Using SQL Query Language
Are you familiar with SQL Query attacks? Many attacks target server applications such as those hosted on web servers or database servers. If you’re planning to take the Security+ exam, you should have a basic understanding of these attacks, along with common application security controls and techniques.
For example, can you answer this question?
Q. Looking at logs for an online web application, you see that someone has entered the following phrase into several queries:
‘ or ‘1’=’1′ —
Which of the following is the MOST likely explanation for this?
A. A buffer overflow attack
B. An XSS attack
C. A SQL injection attack
D. An LDAP injection attack
More, do you know why the correct answer is correct and the incorrect answers are incorrect? The answer and explanation is available at the end of this post.
SQL Queries
As a simple example of a web site that uses SQL queries, think of Amazon.com. When you enter a search term and click Go (as shown in the following figure), the web application creates a SQL query, sends it to a database server, and formats the results into a web page that it sends back to you.
Web page querying a database with SQL
In the example, I selected the Books category and entered Darril Gibson. The result shows a list of books authored by Darril Gibson available for sale on Amazon. The query sent to the database from the Amazon web application may look like this:
SELECT * FROM Books WHERE Author = ‘Darril Gibson’
The * is a wildcard and returns all columns in a table. Notice that the query includes the search term entered into the web page form (Darril Gibson) and encloses the search term in single quotes. If the web site simply plugs the search term into the SELECT statement, surrounded by single quotes, it will work, but it’s also highly susceptible to SQL injection attacks.
CompTIA Security+ Study Guide
The 501 Version of the Study Guide
The CompTIA Security+: Get Certified Get Ahead: SY0-501 Study Guide
is an update to the top-selling SY0-201, SY0-301, and SY0-401 study guides, which have helped thousands of readers pass the exam the first time they took it. It includes the same elements readers raved about in the previous three versions.Each of the eleven chapters presents topics in an easy to understand manner and includes real-world examples of security principles in action.
You’ll understand the important and relevant security topics for the Security+ exam, without being overloaded with unnecessary details. Additionally, each chapter includes a comprehensive review section to help you focus on what’s important.
Over 300 realistic practice test questions with in-depth explanations will help you test your comprehension and readiness for the exam. The book includes:
- A 75 question pre-test
- A 75 question post-test
- Practice test questions at the end of every chapter.
Each practice test question includes a detailed explanation to help you understand the content and the reasoning behind the question. You’ll be ready to take and pass the exam the first time you take it.
If you plan to pursue any of the advanced security certifications, this guide will also help you lay a solid foundation of security knowledge. Learn this material, and you’ll be a step ahead for other exams. This SY0-501 study guide is for any IT or security professional interested in advancing in their field, and a must-read for anyone striving to master the basics of IT security.
Protecting Against SQL Injection Attacks
Input validation provides strong protection against SQL injection attacks. Before using the data entered into a web form, the web application verifies that the data is valid.
Additionally, database developers often use stored procedures with dynamic web pages. A stored procedure is a group of SQL statements that execute as a whole, similar to a mini-program. A parameterized stored procedure accepts data as an input called a parameter. Instead of copying the user’s input directly into a SELECT statement, the input is passed to the stored procedure as a parameter. The stored procedure performs data validation, but it also handles the parameter (the inputted data) differently and prevents a SQL injection attack.
Consider the previous example searching for a book by an author where an attacker entered the following text: Darril Gibson’; SELECT * From Customers;–. The web application passes this search string to a stored procedure. The stored procedure then uses the entire search string in a SELECT statement like this:
SELECT * From Books Where Author = “Darril Gibson’; SELECT * From Customers;– ”
In this case, the text entered by the user is interpreted as harmless text rather than malicious SQL statements. It will look for books with an author name using all of this text: Darril Gibson’; SELECT * From Customers;–. People don’t have names with SELECT statements embedded in them so the query comes back empty.
Depending on how well the database server is locked down (or not), SQL injection attacks may allow the attacker to access the structure of the database, all the data, and even modify data. In some cases, attackers have modified the price of products from several hundred dollars to just a few dollars, purchased several of them, and then returned the price to normal.
