Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Bug Hunting > SQL Injection (Portswigger) > Flashcards

SQL Injection (Portswigger) Flashcards

1
Q

What does SQLi stand for?

A

SQL Injection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is SQLi?

A

SQL injection is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What does SQLi allow an attacker to do?

A

It allows an attacker to view data that they are not normally able to retrieve.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What kind of data could an attacker using SQLi view?

A

They could view data belonging to other users, or any other data that the application itself is able to access.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What could an attacker using SQLi do that’s common?

A

An attacker could modify or delete data, causing persistent changes to the applications behavior.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What could an attacker using SQLi do that’s not common

A

An attacker could escalate an SQL injection attack to compromise the underlying server or other back-end infrastructure, or perform a denial-of-service attack.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What is the impact of a successful SQL injection attack?

A

It can result in unauthorized access to sensitive data, such as passwords, credit card details, or personal user information.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What could an attacker potentially do with SQLi that is not very common?

A

An attacker could obtain a persistent backdoor into an organization’s systems, leading to a long-term compromise that can go unnoticed for an extended period.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

List 5 SQLi examples and give a brief explanation about each one.

A
  • Retrieving hidden data: can modify an SQL query to return additional results
  • Subverting application logic: can change a query to interfere with the application’s logic
  • UNION attacks: can retrieve data from different database tables
  • Examining the database: can extract information about the version and structure of the database
  • Blind SQLi: where the results of a query you could control are not returned in the application’s responses
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Explain the double-dash sequence for revealing hidden data.

A

It’s a comment indicator in SQL, and means that the rest of the query is interpreted as a comment. This effectively removes the remainder of the query which could show hidden data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is this an example of and what could it do?

SELECT * FROM users WHERE username = ‘administrator’–’ AND password = ‘’

A

Subverting application logic

It returns the user whose username is administrator and successfully logs the attacker in as that user

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What keyword would an attacker use to leverage an SQL injection vulnerability to retrieve data from other tables within a database?

A

UNION

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is this an example of and what does it do?

An application executes the following query containing the user input “Gifts”:

SELECT name, description FROM products WHERE category = ‘Gifts’

then an attacker can submit the input:

’ UNION SELECT username, password FROM users–

A

Retrieving data from other database tables
(SQL injection UNION attacks*)
This will cause the application to return all usernames and passwords along with the names and descriptions of products.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What are two ways of exploring a database?

A

Query the version details e.g.
Oracle:
SELECT * FROM v$version

Determine what database tables exist e.g.
Most databases you can use this to list the tables:
SELECT * FROM information_schema.tables

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

True or False?
Many instances of SQL injection are blind vulnerabilities.
If True, what does this mean?

A

It means the application does not return the results of the SQL query or the details of any database errors within its responses.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Give 3 examples of techniques that can be used to exploit blind injection vulnerabilities.

A
  • Change the logic of the query to trigger a detectable difference in the application’s response depending on the truth of a single condition. This might involve injecting a new condition into some Boolean logic, or conditionally triggering an error such as a divide-by-zero.
  • Conditionally trigger a time delay in the processing of the query, allowing you to infer the truth of the condition based on the time that the application takes to respond.
  • Trigger an out-of-band network interaction, using OAST techniques. This technique is extremely powerful and works in situations where the other techniques do not. Often, you can directly exfiltrate data via the out-of-band channel, for example by placing the data into a DNS lookup for a domain that you control.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

True or False?
The majority of SQL injection vulnerabilities can be found quickly and reliably using Burp Suite’s web vulnerability scanner.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

List 5 typical tests to manually detect every entry point in an application via SQL injection.

A
  • Submitting the single quote character ‘ and looking for errors or other anomalies.
  • Submitting some SQL-specific syntax that evaluates to the base (original) value of the entry point, and to a different value, and looking for systematic differences in the resulting application responses.
  • Submitting Boolean conditions such as OR 1=1 and OR 1=2, and looking for differences in the application’s responses
  • Submitting payloads designed to trigger time delays when executed within an SQL query, and looking for differences in the time taken to respond.
  • Submitting OAST payloads designed to trigger an out-of-band network interaction when executed within an SQL query, and monitoring for any resulting interactions.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What is this used to detect?

