_priv views
ALTER ROUTINE Alter_routine_priv stored routines
CREATE ROUTINE Create_routine_priv stored routines
EXECUTE Execute_priv stored routines
FILE File_priv file access on server host
CREATE USER Create_user_priv server administration
PROCESS Process_priv server administration
RELOAD Reload_priv server administration
REPLICATION CLIENT Repl_client_priv server administration
REPLICATION SLAVE Repl_slave_priv server administration
SHOW DATABASES Show_db_priv server administration
SHUTDOWN Shutdown_priv server administration
SUPER Super_priv server administration
ALL [PRIVILEGES] server administration
USAGE server administration

11. FILE
 File privilege allows disk I/O access
 This is BAD for most cases…
 How can we abuse this?
 ‘; SELECT LOAD_FILE("/etc/passwd") INTO OUTFILE
"/var/www/passwd.txt";--
 What if we can upload a text file, or post a text
comment? What about PHP uploads?
 Most servers that will store PHP do so in a non-
executable extension or database…
 But we can change that

12. Installing a Shell
 Let’s say web server allowed you to attach a text file,
called myupload.txt
 Let’s say you’re evil, and the contents of myupload.txt
is the code of a PHP shell.
 Won’t execute due to uploader. Let’s fix that.
 '))); SELECT
LOAD_FILE("/var/www/<user>/uploads/myupload.tx
t") INTO OUTFILE "/var/www/myshell.php";--
 Best served with the command “rm –rf /var/www” 

13. Questions?

14. Security Consultant @ Cigital, Inc.
hon1nbo@hackingand.coffee
@hon1nbo