Security Testing - Injection

Advertisements

Previous Page
Next Page  

Injection technique consists of injecting a SQL query or a command using the input fields of the application.

Web Application - Injection

A successful SQL injection can read, modify sensitive data from the database, and can also delete data from a database. It also enables the hacker to perform administrative operations on the database such as shutdown the DBMS/dropping databases.

Let us understand Threat Agents, Attack Vectors, Security Weakness, Technical Impact and Business Impacts of this flaw with the help of simple diagram.

SQL Injection

Examples

The application uses untrusted data in the construction of the following vulnerable SQL call −

String query = "SELECT * FROM EMP WHERE EMPID = '" + request.getParameter("id") + "'";

Hands On

Step 1 − Navigate to the SQL Injection area of the application as shown below.

SQL Injection

Step 2 − As given in the exercise, we use String SQL Injection to bypass authentication. Use SQL injection to log in as the boss ('Neville') without using the correct password. Verify that Neville's profile can be viewed and that all functions are available (including Search, Create, and Delete).

Step 3 − We will Inject a SQL such that we are able to bypass the password by sending the parameter as 'a' = 'a' or 1 = 1

SQL Injection

Step 4 − Post Exploitation, we are able to login as Neville who is the Admin as shown below.

SQL Injection

Preventing SQL Injection

There are plenty of ways to prevent SQL injection. When developers write the code, they should ensure that they handle special characters accordingly. There are cheat sheets/prevention techniques available from OWASP which is definitely a guide for developers.

  • Using Parameterized Queries
  • Escaping all User Supplied Input
  • Enable Least Privilege for the database for the end users
Advertisements