Full Security+ Course
SY0-501 Full Security+ Course
Helping you Pass the First Time
Online access includes all of the content from the
CompTIA Security+: Get Certified Get Ahead: SY0-501 Study Guide
- Introduction
- About the exam (including information on the number of questions, test duration, passing score, types of questions and more. Also includes a listing of the exam objectives)
- 75 question pre-assessment exam
- Mastering Security Basics (full content from Chapter 1 of the study guide including the exam topic review and 15 practice test questions)
- Understanding Identity and Access Management (full content from Chapter 2 of the study guide including the exam topic review and 15 practice test questions)
- Exploring Network Technologies and Tools (full content from Chapter 3 of the study guide including the exam topic review and 15 practice test questions)
- Securing Your Network (full content from Chapter 4 of the study guide including the exam topic review and 15 practice test questions)
- Securing Hosts and Data (full content from Chapter 5 of the study guide including the exam topic review and 15 practice test questions)
- Comparing Threats, Vulnerabilities, and Common Attacks (full content from Chapter 6 of the study guide including the exam topic review and 15 practice test questions)
- Protecting Against Advanced Attacks (full content from Chapter 7 of the study guide including the exam topic review and 15 practice test questions)
- Using Risk Management Tools (full content from Chapter 8 of the study guide including the exam topic review and 15 practice test questions)
- Implementing Controls to Protect Assets (full content from Chapter 9 of the study guide including the exam topic review and 15 practice test questions)
- Understanding Cryptography and PKI (full content from Chapter 10 of the study guide including the exam topic review and 15 practice test questions)
- Implementing Policies to Mitigate Risks (full content from Chapter 11 of the study guide including the exam topic review and 15 practice test questions)
- 75 question post-assessment exam
- Glossary
Get the SY0-501 Full Security+ Course Here
Test your readiness with these quality materials
Random 75-question tests
Random practice tests from the all of the practice test questions in the CompTIA Security+: Get Certified Get Ahead: SY0-501 Study Guide. All questions include explanations so you'll know why the correct answers are correct, and why the incorrect answers are incorrect.3 sets Performance-based Questions
Three new sets of performance-based questions with a total of 30 questions. These new questions use a new testing engine that includes realistic drag and drop, matching, sorting, and fill in the blank questions.
Flashcard Set
- 494 Online Security+ Glossary Flashcards
- 222 Online Security+ Acronyms Flashcards
- 223 Online Security+ Remember This Slide from the popular CompTIA Security+ Get Certified Get Ahead: SY0-501 Study Guide
Audio - SY0-501 Security+ Remember This Audio Files
Learn by Listening. Over one hour and 20 minutes of audio (MP3 downloads.)Audio - SY0-501 Security+ Question and Answer Audio Files
Learn by Listening. Over two hours hour and 53 minutes of audio (MP3 downloads.)Bonus #1
Audio from the end of chapter reviews from each of the chapters in the CompTIA Security+: Get Certified Get Ahead: SY0-501 Study Guide
. Over one hour and 40 minutes of additional audio.Bonus #2
Access to all of the online content that is available for free to anyone that purchases the CompTIA Security+ Get Certified Get Ahead: SY0-501 Study Guide
. This includes labs, extra practice test questions, and supplementary materialsBonus #3
Access the study materials for a total of 60 days because sometimes life happens.XML Injection
Many databases use Extensible Markup Language (XML) for inputting or exporting data. XML provides formatting rules to describe the data. For example, here’s an XML tag for a name: <name>Darril Gibson</name>. The data is “Darril Gibson” and the XML tags (<name> and </name>) describe the data as a name.
Additionally, databases use XPath as a query language for XML data. If an application accepts XML data without input validation and without stored procedures, it is susceptible to an XML injection attack similar to a SQL injection attack. The attacker can insert additional data in an XML injection attack. This additional data creates XPath statements to retrieve or modify data.
Q. Looking at logs for an online web application, you see that someone has entered the following phrase into several queries:
‘ or ‘1’=’1′ —
Which of the following is the MOST likely explanation for this?
A. A buffer overflow attack
B. An XSS attack
C. A SQL injection attack
D. An LDAP injection attack
Answer is C. Attackers use the phrase in SQL injection attacks to query or modify databases.
A buffer overflow attack sends more data or unexpected data to an application with the goal of accessing system memory.
A cross-site scripting (XSS) attack attempts to insert HTML or JavaScript code into a web site or email.
A Lightweight Directory Application Protocol (LDAP) injection attack attempts to inject LDAP commands to query a directory service database.
