Assignment 1

Information and Network Security

Engineering
SQL Injection Attack

Student_Name: Printezis George

Student_ID: 12849
Lecturer: Dr. Pandithas
Stage: 3
Contents
Summary / Abstract .............................................................................................................. 3
Introduction .............................................................................................................................. 3
Introduction to Cyber Security ................................................................................................ 3
What is cybersecurity all about? .......................................................................................... 4
People...................................................................................................................................... 4
Processes ................................................................................................................................. 4
Technology ............................................................................................................................. 4
Why is cybersecurity important? ......................................................................................... 4
Introduction to SQL Injection Attack ..................................................................................... 5
Retrieving hidden data .......................................................................................................... 7
The Truth About SQL Injection Web Vulnerability ......................................................... 8
Preventing SQL Injection Vulnerabilities ........................................................................... 9
Technical Sections reporting research undertaken ......................................... 10
Technical implementation in SQL Injections ....................................................................... 10
Incorrectly filtered escape characters................................................................................ 10
Incorrect type handling....................................................................................................... 12
Blind SQL injection ............................................................................................................. 12
Conditional responses ......................................................................................................... 13
Second order SQL injection ............................................................................................... 13
Mitigation ................................................................................................................................. 14
Parameterized statements ................................................................................................... 14
Enforcement at the coding level ............................................................................................ 14
Escaping ................................................................................................................................ 14
Pattern check ....................................................................................................................... 15
Database permissions ............................................................................................................ 15
Discussion ............................................................................................................................... 16
Conclusions ............................................................................................................................ 16
References .............................................................................................................................. 16

George Printezis -University of Greenwich | 2

Summary / Abstract

Today, the IT industry is one of the most recognized and known in the world. Seeing big
giants such as Microsoft, apple, Oracle and many others ΙΤ companies, we able to see
that it's about something incredibly profitable in the market. In this case, we have
thousands of millions of employees and billions of customers who use these technologies
in different points.

Within this need for technology have come out formulas of privacy where it has been
implemented so that the user is required to have private access to technology and
specifically in the side of information technology. So, summarizing the above and saying
that in order to use both the Facebook platform and some websites even access to our
personal computer, we need an at least a password to ensure our privacy. Security
nowadays is very important because data theft is very common. It is no coincidence that
big companies face problems from hacking and are forced to develop cyber security more
and more to prevent attacks on their systems. So, what is now known and there are even
individual companies that are constantly developing it is cyber security.
What is it, however, that almost all platforms are using? Databases! Which the largest
number of the platforms are using SQL for themselves. It is a very common phenomenon
of their hacking or in other words the SQL Injection.

Introduction

The introduction will be very detailed before going to the SQL injection section.

Introduction to Cyber Security

Let’s take a look what is the Cyber Security more specifically?

‘Cybersecurity is the practice of protecting systems, networks, and programs from
digital attacks. These cyberattacks are usually aimed at accessing, changing, or
destroying sensitive information; extorting money from users; or interrupting normal
business processes.’ (Woland, 2019)
‘Implementing effective cybersecurity measures is particularly challenging today because
there are more devices than people, and attackers are becoming more innovative.’
(Woland, 2019)

George Printezis -University of Greenwich | 3

What is cybersecurity all about?

‘A successful cybersecurity approach has multiple layers of protection spread across the
computers, networks, programs, or data that one intends to keep safe. In an organization,
the people, processes, and technology must all complement one another to create an
effective defense from cyber-attacks.’ (Woland, 2019)

People

‘Users must understand and comply with basic data security principles like choosing
strong passwords, being wary of attachments in email, and backing up data. Learn more
about basic cybersecurity principles.’ (Woland, 2019)

Processes

‘Organizations must have a framework for how they deal with both attempted and
successful cyber-attacks. One well-respected framework can guide you. It explains how
you can identify attacks, protect systems, detect and respond to threats, and recover from
successful attacks. Watch a video explanation of the NIST cybersecurity framework.’
(Woland, 2019)

Technology

‘Technology is essential to giving organizations and individuals the computer security

tools needed to protect themselves from cyber-attacks. Three main entities must be
protected: endpoint devices like computers, smart devices, and routers; networks; and the
cloud. Common technology used to protect these entities include next-generation
firewalls, DNS filtering, malware protection, antivirus software, and email security
solutions.’ (Woland, 2019)

Why is cybersecurity important?

