SQL Injection (SQLi) - Revision history

MPfrendl: This Page is a duplicate of SQL Injection => Category Removed

2024-12-10T12:58:09Z

This Page is a duplicate of SQL Injection => Category Removed

← Older revision		Revision as of 12:58, 10 December 2024
Line 164:		Line 164:
	* https://www.researchgate.net/publication/322735440_Detection_and_Prevention_of_SQL_Injection_Vulnerabilities_in_Web_Applications_A_Review		* https://www.researchgate.net/publication/322735440_Detection_and_Prevention_of_SQL_Injection_Vulnerabilities_in_Web_Applications_A_Review
	* http://www.gtisc.gatech.edu/bioaucsmith.html		* http://www.gtisc.gatech.edu/bioaucsmith.html


	~~[[Category:Pentesting]]~~

NKirnbauer: NKirnbauer moved page SQL injection (SQLi) to SQL Injection (SQLi)

2024-10-23T10:03:39Z

NKirnbauer moved page SQL injection (SQLi) to SQL Injection (SQLi)

← Older revision		Revision as of 10:03, 23 October 2024
(No difference)

NKirnbauer: gendering

2024-10-23T09:11:58Z

gendering

← Older revision		Revision as of 09:11, 23 October 2024
Line 93:		Line 93:
	==== Time-based SQLi ====		==== Time-based SQLi ====

	The Timing attack allows an attacker to gather information from the response time of the database by executing an injected query in the form of an if/then statement and the "WAITFOR" keyword. This causes a delay along with the branches in the database response for a specific amount of time. The attacker can then determine which branch was chosen in ~~his~~ injection by analyzing the increase or decrease in database response time as well as the answer to the injected question.		The Timing attack allows an attacker to gather information from the response time of the database by executing an injected query in the form of an if/then statement and the "WAITFOR" keyword. This causes a delay along with the branches in the database response for a specific amount of time. The attacker can then determine which branch was chosen in their injection by analyzing the increase or decrease in database response time as well as the answer to the injected question.

	In the example the attacker tries to find the first character of the first table by comparing its ASCII value with X. If there is a 9-second delay in the response time, they realize that the answer to this question is true. So by continuing the process the name of the first table can be discovered.		In the example the attacker tries to find the first character of the first table by comparing its ASCII value with X. If there is a 9-second delay in the response time, they realize that the answer to this question is true. So by continuing the process the name of the first table can be discovered.

NKirnbauer: fixed link

2024-10-23T09:11:12Z

fixed link

← Older revision		Revision as of 09:11, 23 October 2024
Line 163:		Line 163:
	* https://resources.infosecinstitute.com/topic/sql-injection-http-headers		* https://resources.infosecinstitute.com/topic/sql-injection-http-headers
	* https://www.researchgate.net/publication/322735440_Detection_and_Prevention_of_SQL_Injection_Vulnerabilities_in_Web_Applications_A_Review		* https://www.researchgate.net/publication/322735440_Detection_and_Prevention_of_SQL_Injection_Vulnerabilities_in_Web_Applications_A_Review
	* http://www.gtisc.gatech.edu/~~bio aucsmith~~.html		* http://www.gtisc.gatech.edu/bioaucsmith.html


	[[Category:Pentesting]]		[[Category:Pentesting]]

GFehringer: /* Prevention Methods */

2024-01-08T21:34:34Z

Prevention Methods

← Older revision		Revision as of 21:34, 8 January 2024
Line 149:		Line 149:
	The idea of least privilege both avoids SQL injection attacks and mitigates their impact if they do occur. Instead of granting users access to the entire database, this strategy allows them to simply access the tables they require. They should also be given only the privileges they require, such as read-only, write-only, or read and write, depending on their needs.		The idea of least privilege both avoids SQL injection attacks and mitigates their impact if they do occur. Instead of granting users access to the entire database, this strategy allows them to simply access the tables they require. They should also be given only the privileges they require, such as read-only, write-only, or read and write, depending on their needs.
	The concept of least privilege is a cornerstone of security, and it also applies to SQL injections. As a result, the impact of SQL injection is reduced because it only impacts one table or a set of tables rather than the entire database.		The concept of least privilege is a cornerstone of security, and it also applies to SQL injections. As a result, the impact of SQL injection is reduced because it only impacts one table or a set of tables rather than the entire database.
	In some circumstances, instead of allowing access to the entire table, a view for that piece of the table should be established.		In some circumstances, instead of allowing access to the entire table, a view for that piece of the table should be established.

			==== SQL Server Firewalling ====

			Implementing a firewall can block potential attacks before they reach the web application. The firewall should filter out entries with binary data, escape sequences, and comment characters. Multiple layers of validation can be added and unvalidated user input can be concatenated.

