This document provides an overview of SQL injection (SQLi), including what it is, how to detect and exploit it, and how to prevent it. SQLi allows attackers to interfere with and extract data from SQL queries by inserting malicious SQL code. It can be used to bypass authentication, obtain sensitive information, alter or delete database content, and execute remote commands. The document outlines manual and automated testing techniques for detecting SQLi vulnerabilities and tools like SQLMAP for exploiting them. It also discusses prevention best practices.

1. SQL Injection
101
SQLi

2. SQLi
Jason Pubal
Contact Information
Website
www.intellavis.com/blog
Social
www.linkedin.com/in/pubal
E-Mail Twitter: @pubal
jpubal@gmail.com

3. SQLi
SQL Injection
Outline
OWASP Top 10
Web Architecture
What is SQLi?
Detecting SQLi
Exploiting SQLi
Preventing SQLi

4. SQLi

5. SQLi

6. SQLi
Web Application Basics
SELECT *FROM productsWHERE category=‘balls’
Get www.MyAwesomeStore.com/buystuff.php?category=balls
baseballs
soccer balls
basketballs
blue balls
tennis balls

7. SQLi
//connect to database
$conn = mysql_connect(“localhost”, “username”, “password”);
//build sql statement
$query = “SELECT userid FROM AppUsers WHERE user=
‘$_POST[“username”]’ “ .
“AND password = ‘$_POST[“password”]’ “ ;
//run query
$result = mysql_query($query);
//ensure a user was returned
$numrows = mysql_num_rows($result);
if ($numrows != 0){
header(“Location: admin.php”);
}else{
die(‘Incorrect username or password.’)
}

8. SQLi
SELECT userid
FROM AppUsers
WHERE user = ‘jsmith’
AND password = ‘kitteh’ ;

9. SQLi
SELECT userid
FROM AppUsers
WHERE user = ‘jsmith’
AND password = ‘anything’ OR ‘1’ = ‘1’ ;

10. SQLi
//connect to database$conn = mysql_connect(“localhost”,
“username”, “password”);
//build sql statement$query = “SELECT userid FROM AppUsers
WHERE user= ‘$_POST[“username”]’ “ .“AND password =
‘$_POST[“password”]’ “ ;
//run query$result = mysql_query($query);
//ensure a user was returned$numrows = mysql_num_rows($result);
if ($numrows != 0){header(“Location: admin.php”);}else{die(‘Incorrect
username or password.’)}

11. SQLi
Impact
•Authentication Bypass: This attack allows an attacker to log on to an application without
supplying a valid username and password.
•Information Disclosure: This attack allows an attacker to obtain sensitive information that
is contained in a database.
•Alter Data: This attack involves the alteration of the contents of a database. This can be
used to deface a web page. It can also be used to insert malicious content, like JavaScript
malware.
•Delete Data: This attack allows an attacker to delete information with the intent to cause
harm or delete log or audit information that is contained in a database.
•Remote Command Execution: Performing command execution through a database can
allow an attacker to compromise the host operating system. These attacks often leverage an
existing, predefined stored procedure for host operating system command execution.

12. SQLi
Vulnerable Sites
WhiteHat Security Statistics Report

13. SQLi
Web Application Attacks
Web Hacking Incident DB
Body Text

14. SQLi
Detecting SQLi
Testing by Inference Special Characters
•If I see this, then this is probably -- Comment everything after
happening at the back end. /* Begin comment
*/ End Comment
‘ Mark beginning/end of string
Try to break the application. ; End of SQL statement
“ Delimit identifiers
•Find the Inputs likely to be generating
dynamic SQL.
•Use Input that will create invalid SQL. Type Issues
•See if you get errors!
use strings instead of numbers
add unexpected spaces

15. SQLi
SQLi Errors

16. SQLi
Detecting SQLi
Other Signs
HTTP 500 Status
Custom Application Errors
Timing
Differences in Web Page

17. SQLi
Manual Testing

18. SQLi
Manual Testing

19. SQLi
Automated Testing
Browser Plugins

20. SQLi
Automated Testing
Web Application Vulnerability Scanner

21. SQLi
Automated Testing
Web Application Vulnerability Scanner

22. SQLi
Exploitation
SQLMAP

23. SQLi
Preventing SQLi

24. SQLi
Sources / Tools Used
More about SQLi
OWASP - https://www.owasp.org/index.php/SQL_Injection
SQL Injection Attacks and Defense (Amazon) - http://goo.gl/KSUAl
Web Application Vulnerability Scanners
ZAP – http://code.google.com/p/zaproxy/
w3af – http://w3af.sourceforge.net/
Browser Plugins
Tamper Data – https://addons.mozilla.org/en-US/firefox/addon/tamper-data/
SQL Inject Me – https://addons.mozilla.org/en-US/firefox/addon/sql-inject-me/
Vulnerable Web Applications
OWASP Broken Web Apps – http://code.google.com/p/owaspbwa/
The BodgeIt Store – http://code.google.com/p/bodgeit/
Damn Vulnerable Web Application – http://www.dvwa.co.uk/
SQL Exploitation
SQLMAP - http://sqlmap.org/
Collections of Tools
Backtrack – http://www.backtrack-linux.org/
Mantra – http://getmantra.com/

25. THANK YOU FOR
COMING
Contact Info:
jpubal@gmail.com
www.intellavis.com/blog
Twitter: @pubal