‘In today’s connected world, everyone benefits from advanced cyberdefense programs.
At an individual level, a cybersecurity attack can result in everything from identity theft,

George Printezis -University of Greenwich | 4

to extortion attempts, to the loss of important data like family photos. Everyone relies on
critical infrastructure like power plants, hospitals, and financial service companies.
Securing these and other organizations is essential to keeping our society functioning.’
(Woland, 2019)

‘Everyone also benefits from the work of cyberthreat researchers, like the team of 250
threat researchers at Talos, who investigate new and emerging threats and cyber-attack
strategies. They reveal new vulnerabilities, educate the public on the importance of
cybersecurity, and strengthen open source tools. Their work makes the Internet safer for
everyone.’ (Woland, 2019)

‘Figure 1(Career Opportunities in Cyber Security)’ (ISACA, 2019)

Introduction to SQL Injection Attack

‘SQL injection is a code injection technique, used to attack data-driven applications, in

which nefarious SQL statements are inserted into an entry field for execution (e.g. to
dump the database contents to the attacker).’ ([Link], 2012)
‘SQL injection must exploit a security vulnerability in an application's software, for
example, when user input is either incorrectly filtered for string literal escape characters
embedded in SQL statements or user input is not strongly typed and unexpectedly

George Printezis -University of Greenwich | 5

executed. SQL injection is mostly known as an attack vector for websites but can be used
to attack any type of SQL database.’ ([Link], 2013)

‘SQL injection attacks allow attackers to spoof identity, tamper with existing data, cause
repudiation issues such as voiding transactions or changing balances, allow the complete
disclosure of all data on the system, destroy the data or make it otherwise unavailable,
and become administrators of the database server.’ ([Link], 2013)

‘In a 2012 study, it was observed that the average web application received 4 attack
campaigns per month, and retailers received twice as many attacks as other industries.’
([Link], 2013)

let's assume we're going to make an injection on a Login Form

‘Typically, on a Web form for user authentication, when a user enters their name and
password into the text boxes provided for them, those values are inserted into a SELECT
query. If the values entered are found as expected, the user is allowed access; if they
aren't found, access is denied.’ (Rouse, 2019)

‘Figure 2(SQL Injection Attack Example)’ ([Link], 2013)

George Printezis -University of Greenwich | 6

Let's look at a simple example in a technical way with SQL commands.

Retrieving hidden data

‘Consider a shopping application that displays products in different categories. When the
user clicks on the Gifts category, their browser requests the URL:’ ([Link], 2013)

‘[Link] ([Link], 2013)

‘This causes the application to make an SQL query to retrieve details of the relevant
products from the database:’ ([Link], 2013)

‘SELECT * FROM products WHERE category = 'Gifts' AND released = 1’

([Link], 2013)

‘This SQL query asks the database to return:’ ([Link], 2013)

‘all details (*)’ ([Link], 2013)

‘from the products table’ ([Link], 2013)
‘where the category is Gifts’ ([Link], 2013)
‘and released is 1.’ ([Link], 2013)
‘The restriction released = 1 is being used to hide products that are not released. For
unreleased products, presumably released = 0.’ ([Link], 2013)

‘The application doesn't implement any defenses against SQL injection attacks, so an
attacker can construct an attack like:’ ([Link], 2013)
‘[Link] .’ ([Link], 2013)

‘This results in the SQL query:’ ([Link], 2013)

George Printezis -University of Greenwich | 7

‘SELECT * FROM products WHERE category = 'Gifts'--' AND released = 1’
([Link], 2013)

‘The key thing here is that the double-dash sequence -- is a comment indicator in SQL,
and means that the rest of the query is interpreted as a comment. This effectively removes
the remainder of the query, so it no longer includes AND released = 1. This means that
all products are displayed, including unreleased products.’ ([Link], 2013)

‘Going further, an attacker can cause the application to display all the products in any
category, including categories that they don't know about:’ ([Link], 2013)

‘[Link] .’ ([Link],
2013)

‘This results in the SQL query:’ ([Link], 2013)

‘SELECT * FROM products WHERE category = 'Gifts' OR 1=1--' AND released = 1’

([Link], 2013)

