CYBERSECURITY:- A

Practical Approach

Topic:- SQL Injection Attack

Presented By:
Anush S Nuchhi 2GI19EC191
Basavaraj D Shellikeri 2GI19EC033
Suman G N 2GI19EC159
Agenda
Types of SQL Injection Attacks Prevention
Application Security
3 5
1

2 4

SQL Injection Attack Demo-SQL Injection Attack

Web Application Security
The process of developing, adding, and testing security
features within applications to prevent security
vulnerabilities against threats such as unauthorized access
and modification.
SQL Injection
IMPLEMENTATION
• php?id:- SQL Vulnerability Applications
• WebGoat:- A Deliberately insecure web application
categorized by OWASP
• Latest Version used is v8.0.0.M23
• Genre’s are:- Injection Flaws, Authentication Flaws,
Cross-Site Scripting, etc.
SQL Injection
Tools:
1. JVM(Java Virtual Machine)
2. Tomcat:- Open Source java Servlet
Goals:
1. String and Numeric SQL Injection
2. DML, DDL, DCL
Exploitations:
Spoof Identity, Tamper with existing Data, Add Users, Common in
PHP, ASP
Webgoat Login
Severity:
Limited by
• Attacker

• Database Technology

Advanced SQL Injection:

• Goals are Combining SQL Injection Techniques

Blind SQL Injection:

• Used when the web application is configured to show
generic error messages.
 PREVENTING SQL INJECTION ATTACK

• PERFORMING STATIC AND

DYNAMIC TESTING

• USING PARAMETERIZED QUERIES

AND ORMS
• Using escape characters in SQL queries

• Enforcing least privilege on database

• Enabling web-application firewalls.

CONCLUSION:
A successful SQL injection exploit can read sensitive
data from the database.
The main consequences of occurrence of SQL injection
are:
◦ Confidentiality
◦ Authentication
◦ Authorization
◦ Integrity