  • Submitting the single quote character ‘ and looking for errors or other anomalies.
A

SQL injection vulnerability

20
Q

What is this used to detect?

  • Submitting some SQL-specific syntax that evaluates to the base (original) value of the entry point, and to a different value, and looking for systematic differences in the resulting application responses.
A

SQL injection vulnerability

21
Q

What is this used to detect?

  • Submitting Boolean conditions such as OR 1=1 and OR 1=2, and looking for differences in the application’s responses
A

SQL injection vulnerability

22
Q

What is this used to detect?

  • Submitting payloads designed to trigger time delays when executed within an SQL query, and looking for differences in the time taken to respond.
A

SQL injection vulnerability

23
Q

What is this used to detect?

  • Submitting OAST payloads designed to trigger an out-of-band network interaction when executed within an SQL query, and monitoring for any resulting interactions.
A

SQL injection vulnerability

24
Q

Where do most SQL injection vulnerabilities arise within?

What are other most common locations?

A

Most common is in the WHERE clause of a SELECT query.

Other common locations:

  • In UPDATE statements, within the updated values or the WHERE clause.
  • In INSERT statements, within the inserted values.
  • In SELECT statements, within the table or column name.
  • In SELECT statements, within the ORDER BY clause.
25
Q

Describe first-order SQL injection

A

It arises where the application takes user input from an HTTP request and, in the course of processing that request, incorporates the input into an SQL query in an unsafe way.

26
Q

What is second-order SQL injection also known as?

A

Stored SQL injection

27
Q

Describe second-order SQL injection

A

The application takes user input from an HTTP request and stores it for future use. This is usually done by placing the input into a database, but no vulnerability arises at the point where the data is stored. Later, when handling a different HTTP request, the application retrieves the stored data and incorporates it into an SQL query in an unsafe way.

28
Q

How does Second-order SQL injection often arise?

A

In situations where developers are aware of SQL injection vulnerabilities, and so safely handle the initial placement of the input into the database. When the data is later processed, it is deemed to be safe, since it was previously placed into the database safely. At this point, the data is handled in an unsafe way, because the developer wrongly deems it to be trusted.

29
Q

List 5 techniques for detecting and exploiting SQL injection that work differently on different platforms.

A
  • Syntax for string concatenation
  • Comments
  • Batched (or stacked) queries
  • Platform-specific APIs
  • Error messages
30
Q

What is the following code vulnerable to? Why? And how can it be rewritten in a way that prevents this vulnerability?

String query = “SELECT * FROM products WHERE category = ‘”+ input + “’”;

Statement statement = connection.createStatement();

ResultSet resultSet = statement.executeQuery(query);

A

It’s vulnerable to SQL injection because the user input is concatenated directly to the query.

It can be rewritten to prevent user input from interfering with the query structure:

PreparedStatement statement = connection.prepareStatement(“SELECT * FROM products WHERE category = ?”);

statement.setString(1, input);

ResultSet resultSet = statement.executeQuery();

31
Q

When can parameterized queries be used?

A

For any situation where untrusted input appears as data within the query, including the WHERE clause and values in an INSERT or UPDATE statement. They can’t be used to handle untrusted input in other parts of the query, such as table or column names, or the ORDER BY clause.

Application functionality that places untrusted data into those parts of the query will need to take a different approach, such as white-listing permitted input values, or using different logic to deliver the required behavior.

32
Q

How does a parameterized query need to be effective in preventing SQL injection?

A

The string that is used in the query must always be a hard-coded constant, and must never contain any variable data from any origin. Do not be tempted to decide case-by-case whether an item of data is trusted, and continue using string concatenation within the query for cases that are considered safe. It is all too easy to make mistakes about the possible origin of data, or for changes in other code to violate assumptions about what data is tainted.

33
Q

When an application is vulnerable to SQL injection and the results of the query are returned within the application’s responses, what keyword can be used to retrieve data from other tables within the database? What kind of attack is this called?

A

UNION

UNION attack

34
Q

What is this an example of and what will it return?

SELECT a, b FROM table1 UNION SELECT c, d FROM table2

A

UNION query to get results from multiple tables.

It will return a single result set with two columns containing values from columns a and b in table1 and columns c and d in table2

35
Q

What two key requirements must be met for a UNION query to work?