‘The modified query will return all items where either the category is Gifts, or 1 is equal
to 1. Since 1=1 is always true, the query will return all items.’ ([Link], 2013)

The Truth About SQL Injection Web Vulnerability

‘Even though we have just provided examples of how to prevent exploitation of SQL
Injection vulnerabilities, there is no magic wand.’ ([Link], 2019)

‘PHP, however, is attempting a new, aggressive approach. Since PHP 5.5, procedural
MySQL has been deprecated and will soon be removed entirely. This means that future
software projects will need to be switched to either MySQLi or PDO MySQL in order to
continue to work. This is a positive development, since it forces developers into a system
that handles prepared statements with relative ease – though it still requires stacking a
few operations. However, since many developers adopt a 'code golf' style (attempting to

George Printezis -University of Greenwich | 8

code in as few lines or characters as possible), many unfortunately will still opt for a
single-line straight query over a two-line prepared statement.’ ([Link], 2019)

‘There are other options that can account for development shortcomings, including but
not limited to: privilege limitations, data separation, web application firewalls, and many
other approaches. But until these options are employed as consistently as SQL injection
attacks, it may never be the case that injection-style attacks escape OWASP's Top 10
list.’ ([Link], 2019)

An important message for all Developers:

‘Be the change that is needed to ensure data and web application security, and keep your
databases safe from SQL injections!’ ([Link], 2019)

Preventing SQL Injection Vulnerabilities

‘Server-side scripting languages are not able to determine whether the SQL query string
is malformed. All they can do is send a string to the database server and wait for the
interpreted response.’ ([Link], 2019)

‘Surely, there must be a way to simply sanitize user input and ensure an SQL injection is
infeasible. Unfortunately, that is not always the case. There are perhaps an infinite
number of ways to sanitize user input, from globally applying PHP's addslashes() to
everything (which may yield undesirable results), all the way down to applying the
sanitization to "clean" variables at the time of assembling the SQL query itself, such as
wrapping the above $_GET['id'] in PHP's mysql_escape_string() function. However,
applying sanitization at the query itself is a very poor coding practice and difficult to
maintain or keep track of. This is where database systems have employed the use of
prepared statements.’ ([Link], 2019)

George Printezis -University of Greenwich | 9

Technical Sections reporting research
undertaken

Since the SQL Injection attack process consists of the SQL language that is:
 ‘DDL - Data Definition Language’ (López, 2017)

‘Groups the commands used to define the data structures: creation (CREATE),
modification (ALTER) and destruction (DROP) of databases, users, roles, tables,
user data-types and so on. this is a very declarative subset language’ (López, 2017)

 ‘DML - Data Manipulation Language’ (López, 2017)

‘Create, Update and Delete data: adding, removing or altering the data contained
in the above structures.’ (López, 2017)

 ‘DQL - Data Query Language’ (López, 2017)

‘commands to extract data from the database structured data.’ (López, 2017)

However, we are going to see technically how to do the SQL injection process

Technical implementation in SQL Injections

Incorrectly filtered escape characters

‘This form of SQL injection occurs when user input is not filtered for escape
characters and is then passed into an SQL statement. This results in the potential
manipulation of the statements performed on the database by the end-user of the
application.’ ([Link], 2019)
The following line of code illustrates this vulnerability:

statement = " SELECT * FROM users WHERE name = '" + userName + "' ; "

‘This SQL code is designed to pull up the records of the specified username from its table
of users. However, if the "userName" variable is crafted in a specific way by a malicious
user, the SQL statement may do more than the code author intended. For example, setting
the "userName" variable as:’ ([Link], 2019)

George Printezis -University of Greenwich | 10

' OR '1'='1

‘or using comments to even block the rest of the query (there are three types of SQL
comments’ ([Link], 2019)
‘All three lines have a space at the end:’ (JULY 7, 2016 Extracting Multiple Bits Per Request
From Full-blind SQL Injection Vulnerabilities, 2016)

' OR '1'='1' --
' OR '1'='1' {
' OR '1'='1' /*

renders one of the following SQL statements by the parent language:

SELECT * FROM users WHERE name = '' OR '1'='1';

SELECT * FROM users WHERE name = '' OR '1'='1' -- ';

