SQL injection lab

Chapter 2

Description:
• Kind of attack with adding and executing unintended code from untrusted
source
• Manipulate select statements
• Run DML or even DDL
• Run stored procedures

Firstly, SQL plus, using spool

 Open cmd
 Sqlplus username/password@connectionstring

SQL> Spool c:\labs\ch2\lab.txt

SQL> Select name from v$database;
SQL>Spool off;

Go to c:\labs\ch2\lab.txt
And open txt file to show the results.
 SQL injection
Create new user (db_sec):
Cmd> sqlplus / as sysdba – or username/password
SQL> Spool c:\labs\ch2\lab.txt;

Sql> create user db_sec identified by db_sec;

Sql> grant connect, resource to db_sec;
Sql> connect db_sec@lab/db_sec;
Create table
SQL> CREATE TABLE SALARY_INJECTION_TB
(PERSON_ID NUMBER(9,0),
PERSON_NAME VARCHAR2(120),
SALARY NUMBER(11,3)
);
Insert Demo data
insert into salary_injec on_tb values (123,'khaled',3000);
insert into salary_injection_tb values (456,'ali',1500);
insert into salary_injection_tb values (789,'hassan',5400);
Sql> commit;

Query about insert data

SQL> select * from salary_injection_tb;
Create procedure get salary of employee

SQL> create or replace PROCEDURE get_salary (

P_PERSON_NAME IN SALARY_INJECTION_TB.PERSON_NAME%TYPE,
P_SALARY OUT SALARY_INJECTION_TB.SALARY%TYPE
)
IS
query VARCHAR2(2000);
BEGIN
query := 'SELECT SALARY FROM SALARY_INJECTION_TB WHERE
PERSON_NAME='''
|| P_PERSON_NAME ||''''
;
DBMS_OUTPUT.PUT_LINE('Query: ' || query);
EXECUTE IMMEDIATE query INTO P_SALARY ;
DBMS_OUTPUT.PUT_LINE('Sal: ' || P_SALARY );
EXCEPTION
WHEN NO_DATA_FOUND THEN
DBMS_OUTPUT.PUT_LINE('NO DATA FOUND');

END;
/

Set server output message on

SQL> SET SERVEROUTPUT ON;

SQL injection
SQL> DECLARE
v_salary salary_injection_tb.salary%type;
BEGIN
GET_SALARY('ali',v_salary);
GET_SALARY(' '' OR person_id=123 --',v_salary);
END;
/
 Prevent SQL injection
SQL> create or replace PROCEDURE get_salary (
P_PERSON_NAME IN SALARY_INJECTION_TB.PERSON_NAME%TYPE,
P_SALARY OUT SALARY_INJECTION_TB.SALARY%TYPE
)
IS
v_query VARCHAR2(2000);
BEGIN
v_query := 'SELECT SALARY INTO :P_SALARY FROM SALARY_INJECTION_TB
WHERE PERSON_NAME=:P_PERSON_NAME';

DBMS_OUTPUT.PUT_LINE('Query: ' || v_query);

EXECUTE IMMEDIATE v_query INTO P_SALARY

USING P_PERSON_NAME ;

DBMS_OUTPUT.PUT_LINE('SaL: ' || P_SALARY );

EXCEPTION
WHEN NO_DATA_FOUND THEN
DBMS_OUTPUT.PUT_LINE('NO DATA FOUND');
END;
/

Try to inject SQL statements

SQL> DECLARE
v_salary salary_injection_tb.salary%type;
BEGIN
GET_SALARY('ali', v_salary);
GET_SALARY(' '' OR person_id=123 --', v_salary);
END;
/

DECLARE
P_PERSON_NAME VARCHAR2(120);
P_SALARY NUMBER;
BEGIN
P_PERSON_NAME := 'CCCC'' OR PERSON_ID = 123 --';

GET_SALARY(
P_PERSON_NAME => P_PERSON_NAME,
P_SALARY => P_SALARY
);

END;
/