Scribd
Upload
5 views3 pages

The Injection Technique - SQLi Attack

The document discusses SQL Injection (SQLi) attacks, detailing how they exploit poor input validation in SQL queries, leading to potential data exposure or modification. It outlines common targets, types of SQLi attacks, and various avenues through which these attacks can occur, including web and mobile applications, APIs, and legacy systems. Prevention techniques such as using prepared statements, input validation, and regular security testing are emphasized to mitigate the risks associated with SQLi.

Uploaded by

balamurugan.s
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
5 views3 pages

The Injection Technique - SQLi Attack

The document discusses SQL Injection (SQLi) attacks, detailing how they exploit poor input validation in SQL queries, leading to potential data exposure or modification. It outlines common targets, types of SQLi attacks, and various avenues through which these attacks can occur, including web and mobile applications, APIs, and legacy systems. Prevention techniques such as using prepared statements, input validation, and regular security testing are emphasized to mitigate the risks associated with SQLi.

Uploaded by

balamurugan.s
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

UNIT IV DATABASE SECURITY

Need for database security – SQL Injection Attacks – The Injection Technique – SQLi Attack
Avenues and Types.

3. The Injection Technique


✅ How SQLi works:

1. User input is inserted directly into a SQL query without validation


2. The input alters the structure of the SQL query
3. The database executes the modified query, possibly exposing or modifying data

✅ Common Targets:

 Login forms
 Search bars
 URL query strings
 Feedback forms
 API parameters

✅ Impacts:

 Authentication bypass
 Extract entire databases
 Modify or delete records
 Execute administrative tasks like shutting down the database
 Drop entire tables (e.g., DROP TABLE users)

✅ 4. SQLi Attack Avenues


✅ 1. Web Applications

The most common vector; especially those that use dynamic SQL with user inputs.

✅ 2. Mobile Applications

Apps using local or cloud-based SQL storage (e.g., SQLite, MySQL) may be vulnerable.

✅ 3. APIs

APIs that use query strings or post data to build SQL queries are potential targets.

✅ 4. Legacy Systems

Old systems without modern security patches are easy to exploit.

✅ 5. ORMs (Object-Relational Mappers)


When improperly used, ORMs can also introduce injection flaws.

✅ 5. Types of SQL Injection Attacks


Type Description
Classic SQLi The attacker inputs malicious SQL code that is directly executed.
The app does not show output. Attacker deduces info by observing behavior
Blind SQLi
(e.g., true/false responses).
Time-Based Blind SQLi Uses delays (like SLEEP(5)) to infer whether the query executed successfully.
Uses the UNION operator to combine malicious query with the original one to
Union-Based SQLi
fetch extra data.
Forces database errors to reveal information. For example: dividing by 0 or
Error-Based SQLi
accessing an invalid column.
Stored/Second-Order Malicious SQL is saved in the database and executed later when retrieved by a
SQLi different query.

✅ 6. Prevention Techniques
✅ 1. Use Prepared Statements / Parameterized Queries

 Do not concatenate SQL with user inputs


 Use placeholders like ? or named parameters

Example (Python with SQLite):

python
CopyEdit
[Link]("SELECT * FROM users WHERE username=? AND password=?", (uname, pwd))

✅ 2. Input Validation

 Whitelist expected input formats (e.g., only alphanumeric)


 Block or escape dangerous characters (', --, ;, /*, etc.)

✅ 3. Least Privilege Principle

 Application accounts should not have admin access


 Use read-only accounts where applicable

✅ 4. Web Application Firewalls (WAF)

 Can block known SQLi patterns


 Adds a security layer against automated tools

✅ 5. Avoid Detailed Error Messages

 Don't show database errors to users


 Log detailed errors for internal review only
✅ 6. Regular Security Testing

 Conduct vulnerability scans, code reviews, and penetration tests

✅ Summary
 SQL Injection is one of the most common and dangerous security threats.
 It exploits poor input validation and unsafe query construction.
 Attacks can vary from simple data theft to complete database destruction.
 Proper coding practices and security tools can completely prevent SQLi.

You might also like