SQL Injection - Database
Vulnerability Testing
By
Paul Mutinda,
1
What is SQL Injection
Involves Inserting SQL commands into the URL gets the
database server to dump, alter, delete, or create
information in the database.
SQL injection involves an attacker appending SQL database
commands within an input field – form or URL
If the web application code does not filter (sanitize) the
input, SQL commands could be executed on the web server,
allowing an attacker to bypass network security, and
directly interrogate the back-end database.
With SQL injection, an attacker is able to return and steal
tables of information, make changes to records, or even
delete the entire database.
Understanding SQL Injection
3
SQL Injection:What are the implications
4
SQL Injection -What are the implications
Information leakage through DB error messages
Data extracted from your DB
Take complete control your DB (insert data, delete tables, and so on)
Execute commands on your system
Complete system compromise
How Web Application Work
6
SQL Injection and Server-Side
Technologies
7
Types of SQL Injection
1. Input Based SQL Injection
2. Error Message /URL Based SQL Injection
8
1. Input Based SQL Injection
This is executed through input field
9
Understanding HTTP POST
Request
10
Understanding SQL Injection Query
11
Understanding SQL Injection
Query: Code Analysis
12
Example : [Link]/[Link]
- First login with no username and password, the form responds requesting
to input valid username
13
Example : [Link]/[Link]
- Next login with any username and no password, the form responds requesting to input valid
password
14
Example : [Link]/[Link]
- Next login with any username and any password, the form responds Login Failed
15
Example : [Link]/[Link]
- Next perform SQL injection on username field using statement : ‘ OR 1=1--
insert any password to bypass ‘Value required’ validation, then login
16
Example: Results to Successful log in
2. Error Message /URL Based SQL Injection
18
Blind SQL Injection: Types
19
Information Gathering
20
Extracting Information through
Error Messages
21
Example : Extracting information through error messages
- First identify vulnerable URLs with dynamic ids using syntax: .php?id=
22
Example : Extracting information through error messages
- Replace the id=1 with a string id=test, then press ENTER
23
Example : Extracting information through error messages
- Note the error message – Database server information is given as MySQL
24
Example 2 : Extracting information through error messages
- Perform parameter tempering by adding id=115’ then press ENTER
25
Example 2 : Extracting information through error messages
- Note the syntax showing the directory path to the root directory (/home)
26
Example 3: Extracting information through error messages
- Database Name, table name and columns information
discovered
27
28
Perform Union SQL Injection
29
Fixing SQL Injection
Input validation
As often as possible, only accept known good values,
rather than sanitizing
Never use dynamic queries
Use parameterized query APIs
These APIs encode the user input, and make sure that
it doesn’t break the SQL statements
Use stored procedures
They are generally safe from SQL Injection
End
__________________________
Next: SQL Injection Using
Sqlmap