Are you familiar with SQL Query attacks? Many attacks target server applications such as those hosted on web servers or database servers. If you’re planning to take the Security+ exam, you should have a basic understanding of these attacks, along with common application security controls and techniques.
For example, can you answer this question?
Q. Looking at logs for an online web application, you see that someone has entered the following phrase into several queries:
‘ or ‘1’=’1′ —
Which of the following is the MOST likely explanation for this?
A. A buffer overflow attack
B. An XSS attack
C. A SQL injection attack
D. An LDAP injection attack
More, do you know why the correct answer is correct and the incorrect answers are incorrect? The answer and explanation is available at the end of this post.
SQL Queries
As a simple example of a web site that uses SQL queries, think of Amazon.com. When you enter a search term and click Go (as shown in the following figure), the web application creates a SQL query, sends it to a database server, and formats the results into a web page that it sends back to you.
Web page querying a database with SQL
In the example, I selected the Books category and entered Darril Gibson. The result shows a list of books authored by Darril Gibson available for sale on Amazon. The query sent to the database from the Amazon web application may look like this:
SELECT * FROM Books WHERE Author = ‘Darril Gibson’
The * is a wildcard and returns all columns in a table. Notice that the query includes the search term entered into the web page form (Darril Gibson) and encloses the search term in single quotes. If the web site simply plugs the search term into the SELECT statement, surrounded by single quotes, it will work, but it’s also highly susceptible to SQL injection attacks.
The 601 Version of the Study Guide
The CompTIA Security+: Get Certified Get Ahead: SY0-601 Study GuideEach of the eleven chapters presents topics in an easy to understand manner and includes real-world examples of security principles in action.
You’ll understand the important and relevant security topics for the Security+ exam, without being overloaded with unnecessary details. Additionally, each chapter includes a comprehensive review section to help you focus on what’s important.
Over 300 realistic practice test questions with in-depth explanations will help you test your comprehension and readiness for the exam. The book includes:
- A 75 question pre-test
- A 75 question post-test
- Practice test questions at the end of every chapter.
Each practice test question includes a detailed explanation to help you understand the content and the reasoning behind the question. You’ll be ready to take and pass the exam the first time you take it.
If you plan to pursue any of the advanced security certifications, this guide will also help you lay a solid foundation of security knowledge. Learn this material, and you’ll be a step ahead for other exams. This SY0-601 study guide is for any IT or security professional interested in advancing in their field, and a must-read for anyone striving to master the basics of IT security.
Protecting Against SQL Injection Attacks
Input validation provides strong protection against SQL injection attacks. Before using the data entered into a web form, the web application verifies that the data is valid.
Additionally, database developers often use stored procedures with dynamic web pages. A stored procedure is a group of SQL statements that execute as a whole, similar to a mini-program. A parameterized stored procedure accepts data as an input called a parameter. Instead of copying the user’s input directly into a SELECT statement, the input is passed to the stored procedure as a parameter. The stored procedure performs data validation, but it also handles the parameter (the inputted data) differently and prevents a SQL injection attack.
Consider the previous example searching for a book by an author where an attacker entered the following text: Darril Gibson’; SELECT * From Customers;–. The web application passes this search string to a stored procedure. The stored procedure then uses the entire search string in a SELECT statement like this:
SELECT * From Books Where Author = “Darril Gibson’; SELECT * From Customers;– ”
In this case, the text entered by the user is interpreted as harmless text rather than malicious SQL statements. It will look for books with an author name using all of this text: Darril Gibson’; SELECT * From Customers;–. People don’t have names with SELECT statements embedded in them so the query comes back empty.
Depending on how well the database server is locked down (or not), SQL injection attacks may allow the attacker to access the structure of the database, all the data, and even modify data. In some cases, attackers have modified the price of products from several hundred dollars to just a few dollars, purchased several of them, and then returned the price to normal.
XML Injection
Many databases use Extensible Markup Language (XML) for inputting or exporting data. XML provides formatting rules to describe the data. For example, here’s an XML tag for a name: <name>Darril Gibson</name>. The data is “Darril Gibson” and the XML tags (<name> and </name>) describe the data as a name.
Additionally, databases use XPath as a query language for XML data. If an application accepts XML data without input validation and without stored procedures, it is susceptible to an XML injection attack similar to a SQL injection attack. The attacker can insert additional data in an XML injection attack. This additional data creates XPath statements to retrieve or modify data.
Q. Looking at logs for an online web application, you see that someone has entered the following phrase into several queries:
‘ or ‘1’=’1′ —
Which of the following is the MOST likely explanation for this?
A. A buffer overflow attack
B. An XSS attack
C. A SQL injection attack
D. An LDAP injection attack
Answer is C. Attackers use the phrase in SQL injection attacks to query or modify databases.
A buffer overflow attack sends more data or unexpected data to an application with the goal of accessing system memory.
A cross-site scripting (XSS) attack attempts to insert HTML or JavaScript code into a web site or email.
A Lightweight Directory Application Protocol (LDAP) injection attack attempts to inject LDAP commands to query a directory service database.
