SQL Injection - Revision history

MPfrendl at 17:46, 18 December 2024

2024-12-18T17:46:29Z

← Older revision		Revision as of 17:46, 18 December 2024
Line 185:		Line 185:

	[[File:SQLi CNN-BiLSTM.png\|500px\|SQLi_CNN-BiLSTM]]		[[File:SQLi CNN-BiLSTM.png\|500px\|SQLi_CNN-BiLSTM]]


	~~== Practice ==~~

	~~=== Damn Vulnerable Web App (DVWA) ===~~
	Damn Vulnerable Web App (DVWA) is a PHP/MySQL web application that is damn vulnerable. Its main goals are to be an aid for security professionals to test their skills and tools in a legal environment, help web developers better understand the processes of securing web applications and aid teachers/students to teach/learn web application security in a class room environment.

	~~To Install the DvWA project follow the following page:~~

	* https://github.com/ethicalhack3r/DVWA

	~~Installation:~~

	~~=== Burp suite ===~~
	Burp Suite is a tool for performing penetration testing of web applications. With the Burp Suite, administrators can intercept and manipulate HTTP / HTTPS traffic to web applications before it is sent to the server. This enables security gaps in web applications to be discovered quickly and effectively.

	~~To start intercepting web traffic, you have to set the proxy of the browser to 127.0.0.1:8080. The proxy listener is by default configured on 127.0.0.1:8080 in burp suite.~~

	~~[[File:Proxy 4.png]]~~


	~~In the DVWA project move to "SQL Injection" and type in the following input as User ID:~~

	~~1' or 1=1~~

	~~This will deliver all users stored in the database as the condition is always true.~~

	~~[[File:demo2.png]]~~

	~~Afterwards when switching to burp suite tab "Proxy" -> History you will see that the request has been captured. Within the request the "PHPSESSID" will be included as part of the cookie.~~

	~~[[File:demo3.png]]~~

	~~With this sessionid it is possible to connect to database and get further information with the help of a third tool called "sqlmap". To get the databases within DBMS system use the following command:~~

	~~sqlmap -u "http://localhost/DVWA/vulnerabilities/sqli/?id=1&Submit=Submit" "--cookie=security=<e.g. medium>; PHPSESSID=<SessionID>" --dbs~~

	~~[[File:demo4.png]]~~

	~~To retrieve the tables of a specific database for example dvwa database. Replace the "--dbs" option with the "--tables" and "-D" option and define the database.~~

	~~sqlmap -u "http://localhost/DVWA/vulnerabilities/sqli/?id=1&Submit=Submit" "--cookie=security=low; PHPSESSID=t664gnfopfo6kem1nkon3a6kvb" --tables -D dvwa~~


	~~[[File:demo5.png]]~~

	~~Furthermore, it is possible to see the database schema from database "dvwa" as well by executing the following command:~~

	~~sqlmap -u "http://localhost/DVWA/vulnerabilities/sqli/?id=1&Submit=Submit" "--cookie=security=low; PHPSESSID=t664gnfopfo6kem1nkon3a6kvb" --columns -D dvwa -T users~~


	~~[[File:demo6.png]]~~

	~~At the end to get to the sensitive data the attacker will execute the command:~~

	~~sqlmap -u "http://localhost/DVWA/vulnerabilities/sqli/?id=1&Submit=Submit" "--cookie=security=low; PHPSESSID=t664gnfopfo6kem1nkon3a6kvb" --dump -D dvwa -T users~~


	~~[[File:demo7.png]]~~

	== References ==		== References ==

LDavidowicz: Readd the Picture of the CNN Model for SQL Detection to be able to submit my changes for IT Security CSDCBB Vertiefung

2024-12-18T16:42:47Z

Readd the Picture of the CNN Model for SQL Detection to be able to submit my changes for IT Security CSDCBB Vertiefung

← Older revision		Revision as of 16:42, 18 December 2024
Line 184:		Line 184:
	An example is the Detection with the CNN-BiLSTM Algorithm. Their Detection process looks like this:		An example is the Detection with the CNN-BiLSTM Algorithm. Their Detection process looks like this:

			[[File:SQLi CNN-BiLSTM.png\|500px\|SQLi_CNN-BiLSTM]]

