SQL Injection

Vadim Gellerman

What is SQL Injection?

SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed. This allows alteration of, for example, a hyperlink, which would then cause a false positive query result from the database and grant you access.

3 Classes of SQL Injection

SQL Injection can be broken up into 3 classes: 1. 2. 3. Inband - data is extracted using the same channel that is used to inject the SQL code. This is the most straightforward kind of attack, in which the retrieved data is presented directly in the application web page Out-of-Band - data is retrieved using a different channel (e.g.: an email with the results of the query is generated and sent to the tester) Inferential - there is no actual transfer of data, but the tester is able to reconstruct the information by sending particular requests and observing the resulting behaviour of the website/DB Server.

Inband is the most common, so let s focus on that:

Assume that you have a website with this existing hyperlink: http://[sitedomain]/products/products.asp?productid=123 This is a common format, and clicking it would take you to the product with ProductID = 123. From a SQL standpoint, this would could look like: SELECT ProductName, ProductDescription FROM Products WHERE ProductNumber = 123 Since the product id is actually visible in the link, it s not very safe, and is open to alteration and injection. Append or 1=1 to the link, to make it: http://[sitedomain]/products/products.asp?productid=123 or 1=1 Now from a SQL standpoint this becomes: SELECT ProductName, Product Description FROM Products WHERE ProductNumber = 123 OR 1=1 Since 1 = 1 is always true, this grants you access to the database, and displays all Product Names and Descriptions.

Inband ctd.
Some other examples of SQL injection through the inbound use of a hyperlink are: http://www.mydomain.com/products/products.asp?productid=123; DROP TABLE Products http://www.mydomain.com/products/products.asp?productid=123 UNION SELECT user-name, password FROM USERS The first will drop the products table, while the second while return two tables, the productID, and the union joined table with a list of user names and passwords.

SQL Injection for Login Credential Manipulation

SQL injection can also be used to grant login access onto a website, or online database GUI.
In order to do this, you use true statements to bypass security, or in some cases by using the administrative rights account. When logging onto a site, or server, the user name and password you put in is compared to an encrypted list in order to determine what type of access, if any, you have. By using a true statement, such as or 1=1 will cause the database to believe you input proper credentials.

Defending against SQL Injection

URL based injection: Avoid using clear text when coding in SQL. If your database and webpage are constructed in a way where you can view the data, it s open to injection. http://mysite.com/listauthordetails.aspx?SSN=172-32-9999 As in prior example, you could add a drop, or other command, to alter the database. Passwords, and other sensitive information need to be either encrypted or one way hashed. There is no full proof way to defend from injection, but by limiting sensitive information, you can insure that your information is at least somewhat protected.

Defending Against Injection ctd.

Login based injection: Restrict input field length. Instead of allowing an unlimited amount of characters to be entered for user name and password, restricting them will make it more difficult for someone to run a malicious query. While it may not prevent direct read access, it can prevent statements like drop. User privileges: Have a Superuser/Admin with full rights, but limit other users to only the things they need to do. This way, if someone accesses the database, they ll have a restricted amount of privileges. Use proper escapes strings, generally created through PHP. $SQL = "SELECT * FROM users where username = "mysql_real_escape_string($POST['user']); When someone tries to access the database using a command like OR 1 ;, their query would return \ OR 1\ , because your query was created to have a defined escape string.

FIN