Understanding SQL Injections

You are most welcome to this post.

Really thanks to you for your interest in this topics. :)

SQL attacks are very demotic because databases, which often comprise radiosensitive and precious content, are engaging targets. One of the most shared SQL attacks is the SQL shot aggress.

The original world discussions of SQL injection started attending around 1998. In 2013, SQL shot was rated the product one struggle on the OWASP top 10 lean.

In 2012, a hacking group that bills itself as “D33DS Reserves” leaked what it said were email addresses and passwords for 450,000 Character accounts. D33DS said it obtained the assemblage by executing a SQL solution formulation against an unnamed Character subdomain, which guarantee experts love identified as state Yahoo Voices. (Communicator: Yahoo Intelligence)

Security analysts should be competent to thank suspicious SQL queries in dictate to detect if the relational database has been subjected to SQL solution attacks.

An SQL shot assault consists of inserting a SQL query via the sign information from the computer to the covering. A booming SQL shot employ can indicate photosensitive information from the database, qualify database accumulation, kill medication dealings on the database, and, sometimes, distribute commands to the operating group.

Unless an utilisation uses exact input accumulation validation, it present be unguarded to the SQL injection assault. If an program accepts and processes user-supplied accumulation without any signal assemblage finding, an assailant could submit a maliciously crafted signaling advance to initiation the SQL injection assault.

Below is a simple example of a web server with a login page and an SQL backend. A normal SQL query might look like the following:

SELECT UserID FROM users WHERE username = 'admin' AND password = 'i<3Cisco'

The admin and i<3Cisco fields were provided by the user when they logged in. The SQL server searches the users table to find the first entry that matches those credentials. If it fails, nothing will be returned and the user will not be allowed to log in. If it succeeds, the user ID will be returned and the login process will continue.

The following is the same query with SQL injection:

SELECT UserID FROM users WHERE username = 'anything' OR 1=1 -- AND password = 'hacktheplanet'

As an analyst, if you see the string “or 1=1 –<space>” in an HTTP form response, what should you suspect?

The first part of the query, SELECT UserID FROM users WHERE username =, is hardcoded, which the attacker has no control over.

The attacker provides the other parts, where the username here is anything. It will not matter whether that user actually exists or not, because OR 1=1 overrides the username check. Because it uses OR, the first part can fail (for example, username is invalid), but the query will still succeed (because 1 is always equal to 1).

The last part of the query is password, but since the attacker provided two dashes and a space (–<space>), it has just been commented out. Even though the attacker typed hacktheplanet into the password field, the password won’t be interpreted by the SQL server. Note that there must be a space after the double dash (—).

The result is that the query will succeed, even though it should have failed, given the invalid user name and password. The problem is that the attacker will get logged in as the first user that matches, which is not a good thing because the first user in the database is generally an administrator. The attack could be modified to target a specific user name, but the attacker would have to know (or guess) that user name.

As an analyst, if you encounter such a SQL query, you need to determine which user ID was used by the attacker to log in, then identify any information or further access the attacker could have leveraged after a successful login.

The following example shows the result of the SQL query after entering ‘ or 1=1 –<space> in the name field (again, the trailing space is important), and Blah in the password field:

Reference: cisco.com