LDavidowicz at 16:35, 18 December 2024

2024-12-18T16:35:40Z

← Older revision		Revision as of 16:35, 18 December 2024
Line 181:		Line 181:

	Standard SQL injection Detection Software are Fuzzing tools, dynamic analysis tools and Web Application Firewalls. Nowadays (2024) Machine Learning (ML) and Deep Learning (DL) Detection are coming in handy for IT Security. With ML and DL the Security keeps up to date and less likley expires, when new SQL injection attacks are evolving.		Standard SQL injection Detection Software are Fuzzing tools, dynamic analysis tools and Web Application Firewalls. Nowadays (2024) Machine Learning (ML) and Deep Learning (DL) Detection are coming in handy for IT Security. With ML and DL the Security keeps up to date and less likley expires, when new SQL injection attacks are evolving.

			An example is the Detection with the CNN-BiLSTM Algorithm. Their Detection process looks like this:



	== Practice ==		== Practice ==

MPfrendl: /* Example */ admin changed to myuser to match Image

2024-12-11T13:17:54Z

Example: admin changed to myuser to match Image

← Older revision		Revision as of 13:17, 11 December 2024
Line 40:		Line 40:
	</code>		</code>

	Suppose the attacker gives <code>~~admin~~' --</code> as the user and leaves the password empty. That results in the following query that will be evaluated by the database:		Suppose the attacker gives <code>myuser' --</code> as the user and leaves the password empty. That results in the following query that will be evaluated by the database:

	<code>		<code>
	SELECT * FROM Users WHERE user ='~~admin~~' --' AND password='';		SELECT * FROM Users WHERE user ='myuser' --' AND password='';
	</code>		</code>

Line 49:		Line 49:

	<code>		<code>
	SELECT * FROM Users = '~~admin~~';		SELECT * FROM Users = 'myuser';
	</code>		</code>

MPfrendl: /* Out-of-band SQLi */ Precised Statemends.

2024-12-11T13:16:28Z

Out-of-band SQLi: Precised Statemends.

← Older revision		Revision as of 13:16, 11 December 2024
Line 132:		Line 132:
	=== Out-of-band SQLi ===		=== Out-of-band SQLi ===

	Unlike traditional SQL injections, which rely on the standard communication channels between the ~~web application~~ and the database, out-of-band attacks involve retrieving data through alternative channels~~. This technique is particularly effective when the web server is unable to communicate directly with the system controlled by the attacker~~. Out-of-band SQL injection typically uses DNS requests, HTTP requests, or other network protocols to transmit data to the attacker's machine. Such is the case with Microsoft SQL Server’s xp_dirtree command, which can be used to make DNS requests to a server an attacker controls; as well as Oracle Database’s UTL_HTTP package, which can be used to send HTTP requests from SQL and PL/SQL to a server an attacker controls.		Unlike traditional SQL injections, which rely on the standard communication channels between the attacker and the targets database, out-of-band attacks involve retrieving data through alternative channels. Out-of-band SQL injection typically uses DNS requests, HTTP requests, or other network protocols to transmit data to the attacker's machine. Such is the case with Microsoft SQL Server’s xp_dirtree command, which can be used to make DNS requests to a server an attacker controls; as well as Oracle Database’s UTL_HTTP package, which can be used to send HTTP requests from SQL and PL/SQL to a server an attacker controls.

	== Prevention ==		== Prevention ==

MPfrendl: Merged Pages. Removed grammatical and semantic errors.

2024-12-11T11:26:12Z

Merged Pages. Removed grammatical and semantic errors.

← Older revision		Revision as of 11:26, 11 December 2024
Line 37:		Line 37:

	<code>		<code>
	SELECT * FROM Users WHERE user ='userName' ~~and~~ password='password';		SELECT * FROM Users WHERE user ='userName' AND password='password';
	</code>		</code>

Line 43:		Line 43:

	<code>		<code>
	SELECT * FROM Users WHERE user ='admin' --' ~~and~~ password='';		SELECT * FROM Users WHERE user ='admin' --' AND password='';
	</code>		</code>

MPfrendl: == SQL Injection == SQL Injection is a vulnerability, which can be found in applications, especially web applications. SQL injection vulnerabilities have been described as one of the most serious threats for Web applications. According to the List of OWASP Top 10 Web Application Security Risks Injections are still on top in 2020. A successful SQL injection exploit can read sensitive data from the database, modify database data, perform database administration operations such as shutting down th

2024-12-11T11:24:34Z

== SQL Injection == SQL Injection is a vulnerability, which can be found in applications, especially web applications. SQL injection vulnerabilities have been described as one of the most serious threats for Web applications. According to the List of OWASP Top 10 Web Application Security Risks Injections are still on top in 2020. A successful SQL injection exploit can read sensitive data from the database, modify database data, perform database administration operations such as shutting down th

Show changes

MPfrendl: This Page was a duplicate, is now the correct Page.

