SQL injection is a code injection technique that attacks data-driven applications. It involves inserting malicious SQL statements into entry fields that are then executed by the database. There are different types of SQL injection attacks, including directly injecting code to immediately execute or injecting into persistent storage to be triggered later. Injection can occur through user input, cookies, or server variables. Prevention techniques aim to stop these types of attacks from harming databases.

1. SQL injection in Cybersecurity

2. AGENDA
What is SQL?
What is SQL injection?
SQL injection Attack type?
Prevention of SQL Injection Attack

3. What is SQL?
SQL is a domain-specific
language used in
programming and designed
for managing data held in a
relational database
management system, or for
stream processing in a
relational data stream
management system.

4. What is SQL injection?
SQL injection is a code injection
technique used to attack data-
driven applications, in which
malicious SQL statements are
inserted into an entry field for
execution.

5. Example

6. Types of sql attacks
The attacker can simply enter a malicious
stirring and cause the modified code to
be executed immediately.
The attacker injects into persistent
storage which is deemed as a trusted
source. An attack is subsequently
executed by another activity.
The attacker can manipulate the
implicit function to Char() by
changing the values of the
environment.

7. Injection Mechanism
Injection through User input
Injection through cookies
Injection through server variable
Second-order injection.
}First-Order
injection

8. Second-Order injection
 The application stores that input for future use &
responds to the request.
 The attacker submit a second request.
 To handle the second request, the application
retrieves the stored input & processes it, causing
the attacker’s injected SQL query to execute.

9. Inference
 Inject commands into the site and then
observe how the function/response of the
website changes.
 Blind injection
 Timing attacks

10. Blind SQL
Blind SQL (Structured Query Language) injection is
a type of SQL Injection attack that asks the database
true or false questions and determines the answer
based on the applications response

11. Timing Attack
A timing attack is a security exploit that allows
an attacker to discover vulnerabilities in the
security of a computer or network system by
studying how long it takes the system to
respond to different inputs.

12. Thank you