‘If this code were to be used in an authentication procedure then this example could be
used to force the selection of every data field (*) from all users rather than from one
specific user name as the coder intended, because the evaluation of '1'='1' is always true.’
(JULY 7, 2016 Extracting Multiple Bits Per Request From Full-blind SQL Injection Vulnerabilities,
2016)
‘The following value of "userName" in the statement below would cause the deletion of
the "users" table as well as the selection of all data from the "userinfo" table (in essence
revealing the information of every user), using an API that allows multiple statements:’
(JULY 7, 2016 Extracting Multiple Bits Per Request From Full-blind SQL Injection Vulnerabilities,
2016)

a'; DROP TABLE users; SELECT * FROM userinfo WHERE 't' = ' t

‘This input renders the final SQL statement as follows and specified:’ (JULY 7, 2016
Extracting Multiple Bits Per Request From Full-blind SQL Injection Vulnerabilities, 2016)

SELECT * FROM users WHERE name = 'a';DROP TABLE users; SELECT * FROM
userinfo WHERE 't' = 't';

‘While most SQL server implementations allow multiple statements to be executed with
one call in this way, some SQL APIs such as PHP's mysql_query() function do not allow
this for security reasons. This prevents attackers from injecting entirely separate queries,
but doesn't stop them from modifying queries.’ (JULY 7, 2016 Extracting Multiple Bits Per
Request From Full-blind SQL Injection Vulnerabilities, 2016)

George Printezis -University of Greenwich | 11

Incorrect type handling
‘This form of SQL injection occurs when a user-supplied field is not strongly typed or is
not checked for type constraints. This could take place when a numeric field is to be used
in an SQL statement, but the programmer makes no checks to validate that the user
supplied input is numeric. For example:’ (JULY 7, 2016 Extracting Multiple Bits Per Request
From Full-blind SQL Injection Vulnerabilities, 2016)

statement := " SELECT * FROM userinfo WHERE id = " + a_variable + ";"

‘It is clear from this statement that the author intended a_variable to be a number
correlating to the "id" field. However, if it is in fact a string then the end-user may
manipulate the statement as they choose, thereby bypassing the need for escape
characters. For example, setting a_variable to’ (JULY 7, 2016 Extracting Multiple Bits Per
Request From Full-blind SQL Injection Vulnerabilities, 2016)

1;DROP TABLE users

‘will drop (delete) the "users" table from the database, since the SQL becomes:’ (JULY 7,
2016 Extracting Multiple Bits Per Request From Full-blind SQL Injection Vulnerabilities, 2016)

SELECT * FROM userinfo WHERE id=1; DROP TABLE users;

Blind SQL injection

‘Blind SQL Injection is used when a web application is vulnerable to an SQL injection
but the results of the injection are not visible to the attacker. The page with the
vulnerability may not be one that displays data but will display differently depending on
the results of a logical statement injected into the legitimate SQL statement called for that
page. This type of attack has traditionally been considered time-intensive because a new
statement needed to be crafted for each bit recovered, and depending on its structure, the
attack may consist of many unsuccessful requests. Recent advancements have allowed
each request to recover multiple bits, with no unsuccessful requests, allowing for more
consistent and efficient extraction’ (JULY 7, 2016 Extracting Multiple Bits Per Request From
Full-blind SQL Injection Vulnerabilities, 2016)
‘There are several tools that can automate these attacks once the location of the
vulnerability and the target information has been established.’ ([Link], 2019)

George Printezis -University of Greenwich | 12

Conditional responses

‘One type of blind SQL injection forces the database to evaluate a logical statement on an
ordinary application screen. As an example, a book review website uses a query string to
determine which book review to display. So
the URL [Link] would cause the server to run
the query’ (Blind SQL Injection, 2019)

SELECT * FROM bookreviews WHERE ID = 'Value(ID)';

‘from which it would populate the review page with data from the review with ID 5,
stored in the table bookreviews. The query happens completely on the server; the user
does not know the names of the database, table, or fields, nor does the user know the
query string. The user only sees that the above URL returns a book review. A hacker can
load the
URLs [Link] OR 1=1 and [Link]
[Link]/[Link]?ID=5 AND 1=2, which may result in queries

SELECT * FROM bookreviews WHERE ID = '5' OR '1'='1';