2024-12-10T12:58:39Z

This Page was a duplicate, is now the correct Page.

← Older revision		Revision as of 12:58, 10 December 2024
Line 198:		Line 198:
	== References ==		== References ==

			* https://ieeexplore.ieee.org/document/9445347
			* https://ieeexplore.ieee.org/document/8880301
			* https://ieeexplore.ieee.org/document/10481914
			* https://ieeexplore.ieee.org/document/9410675
			* https://ieeexplore.ieee.org/document/10250505
	* https://ieeexplore.ieee.org/document/6400112		* https://ieeexplore.ieee.org/document/6400112
			* https://ieeexplore.ieee.org/abstract/document/6396096
			* https://www.researchgate.net/publication/249773840_A_Classification_of_SQL_Injection_Attacks_and_Countermeasures
			* https://www.w3.org/Protocols/rfc2616/rfc2616.html
			* https://resources.infosecinstitute.com/topic/sql-injection-http-headers
			* https://www.researchgate.net/publication/322735440_Detection_and_Prevention_of_SQL_Injection_Vulnerabilities_in_Web_Applications_A_Review
			* http://www.gtisc.gatech.edu/bioaucsmith.html
	* https://pdfs.semanticscholar.org/81a5/02b52485e52713ccab6d260f15871c2acdcb.pdf/		* https://pdfs.semanticscholar.org/81a5/02b52485e52713ccab6d260f15871c2acdcb.pdf/
	* https://ieeexplore.ieee.org/abstract/document/6396096
	* http://web.archive.org/web/20210302071805/https://www.dbcybertech.com/pdf/sql-injection-detection-web-environment.pdf		* http://web.archive.org/web/20210302071805/https://www.dbcybertech.com/pdf/sql-injection-detection-web-environment.pdf
	* https://www.cisecurity.org/wp-content/uploads/2017/05/SQL-Injection-White-Paper2.pdf		* https://www.cisecurity.org/wp-content/uploads/2017/05/SQL-Injection-White-Paper2.pdf
Line 206:		Line 216:
	* http://web.archive.org/web/20200125164747/http://www.dvwa.co.uk/		* http://web.archive.org/web/20200125164747/http://www.dvwa.co.uk/
	* https://owasp.org/www-project-top-ten/		* https://owasp.org/www-project-top-ten/
	* https://ieeexplore.ieee.org/document/10481914
	* https://ieeexplore.ieee.org/document/9410675		[[Category:Pentesting]]
	* https:~~//ieeexplore.ieee.org/document/10250505~~

MPfrendl: This Page is a duplicate of SQL Injection (SQLi)

2024-12-10T12:53:45Z

This Page is a duplicate of SQL Injection (SQLi)

← Older revision		Revision as of 12:53, 10 December 2024
Line 209:		Line 209:
	* https://ieeexplore.ieee.org/document/9410675		* https://ieeexplore.ieee.org/document/9410675
	* https://ieeexplore.ieee.org/document/10250505		* https://ieeexplore.ieee.org/document/10250505

	~~[[Category:Basic]]~~

LDavidowicz at 17:11, 8 November 2024

2024-11-08T17:11:54Z

← Older revision		Revision as of 17:11, 8 November 2024
Line 206:		Line 206:
	* http://web.archive.org/web/20200125164747/http://www.dvwa.co.uk/		* http://web.archive.org/web/20200125164747/http://www.dvwa.co.uk/
	* https://owasp.org/www-project-top-ten/		* https://owasp.org/www-project-top-ten/
			* https://ieeexplore.ieee.org/document/10481914
			* https://ieeexplore.ieee.org/document/9410675
			* https://ieeexplore.ieee.org/document/10250505

	[[Category:Basic]]		[[Category:Basic]]