Lecture5 SQL Injection

Question 1

Vulnerability disclosure model like full disclosure expect ….

Answer 1

expect all stakeholders agree to allow a period of time for the vulnerability to be patched

Question 2

SQL Injection – What is it?

Answer 2

Inputs to the application that interact with a
backend database directly can be vulnerable to
SQL injection

Question 3

SQLi – What can you do?
The attack targets the system and can lead to the
following;

Answer 3

1. Circumvent access controls
2. Modify data (insert/update/delete)
3. Read sensitive data
4. Read file on the DBMS file system e.g., /etc/passwd
5. Execute administration operations on the DB
6. Execute OS Commands

Question 4

Detection Techniques

Answer 4

1. Find out where the application interacts with the backend DB e.g. Authentication forms, Search Functions, E-Commerce Functions
2. Make a list of all input fields:
   - including the hidden fields
   - Consider HTTP headers and Cookies

Question 5

Fingerprinting the DB (two methods)

Answer 5

First method is to observe the error returned by the DB where each DB will throw a different error message
Second method can be used in the case of:
- No error message
- Custom error message

Question 6

3 SQL Injection Classes

Answer 6

1. Inband: data is extracted using the same channel that is used to inject the SQL code. This is the most straightforward kind of attack, in which the
   retrieved data is presented directly in the application web page.
2. Out-of-band: data is retrieved using a different channel (e.g., an email with the results of the query is generated and sent to the tester).
3. Blind: there is no actual transfer of data, but the tester is able to reconstruct the information by sending particular requests and observing the resulting behaviour of the DB Server.

Question 7

When trying to exploit an SQL Injection there are two

outcomes for the attacker:

Answer 7

1. The application returns an error message generated by an incorrect query (makes it easier for the attacker to reconstruct the logic)
2. The application hides the error details, then the tester must be able to reverse engineer the logic of the original query.

Question 8

3 SQLi Techniques

Answer 8

1. Union Technique: can be used when the SQL injection flaw happens in a SELECT statement, making it possible to combine two queries into a single result or result set.
2. Boolean Technique: use Boolean condition(s) to verify whether certain conditions are true or false. (useful in blind SQLi)
3. Time delay technique: use database commands (e.g. sleep) to delay answers in conditional queries. It is useful when attacker doesn’t have some kind of answer (result, output, or error) from the
   application. (appropriate for blind SQLi)

Question 9

Union technique can be used to find out …

Answer 9

1. Find the right number of columns in the SELECT statement

2. Find out column type

Question 10

Other SQLi Techniques

Answer 10

1. Error based technique: Force DB to run a command when it’s throwing an error. Exploitation is different from DB to DB
2. Out of band technique
   - Used in blind SQL injection situations
   - Force the DB to perform an “out-of-band” connection and deliver the results of the injection to a server an attacker owns
   - e.g. an email, a HTTP connection

Question 11

SQL Injection Mitigation

Answer 11

There are several options and each one should be
considered for each vulnerability. Applications differ
greatly and one technique may not be suitable for all

• Parameterised Queries
• Stored Procedures
• Escaping User Supplied Input

Question 12

Parameterised Queries

Answer 12

only allows for the correct data type to be inputted

Question 13

Other SQLi defences

Answer 13

• Whitelist input validation
• Escaping User Supplied Input
• Avoid detailed error messages
• Enforce least privilege