SELECT * FROM bookreviews WHERE ID = '5' AND '1'='2';

respectively. If the original review loads with the "1=1" URL and a blank or error page is
returned from the "1=2" URL, and the returned page has not been created to alert the user
the input is invalid, or in other words, has been caught by an input test script, the site is
likely vulnerable to a SQL injection attack as the query will likely have passed through
successfully in both cases. The hacker may proceed with this query string designed to
reveal the version number of MySQL running on the
server: [Link] ANDsubstring(@@version, 1,
INSTR(@@version, '.') - 1)=4, which would show the book review on a server running
MySQL 4 and a blank or error page otherwise. The hacker can continue to use code
within query strings to glean more information from the server until another avenue of
attack is discovered or his goals are achieved.’ (Blind SQL Injection, 2019)

Second order SQL injection

‘Second order SQL injection occurs when submitted values contain malicious commands
that are stored rather than executed immediately. In some cases, the application may
correctly encode an SQL statement and store it as valid SQL. Then, another part of that
application without controls to protect against SQL injection might execute that stored
SQL statement. This attack requires more knowledge of how submitted values are later
used. Automated web application security scanners would not easily detect this type of
SQL injection and may need to be manually instructed where to check for evidence that it
is being attempted.’ (Jones, 2015)

George Printezis -University of Greenwich | 13

Mitigation

‘An SQL injection is a well-known attack and easily prevented by simple measures. After
an apparent SQL injection attack on Talk Talk in 2015, the BBC reported that security
experts were stunned that such a large company would be vulnerable to it.’ (Jones, 2015)

Parameterized statements

‘With most development platforms, parameterized statements that work with parameters
can be used (sometimes called placeholders or bind variables) instead of embedding user
input in the statement. A placeholder can only store a value of the given type and not an
arbitrary SQL fragment. Hence the SQL injection would simply be treated as a strange
(and probably invalid) parameter value.’ (GitHub, 2012)
‘In many cases, the SQL statement is fixed, and each parameter is a scalar, not a table.
The user input is then assigned (bound) to a parameter.’ (GitHub, 2012)

Enforcement at the coding level

‘Using object-relational mapping libraries avoids the need to write SQL code. The ORM
library in effect will generate parameterized SQL statements from object-oriented code.’
(Revolvy, 2019)

Escaping
‘A straightforward, though error-prone way to prevent injections is to escape characters
that have a special meaning in SQL. The manual for an SQL DBMS explains which
characters have a special meaning, which allows creating a comprehensive blacklist of
characters that need translation. For instance, every occurrence of a single quote ( ' ) in a
parameter must be replaced by two single quotes ( '' ) to form a valid SQL string literal.
For example, in PHP it is usual to escape parameters using the
function mysqli_real_escape_string(); before sending the SQL query:’ (Revolvy,
2019)

$mysqli = new mysqli('hostname', 'db_username', 'db_password',

'db_name');
$query = sprintf("SELECT * FROM `Users` WHERE UserName='%s' AND
Password='%s'",
$mysqli->real_escape_string($username),
$mysqli->real_escape_string($password));
$mysqli->query($query);

George Printezis -University of Greenwich | 14

‘This function prepends backslashes to the following
characters: \x00 , \n , \r , \ , ' , " and \x1a . This function is normally used to make
data safe before sending a query to MySQL.’ (Revolvy, 2019)

‘PHP has similar functions for other database systems such as pg_escape_string() for
PostgreSQL. The function addslashes(string $str) works for escaping characters, and is
used especially for querying on databases that do not have escaping functions in PHP. It
returns a string with backslashes before characters that need to be quoted in database
queries, etc. These characters are single quote ('), double quote ("), backslash (\) and
NUL (the NULL byte)’ ([Link], 2019)

‘Routinely passing escaped strings to SQL is error prone because it is easy to forget to
escape a given string. Creating a transparent layer to secure the input can reduce this
error-proneness, if not entirely eliminate it.’ (Eisele, 2010)

Pattern check
‘Integer, float or boolean, string parameters can be checked if their value is valid
representation for the given type. Strings that must follow some strict pattern (date,
UUID, alphanumeric only, etc.) can be checked if they match this pattern.’
([Link], 2019)

