SQL Injections Flashcards
What is SQL Injection?
The purpose of the injection attack is to gain access to a web applications database server so that you can execute malicious queries on it.
What is a database?
A database is a way of electronically storing collections of data in an organized manner. Databases are normally managed by DBMS or Data Base Management Systems.
What are the two categories of DBMS?
Database Management Systems normally fall into two potential categories: Rational and Non-Rational.
What is the structure of a DBMS?
A DBMS will actually be made up of smaller database that are focused on specific parts of a site, you should think Subnetting for this. These smaller databases will actually take information and refine it even more into specific tables.
What is a DataBase Table?
Tables in a database are broken into columns and rows. Columns hold data of the tables while adding or taking away data will add a new row
What is the primary difference between a Rational DBMS and a Non-Rational DBMS?
The use of Tables. A Rational DBMS will use Tables while a Non-Rational DBMS doesn’t use any tables.
What is SQL?
SQL stands for Structured Query Language, it’s a feature rich language used for query databases. A SQL queries is referred to as a Statement.
What’s the SELECT query type used for?
The SELECT query type is used for retrieving data from the database.
What’re some SELECT statements in practice and what do they do?
- select * from users; This will return all columns from a table.
- select * from users LIMIT 1; This will force the query to skip and return the first result, you can also use LIMIT 2, 1; to skip the first two results and return the third.
- select * from users where username = ‘admin’; This will only return rows where the username is equal to admin.
- select * from users where username != ‘admin’; This will only return rows where the username isn’t equal to admin.
- select * from users where username like ‘a%’; This returns rows from users where the username starts with a.
- select * from users where username like ‘%n’; This returns rows from users where the username ends with n.
- select. * from users where username like ‘%mi%’; This returns rows from users where the username contains the characters with ‘mi’ within them.
What is the UNION query string and what does it do?
The UNION query string is used is used to combine SELECT statements and return data from multiple tables.
What are the rules when using UNION statements?
Theres a couple of primary rules that yo have to follow when using UNION statements:
- UNION statement must have the same number of columns for each select statement
- The columns have to be a similar data type
- The columns have to be in the same order
Can you make a UNION Statement?
UNION SELECT company, address, city, zip code from suppliers; This is going to return data from multiple tables using UNION to combine select statements.
How do SQL Injections happens?
An SQL injection happens when user-provided data gets included in the SQL query.
What does this look like in practice?
Let’s have an example here: A blog site normally will hold data such as blog post in a database meaning that its kept into a table.
Say we have a URL that looks like this: https://website.thm/blog?id=1, we can see that the blog post is controlled by the id parameter that can take a user input, can also take a SQL injection.
What is In-Band SQLi?
In-Band SQLi is the easiest type to detect and exploit; In-Band refers to discovering an SQL vulnerability on a website page and then being able to extract data from the database to the same page.