	== References ==		== References ==

GFehringer: /* SQLI Attacks */

2024-01-08T21:19:29Z

SQLI Attacks

← Older revision		Revision as of 21:19, 8 January 2024
Line 37:		Line 37:
	The strategies can be used independently or jointly, depending on the attacker's goal. Some of these SQLi attacks are listed below:		The strategies can be used independently or jointly, depending on the attacker's goal. Some of these SQLi attacks are listed below:

	<li style="display: inline-block;"> [[File:SQLiType.gif\|thumb\|none\|500px\| Nada Basit, Abdeltawab Hendawi, Joseph Chen, and Alexander Sun. 2019. A Learning Platform for SQL Injection. In Proceedings of the 50th ACM Technical Symposium on Computer Science Education (SIGCSE '19). Association for Computing Machinery, New York, NY, USA, 184–190. https://doi.org/10.1145/3287324.3287490]] </li>		<li style="display: inline-block;"> [[File:SQLiType.gif\|thumb\|none\|500px\|https://doi.org/10.1145/3287324.3287490]] </li>

	=== Tautology ===		=== Tautology ===

GFehringer: /* SQLI Attacks */

2024-01-08T21:17:47Z

SQLI Attacks

← Older revision		Revision as of 21:17, 8 January 2024
Line 36:		Line 36:
	SQL injection attacks can happen in a variety of ways and in different contexts.		SQL injection attacks can happen in a variety of ways and in different contexts.
	The strategies can be used independently or jointly, depending on the attacker's goal. Some of these SQLi attacks are listed below:		The strategies can be used independently or jointly, depending on the attacker's goal. Some of these SQLi attacks are listed below:

			<li style="display: inline-block;"> [[File:SQLiType.gif\|thumb\|none\|500px\| Nada Basit, Abdeltawab Hendawi, Joseph Chen, and Alexander Sun. 2019. A Learning Platform for SQL Injection. In Proceedings of the 50th ACM Technical Symposium on Computer Science Education (SIGCSE '19). Association for Computing Machinery, New York, NY, USA, 184–190. https://doi.org/10.1145/3287324.3287490]] </li>

	=== Tautology ===		=== Tautology ===

GFehringer: /* SQLI Attacks */

2024-01-08T21:04:57Z

SQLI Attacks

← Older revision		Revision as of 21:04, 8 January 2024
Line 96:		Line 96:

	SELECT * FROM Accounts WHERE user=’user1’ AND ASCII (SUBSTRING((SELECT TOP 1 name FROM sysobjects),1,1))>X WAITFOR DELAY ‘000:00:09’- -‘AND PASS=’‘ AND eid=		SELECT * FROM Accounts WHERE user=’user1’ AND ASCII (SUBSTRING((SELECT TOP 1 name FROM sysobjects),1,1))>X WAITFOR DELAY ‘000:00:09’- -‘AND PASS=’‘ AND eid=

			=== Out-of-band SQLi ===

			Unlike traditional SQL injections, which rely on the standard communication channels between the web application and the database, out-of-band attacks involve retrieving data through alternative channels. This technique is particularly effective when the web server is unable to communicate directly with the system controlled by the attacker. Out-of-band SQL injection typically uses DNS requests, HTTP requests, or other network protocols to transmit data to the attacker's machine. Such is the case with Microsoft SQL Server’s xp_dirtree command, which can be used to make DNS requests to a server an attacker controls; as well as Oracle Database’s UTL_HTTP package, which can be used to send HTTP requests from SQL and PL/SQL to a server an attacker controls.

	== Prevention Methods ==		== Prevention Methods ==

SBarakati: /* Error-based SQLi */

2022-01-17T19:09:46Z

Error-based SQLi

← Older revision		Revision as of 19:09, 17 January 2022
Line 70:		Line 70:
	==== Error-based SQLi ====		==== Error-based SQLi ====
	Error-based SQLi is an in-band SQL injection technique that uses error messages of the database server to gather information about the structure of the database. An attacker can sometimes enumerate an entire database using only error-based SQL injection.		Error-based SQLi is an in-band SQL injection technique that uses error messages of the database server to gather information about the structure of the database. An attacker can sometimes enumerate an entire database using only error-based SQL injection.
	While errors are useful during the development phase of a web application, they should be ~~deactivated~~ on ~~a live site~~ or logged to a secure file.		syntax, type conversion, or logical error [3].
			While errors are useful during the development phase of a web application, they should be hidden on production or logged to a secure file, therefore no vulnerable/injectable parameters can be revealed to an attacker.

	=== Inferential SQLi ===		=== Inferential SQLi ===

SBarakati: /* SQL injection */

2022-01-17T19:06:27Z

SQL injection

← Older revision		Revision as of 19:06, 17 January 2022
Line 7:		Line 7:
	This type of security threat is defined as a vulnerability in Database Driven Web Applications that allows an attacker to inject SQL commands into a vulnerable program. A successful SQL injection exploit can read sensitive data from the database, modify database data, perform database administration operations such as shutting down the Database management system (DBMS), recovering the content of a given file on the DBMS file system, and in some cases, issue commands to the operating system.		This type of security threat is defined as a vulnerability in Database Driven Web Applications that allows an attacker to inject SQL commands into a vulnerable program. A successful SQL injection exploit can read sensitive data from the database, modify database data, perform database administration operations such as shutting down the Database management system (DBMS), recovering the content of a given file on the DBMS file system, and in some cases, issue commands to the operating system.

	The core reason for this is usually due to improper or inadequate coding methods. Invalid input, Generous privileges, Uncontrolled variable size, Error messages, Variable orphism, Unsensitized user input, Client-side control, and Multiple statements are some of the sources of SQL injection.		The core reason for this is usually due to improper or inadequate coding methods.
			Invalid input, Generous privileges, Uncontrolled variable size, Error messages, Variable orphism, Unsensitized user input, Client-side control, and Multiple statements are some of the sources of SQL injection.

	== Impacts of SQLI ==		== Impacts of SQLI ==