According to a 2015 study, 86% of over 30,000 websites tested had at least one serious vulnerability. Of the vulnerabilities found, 61% were resolved within 193 days. SQL injection is a type of attack where an attacker tries to alter SQL statements by inserting new SQL keywords or operators. Examples provided demonstrate how an attacker can use SQL injection to drop all databases or return all records. Prevention techniques like escaping characters and using prepared statements can help protect against SQL injection attacks.

1. Sayed Ahmad Naweed

2. of 30,000 websites
tested by WhiteHat
Sentinel had at least
one serious
vulnerability.
86%
Source: https://www.whitehatsec.com/statistics-report/featured/2015/05/21/statsreport.html

3. of these vulnerabilities
were resolved.
61%
Source: https://www.whitehatsec.com/statistics-report/featured/2015/05/21/statsreport.html

4. 193 Days

5. From a single injection we
accessed EVERYTHING
Why do you put such faith
in a company that allows
itself to become open to
these simple attacks?
“
”
“
”
LulzSec
Source: http://www.theguardian.com/technology/2012/aug/29/lulzsec-hacker-arrest-sony-attack

6. SQL is used to communicate
with a relational database.
SQL

7. When an attacker attempts to
change the logic, semantics or
syntax of a legitimate SQL
statement by inserting new
SQL keywords or operators into
the statement.
Source: Halfond, William GJ, and Alessandro Orso. "AMNESIA: analysis and monitoring for NEutralizing SQL-injection attacks." Proceedings of the
20th IEEE/ACM international Conference on Automated software engineering. ACM, 2005.
SQL Injection

10. SQL

11. Example
#1

12. SELECT * FROM USERS
WHERE
Username = “sayed”

13. SELECT * FROM USERS
WHERE
Username = “sayed”“

14. SELECT * FROM USERS
WHERE
Username = “sayed”; Drop All
DATABASES
;DROP ALL DATABASES;

15. Example
#2

16. OR ‘1’ = ‘1’
SELECT * FROM USERS
WHERE
username = “sayed”
AND
Password =“1234” or ‘1’ = ‘1’

17. Live Demo
http://sqlzoo.net/hack/

18. Prevention Techniques

19. Scape
Characters
mysql_real_escape_string(Query)
Prepared
Stetement
SELECT * FROM USERS
WHERE
username = ?

20. Conclusion
• Your vulnerable if you do not use prepared
statement.
• Don’t forget
As hacks go, there are worst ones!

21. any question …