The presentation by Kevin Alcock discusses SQL injection attacks, outlining their risks and the importance of protection against them. It covers defensive techniques like prepared statements, stored procedures, and least privilege access, as well as the use of web application firewalls. The speaker emphasizes the need for comprehensive testing and awareness to prevent such vulnerabilities.

1. Protecting your data from
SQL Injection attacks
July 20, 2016
Kevin Alcock

2. WARNING!
This presentation contains live hacking by a trained
professional*
Please do not try this at home
* Kevin is a Offensive Security Certified Profession (OSCP), only try this on computer on which you are authorised to do so.

3. Who is this old guy?
• 30 years of software development and
delivery
• 10 years in North America
• Mainly in Banking, Utilities, Telcos,
Local Government and Health
• @kevinnz

4. this old guy…
• Co-organiser ISIG-CHC meetup
• Offensive Security Certified Professional
(OSCP)
• Katipo Information Security Ltd.
• Been using MS-SQL since Version 1.1
(AKA Sybase 4.2)

5. OWASP TOP 10
A1 - Injection
A2 - Broken Authentication and Session Management
A3 - Cross-Site Scripting (XSS)
A4 - Insecure Direct Object References
A5 - Security Misconfiguration
A6 - Sensitive Data Exposure
A7 - Missing Function Level Access Control
A8 - Cross-Site Request Forgery (CSRF)
A9 - Using Known Vulnerable Components
A10 - Unvalidated Redirects and Forwards

6. SQL Injection (SQLi)
• First reported in 1998
(http://phrack.org/issues/54/1.html)
• insertion or "injection" of a SQL query via the input
data from the client to the application
• ‘ or 1 =1 ;#

7. Why is it bad?
• can read sensitive data from the database
• modify database data (Insert/Update/Delete)
• execute administration operations on the database
(such as shutdown the DBMS)
• recover the content of a given file present on the DBMS
file system
• in some cases issue commands to the operating
system

8. Demo

9. Defense

10. Prepared Statements (with
Parameterized Queries)
cmd.CommandText =
"SELECT T1.postid, T1.catid, T1.posttitle, T1.postbrief, T1.postbody, T1.postenabled, T2.catid, T2
cmd.Connection = conn;
var idParam = new SqlParameter
{
ParameterName = "@POSTID",
sqlDbType = SqlDbType.Integer,
Size = 8,
Direction = ParameterDirection.Input,
Value = postId
};
cmd.Parameters.Add(idParam);
C#

11. Stored Procedures
Try
Dim command As SqlCommand = new SqlCommand("sp_getAccountBalance", connection)
command.CommandType = CommandType.StoredProcedure
command.Parameters.Add(new SqlParameter("@CustomerName", CustomerName.Text))
Dim reader As SqlDataReader = command.ExecuteReader()
‘ …
Catch se As SqlException
‘ error handling
End Try
VB

12. White List Input
Validation
public String someMethod(boolean sortOrder) {
String SQLquery = "some SQL ... order by Salary " + (sortOrder ? "ASC" : "DESC");
...

13. Escaping All User Supplied
Input
declare @data sysname
set @data = ‘data’
— Will print [data]
print quotename( @data )
set @data = ‘this data needs to be escaped: ] ‘
— Will print [this data needs to be escaped: ]] ]
print quotename( @data )
TSQL

14. Least Privilege
• Use a separate user account ( not SA)
• GRANT as least amount of access
• Don’t run as SYSTEM!!!!!!!
• Don’t assume trust across boundaries

15. Web Application Firewall
(WAF)
• Commercial (F5, Check Point, Imperva)
• Cloud (Red Shield, CloudFlare)
• Open Source (mod-security, AppArmor)

16. Test for it
• Yes you can
• Automated integration of OWASP ZAP into your CI
• Add to junk input of scripts
• … humans
• Pentest from internal or external team
• “Free” Pentest

17. Code Review
• Add SQLi to your list to look for
• Get a code review
• Peer
• Intra company teams
• External

18. Summary
• SQLi is bad
• Don’t use one defensive technique
• Catch it before the bad guys do
• http://security.stackexchange.com/questions/12841
2/sql-injection-is-17-years-old-why-is-it-still-around

19. Check out
• http://bobby-tables.com
• https://bitbucket.org/t0x0/fooblog
• Open Web Security Project (http://owasp.org)
• Local ISIG and OWASP meet ups
• https://2016.chcon.nz

20. Thanks
• @TheHybridDBA for inviting me
• @t0x0_nz for his broken app
• and you for listening to me rant :)