14.2 SQL Injection attacks

SQL Injection (SQLI) attacks
SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution.
Code injection is the exploitation of a computer bug that is caused by processing invalid data. Injection is used by an attacker to introduce (or "inject") code into a vulnerable computer program and change the course of execution.
SQL injection is mostly known as an attack vector and can be used to attack any type of SQL database.
SQL injection attacks allow attackers to spoof identity, tamper with existing data, cause repudiation issues such as voiding transactions or changing balances, allow the complete disclosure of all data on the system, destroy the data or make it otherwise unavailable, and become administrators of the database server.
Four main classes of SQLI
• Classic SQLI
• Blind or Inference SQLI
• Database management system-specific SQLI
• Compounded SQLI
• SQL injection + insufficient authentication
• SQL injection + DDoS attacks
• SQL injection + DNS hijacking
• SQL injection + XSS
Technical implementations
• Incorrectly filtered escape characters
• Incorrect type handling
• Blind SQL injection
• Conditional responses
• Second order SQL injection
SQL Injection techniques
• Authorization bypass - bypass log on forms
• Using SELECT command - retrieve data from db
• Using INSERT command - add info to db
• using SQL server stored procedures
• Use single quote in the input
Incorrectly filtered escape characters
Below line of code illustrates this vulnerability:
SELECT * FROM users WHERE name = '" + userName + "';
Try “userName" variable as:
' OR '1'='1
' OR '1'='1' --
' OR '1'='1' ({
' OR '1'='1' /*
The SQL statements will be:
SELECT * FROM users WHERE name = '' OR '1'='1‘;
SELECT * FROM users WHERE name = '' OR '1'='1' -- ';
Query:
a';DROP TABLE users; SELECT * FROM userinfo WHERE 't' = 't
This input renders the final SQL statement as follows and specified:
SELECT * FROM users WHERE name = 'a';DROP TABLE users; SELECT * FROM userinfo WHERE 't' = 't‘;
PHP's mysql_query() function do not allow this for security reasons.
Incorrect type handling
This form of SQL injection occurs when a user-supplied field is not strongly typed or is not checked for type constraints.
Example:
"SELECT * FROM userinfo WHERE id =" + abc + ";“
abc=1;DROP TABLE users;
the SQL becomes:
SELECT * FROM userinfo WHERE id=1; DROP TABLE users;
Blind SQL Injection is used when a web application is vulnerable to an SQL injection but the results of the injection are not visible to the attacker.
– Hacker tests SQLI vulnerability with inputs which would cause server to generate invalid SQL query.
Conditional responses
One type of blind SQL injection forces the database to evaluate a logical statement.
Example: http://books.example.com/showReview.php?ID=5 would cause the server to run the query
SELECT * FROM bookreviews WHERE ID = 'Value(ID)';
and display the results for ID=5
Second order SQL injection occurs when submitted values contain malicious commands that are stored rather than executed immediately.