Week 7 - SQL Injection Flashcards
What is SQL Injection?
use of malicious user input used to generate and deploy SQL queries, allowing attackers to gain access or modify data
Where are SQL injection attacks used?
typically SQL databases or any application that uses a SQL backend
When would you use an SQL Injection Attack?
when user inputs are not validated and have direct access to SQL queries
Also having knowledge of the application and the structure of the database, helps with SQL injection attacks
How would you use an SQL injection attack on username?
e.g
username = “$username” AND password = “$password”
username = ‘Fred’ OR ‘1’=’1’
This will always result in a true value because OR 1 = 1 will always be true. Fred can be any value
Then attacker could use common passwords (password spraying) to gain access
What is Password Spraying?
A method where an attacker uses a list of common passwords to gain access to an account
How would you use an SQL injection attack on password?
e.g
username = “$username” AND password = “$password”
password = ‘value’ OR ‘1’=’1’
used to access a specific account. we know a user’s username then,
This will always result in a true value because OR 1 = 1 will always be true.
username = ‘$username’ AND password = ‘$password’”);
How can we exploit this?
if (mysql_num_rows($result)>0) { echo “Success”;
password = ‘ OR 1 = 1–’
two dashes comments out the rest of query, so it will look like this:
“SELECT * FROM accounts WHERE username = ‘OR 1 = 1–’;”
thus bypassing other checks, without the need to know the username and password.
What is a UNION SQL injection?
allows the attacker to combine multiple SQL statements together, so that they can access other information from the database.
How do you use UNION?
e.g
date= ‘$date’
date = ‘31/8/2015’ UNION SELECT ‘1/1/31’, username, password
FROM users;’
this returns one results set.
ALSO needs to be same number of columns and the same data types for each of the columns
What is a prepared Statement?
a method where the SQL query is defined first and the values/parameters are passed in later. preventing direct execution of user input.
How would you use a prepared statement?
String uname = “Fred Bloggs”;
String query = “SELECT fname, sname, address
FROM users WHERE user_name = ? “;
– question mark indicates where the parameter is going to be inserted.
PreparedStatement ps =
connection.prepareStatement( query );
– we create prepared statement object, which creates a prepared statement
ps.setString( 1, uname);
– we pass the username into the first question mark
ResultSet results = ps.executeQuery( );
– then we execute the query
What is a Stored Procedure?
predefined SQL queries stored in the database. They are called from the application.
How do you implement a stored procedure?
String custname = “egan”;
{ CallableStatement cs =
connection.prepareCall(“{call
getAccountBalance(?)}”);
– this calls the predefined SQL query from the database.
cs.setString(1, custname);
– we pass the customer name into the first question mark
ResultSet results = cs.executeQuery();
– then we execute the query
Difference between prepared statements and stored Procedures?
- prepared statements are defined in the application code
- Stored procedures are precompiled in the database and executed by the application
Why are prepared statements and stored procedures used to prevent SQL injection?
both separate user input from the SQL query.
user input is treated only as data, preventing it from being treated as SQL code
