SQL injection attacks are all too common, but they are easy to identify, and relatively easy to protect against.
Many web sites use SQL statements to interact with a database providing users with dynamic content. If you’re planning on taking the Security+ exam, you should have a good understanding of how attackers launch a SQL injection attack.
For example, can you answer this question?
Q. Attackers have attacked an online web server using a SQL injection attack. Which of the following BEST describes this?
A. The attacker is attempting to overload the system with unexpected data and access memory locations.
B. The attacker is attempting to impersonate a user using HTML code.
C. The attacker is sending random data into a program to see if the application will crash.
D. The attacker is attempting to pass commands to a back-end database server to access data.
More, do you know why the correct answer is correct and the incorrect answers are incorrect? The answer and explanation is available at the end of this post.
How SQL Injection Attack Works
In a SQL injection attack, the attacker enters additional data into the web page form to generate different SQL statements. SQL query languages use a semicolon (;) to indicate the end of the SQL line and use two dashes (–) as an ignored comment. With this knowledge, the attacker could enter different information into the web form like this:
Darril Gibson‘; SELECT * FROM Customers;–
If the web application plugged this string of data directly into the SELECT statement surrounded by the same single quotes, it would look like this:
SELECT * FROM Books WHERE Author = ‘Darril Gibson’;
SELECT * FROM Customers;
–’
The first line retrieves data from the database, just as before. However, the semicolon signals the end of the line and the database will accept another command. The next line reads all the data in the Customers table, which can give the attacker access to names, credit card data, and more. The last line comments out the second single quote to prevent a SQL error.
If the application doesn’t include error-handling routines, these errors provide details about the type of database the application is using, such as an Oracle, Microsoft SQL Server, or MySQL database. Different databases format SQL statements slightly differently, but once the attacker learns the database brand, it’s a simple matter to format the SQL statements required by that brand. The attacker then follows with SQL statements to access the database and may allow the attacker to read, modify, delete, and/or corrupt data.
This attack won’t work against Amazon (please don’t try it) because Amazon is using secure coding principles. I don’t have access to its code, but I’d bet their developers are using input validation and SQL-based stored procedures.
Many SQL injection attacks use a phrase of or ‘1‘ = ‘1‘ to create a true condition. For example, if an online database allows you to search a Customers table looking for a specific record, it might expect you to enter a name. If you entered Homer Simpson, it would create a query like this:
SELECT * FROM Customers WHERE name = ‘Homer Simpson’
This query will retrieve a single record for Homer Simpson. However, if the attacker enters ‘ or ‘1’=’1′ — instead of Homer Simpson, it will create a query like this:
SELECT * FROM Customers WHERE name = ‘ ‘ or ‘1’=’1′ –‘
Although this is a single SELECT statement, the or clause causes it to behave as two separate SELECT statements:
SELECT * FROM Customers WHERE name = ‘ ‘
SELECT * FROM Customers WHERE ‘1’=’1′
Note: The clause or ‘1’=’1′ –‘ is a dead giveaway informing you that this is a SQL injection attack. If you see this in a log entry, it should ring some alarm bells for you. If you see this in an exam question, you should think about SQL injection attacks.
The first clause will likely not return any records because the table is unlikely to have any records with the name field empty. However, because the number 1 always equals the number 1, the WHERE clause in the second statement always equates to True, so the SELECT statement retrieves all records from the Customers table.
In many cases, a SQL injection attack starts by sending improperly formatted SQL statements to the system to generate errors. Proper error handling prevents the attacker from gaining information from these errors, though. Instead of showing the errors to the user, many web sites simply present a generic error web page that doesn’t provide any details.
Remember this Attackers use SQL injection attacks to pass queries to back-end databases through web servers. Many SQL injection attacks use the phrase ‘ or ‘1’=’1′ – to trick the database server into providing information. Input validation and stored procedures reduce the risk of SQL injection attacks.
Q. Attackers have attacked an online web server using a SQL injection attack. Which of the following BEST describes this?
A. The attacker is attempting to overload the system with unexpected data and access memory locations.
B. The attacker is attempting to impersonate a user using HTML code.
C. The attacker is sending random data into a program to see if the application will crash.
D. The attacker is attempting to pass commands to a back-end database server to access data.
Answer is D. In a SQL injection attack, an attacker attempts to inject SQL commands into a query to access or manipulate data on a back-end database.
A buffer overflow attack attempts to overload a system with too much data or unexpected data in an attempt to access system memory.
A cross-site request forgery (XSRF) attack attempts to impersonate a user with HTML code.
Fuzzing is a testing technique that sends random data into an application to see if the application can handle it.