Download as PDF, PPTX
Uploaded byMd Syed Ahamad
Web Application Security II - SQL Injection
The document presents a project on detecting and preventing SQL injection, detailing methods, mechanisms, and tools like WebGoat and WebScarab. It discusses the nature of SQL injection attacks and their impacts, as well as prevention techniques such as parameterized queries and indirect SQL queries. The conclusion emphasizes the necessity of advanced scanning structures and hashing of user credentials for improved security.
More Related Content
Similar to Web Application Security II - SQL Injection
Web Application Security II - SQL Injection
- 1. Web Application Security Presentedby: Md Syed Ahamad Detection and Prevention of SQL Injection 1 Project under: Dr. Ferdous Ahmed
- 2. Project Role Theory Analysis Implementation CS200Detection and Prevention of SQL Injection 2
- 3. Topics Introduction Webgoatand WebScarab Prevention Mechanism and Detection Mechanism Methods Visual Advantage and disadvantage Conclusion CS200Detection and Prevention of SQL Injection 3
- 4. Introduction Thread Agent– Application Specific Attack Vector Exploitability – Easy Security Weakness Prevalence – Common Detectability – Average Technical impacts – severe Business impacts – Business Specific CS200Detection and Prevention of SQL Injection 4
- 5. WebGoat and WebScarab WebGoat – Web based application for demonstration of common Web App. Flaws. Application penetration testing techniques WebScarab – use as proxy in the localhost for WebGoat. Shows Request and Response intercept Parameters can be modified CS200Detection and Prevention of SQL Injection 5
- 6. WebScarab CS200Detection and Preventionof SQL Injection 6
- 7. SQL Injection Seriousthread String query = "SELECT * FROM accounts WHERE custID='" + request.getParameter("id") + "'"; Select * from account where username=‘”+a+”’ and PIN=‘”+b+”’; Here, a=998’or’1’=‘1, b may be empty or anything. CS200Detection and Prevention of SQL Injection 7
- 8. Prevention Mechanism ParametrizedQuery Specific primitive data type CS200Detection and Prevention of SQL Injection 8
- 9. Prevention Mechanism IndirectSQL Query Avoid Direct SQL Query Some tuple similar to the input is taken out and match If match is found go ahead otherwise return false CS200Detection and Prevention of SQL Injection 9
- 10. Detection Mechanism Methods Regular Expression – /w*((%27)|('))((%6F)|o|(%4F))((%72)|r|(%52))/ix @"(;|s)(exec|execute|select|insert|update|delete|create|alter|drop|rename|truncate |backup|restore)s" Parametrized Visual Advantage and disadvantage CS200Detection and Prevention of SQL Injection 10
- 11. Detection Mechanism CS200Detection andPrevention of SQL Injection 11
- 12. Conclusion Its notsolving the all injection flaws. Hierarchical structure of Scanner is required. Hashing of user’s input credentials. CS200Detection and Prevention of SQL Injection 12