Database permissions
‘Limiting the permissions on the database login used by the web application to only what
is needed may help reduce the effectiveness of any SQL injection attacks that exploit any
bugs in the web application.’ ([Link], 2019)
‘For example, on Microsoft SQL Server, a database logon could be restricted from
selecting on some of the system tables which would limit exploits that try to insert
JavaScript into all the text columns in the database.’ ([Link], 2019)

deny select on [Link] to webdatabaselogon;

deny select on [Link] to webdatabaselogon;
deny select on [Link] to webdatabaselogon;
deny select on [Link] to webdatabaselogon;
deny select on [Link] to webdatabaselogon;

George Printezis -University of Greenwich | 15

Discussion

A very interesting chapter in SQL injection which shows us that with the same
commands we do queries in our database, we can just use it as a method to steal data
through URL and access as administrators or other user accounts by doing SQL queries
in Login Form. Generally, it is a process that is considered illegal. And there are many
ways of forbidding rights to third-party users and thus sparing the SQL Injection Attacks

Conclusions

It is a very interesting process. Surely you need to know a lot of SQL requirements to
make an attack. Of course, there is a lot of legal responsibility. It is possible to overturn
this attack process so one of the first things you need to do if you build a database-served
application will be to secure it in some ways.

References

Bibliography
[Link]. (2013). Imperva Web Application Attack Report. [online] Available at:
[Link] [Accessed Jul.
2013].
López, M. (2017). What type of programming language is SQL?. [online] Quora. Available at:
[Link] [Accessed 20 Dec. 2017].
Rouse, M. (2019). What is SQL injection? - Definition from [Link]. [online]
SearchSoftwareQuality. Available at: [Link]
injection [Accessed Jan. 2010].
[Link]. (2012). SQL Injection. [online] Available at: [Link]
us/previous-versions/sql/sql-server-2008-r2/ms161953(v=sql.105) [Accessed 10 Apr. 2012].
[Link]. (2013). What is SQL injection and how to prevent it?. [online] Available at:
[Link] [Accessed Mar. 2013].
[Link]. (2019). What is the SQL Injection Vulnerability & How to Prevent it?. [online]
Available at: [Link]
vulnerability/#WhatIsAnSQLInjectionVulnerability [Accessed Jun. 2015].
Woland, A. (2019). What Is Cybersecurity? [online] Cisco. Available at:
[Link] [Accessed 16 Jan.
2019].
ISACA (2019). RSA Survey – Career Opportunities in Cyber Security – Explained Visually by
ISACA. [image] Available at: [Link] [Accessed 19 May 2016].

George Printezis -University of Greenwich | 16

[Link]. (2019). IBM Informix Guide to SQL: Syntax. [online] Available at:
[Link] [Accessed 4 Jun. 2018].
JULY 7, 2016 Extracting Multiple Bits Per Request From Full-blind SQL Injection Vulnerabilities.
(2016). Training for manipulating all kinds of things: Extracting Multiple Bits Per Request From
Full-blind SQL Injection Vulnerabilities. [online] Available at:
[Link]
[Link] [Accessed 7 Jul. 2016].
[Link]. (2019). Using SQLBrute to brute force data from a blind SQL injection point
([Link]). [online] Available at:
[Link]
[Link] [Accessed 14 Jun. 2018].
Blind SQL Injection. (2019). Guide Blind SQL Injection. [online] Available at:
[Link]
games/[Link] [Accessed 6 Feb. 2009].
Jones, C. (2015). Questions for TalkTalk. [online] BBC News. Available at:
[Link] [Accessed 26 Oct. 2015].
GitHub. (2012). OWASP/CheatSheetSeries. [online] Available at:
[Link]
n_Cheat_Sheet.md [Accessed 2 Feb. 2019].
Revolvy, L. (2019). "SQL injection" on [Link]. [online] [Link]. Available at:
[Link] [Accessed 10 Aug. 2014].
[Link]. (2019). PHP: addslashes - Manual. [online] Available at:
[Link]
hp [Accessed 5 Sep. 2011].
Eisele, R. (2010). Transparent query layer for MySQL • Open Source is Everything. [online]
[Link]. Available at: [Link]
[Accessed 11 Nov. 2010].
[Link]. (2019). Guesswork Plagues Web Hole Reporting. [online] Available at:
[Link] [Accessed 6 Mar. 2002].

George Printezis -University of Greenwich | 17