A
  • The individual queries must return the same number of columns.
  • The data types in each column must be compatible between the individual queries.
36
Q

What two requirements must be figured out to carry out an SQL injection UNION attack?

A
  • How man columns are being returned from the original query?
  • Which columns returned from the original query are of a suitable data type to hold the results from the injected query?
37
Q

In determining the number of columns required in an SQL injection UNION attack, there are two methods to determine how many columns are being returned from the original query.

What are they?

A
  • One method involves injecting a series of ORDER BY clauses and incrementing the specified column index until an error occurs.
  • The other method involves submitting a series of SERIES SELECT payloads specifying a different number of null values.
38
Q

Describe the ORDER BY method

A

This method involves injecting a series of ORDER BY clauses and incrementing the specified column index until an error occurs. For example, assuming the injection point is a quoted string within the WHERE clause of the original query, you would submit:

’ ORDER BY 1–
‘ ORDER BY 2–
‘ ORDER BY 3–
etc.

This series of payloads modifies the original query to order the results by different columns in the result set. The column in an ORDER BY clause can be specified by its index, so you don’t need to know the names of any columns. When the specified column index exceeds the number of actual columns in the result set, the database returns an error, such as:

The ORDER BY position number 3 is out of range of the number of items in the select list.

The application might actually return the database error in its HTTP response, or it might return a generic error, or simply return no results. Provided you can detect some difference in the application’s response, you can infer how many columns are being returned from the query.

39
Q

Describe the UNION SELECT method

A

This method involves submitting a series of UNION SELECT payloads specifying a different number of null values:

’ UNION SELECT NULL–
‘ UNION SELECT NULL,NULL–
‘ UNION SELECT NULL,NULL,NULL–
etc.

If the number of nulls does not match the number of columns, the database returns an error, such as:

All queries combined using a UNION, INTERSECT or EXCEPT operator must have an equal number of expressions in their target lists.

Again, the application might actually return this error message, or might just return a generic error or no results. When the number of nulls matches the number of columns, the database returns an additional row in the result set, containing null values in each column. The effect of the resulting HTTP response depends on the application’s code. If you are lucky, you will see some additional content within the response, such as an extra row on an HTML table. Otherwise, the null values might trigger a different error, such as a NullPointerException. Worst case, the response might be indistinguishable from that which is caused by an incorrect number of nulls, making this method of determining the column count ineffective.

40
Q

In determining the number of columns required in an SQL injection UNION attack, what is the reason for using NULL as the values returned from the injected SELECT query?

A

The data types in each column must be compatible between the original and the injected queries. Since NULL is convertible to every commonly used data type, using NULL maximizes the chance that the payload will succeed when the column count is correct.

41
Q

What is the reason for performing an SQL injection UNION attack?

A

To be able to retrieve the results from an injected query.

42
Q

What can you do if you’ve already determined the number of required columns with an SQLi UNION attack?

A

You can probe each column to test whether it can hold string data by submitting each column to test whether it can hold string data by submitting a series of UNION SELECT payloads that place a string value into each column in turn.

43
Q

What is the reason for using ‘a’?

’ UNION SELECT ‘a’,NULL,NULL,NULL–
‘ UNION SELECT NULL,’a’,NULL,NULL–
‘ UNION SELECT NULL,NULL,’a’,NULL–
‘ UNION SELECT NULL,NULL,NULL,’a’–

A

To find if the column is compatible with string data. If no database error occurs then the relevant column is suitable for retrieving string data.

44
Q

Within an SQLi UNION attack

Suppose that:

The original query returns two columns, both of which can hold string data.
The injection point is a quoted string within the WHERE clause.
The database contains a table called users with the columns username and password.

Give an example of the input

A

’ UNION SELECT username, password FROM users–

45
Q

What is this an example of and on what platform would it take place? What is the result of this query?

’ UNION SELECT username || ‘~’ || password FROM users–

A

A double-pipe sequence || which is a string concatenation operator on Oracle.

Result:
administrator~s3cure
weiner~peter
carlos~montoya

46
Q

What information is necessary to exploit SQL injection vulnerabilities?

A

Type and version of the database software, and the contents of the database in terms of which tables and columns it contains.

47
Q

Querying the database type and version question

A

.

Bug Hunting (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions