If you’re planning to take the SY0-501 version of the Security+ exam, you should understand many of the common attacks included web application attacks on servers.
For example, can you answer this question?
Q. Looking at logs for an online web application, you see that someone has entered the following phrase into several queries:
‘ or ‘1’=’1’ —
Which of the following is the MOST likely explanation for this?
A. A buffer overflow attack
B. An XSS attack
C. A SQL injection attack
D. A DLL injection attack
More, do you know why the correct answer is correct and the incorrect answers are incorrect? The answer and explanation are available at the end of this post.
Web servers most commonly host web sites accessible on the Internet, but they can also serve pages within an internal network. Organizations place web servers within a demilitarized zone (DMZ) to provide a layer of protection.
Establishing a web presence is almost a requirement for organizations today, and users expect fancy web sites with dynamic pages that are easy to use. Although many applications make it easy to create web sites, they don’t always include security. This often results in many web sites being highly susceptible to attacks. This post discusses SQL injection attacks as common attacks related to different types of servers.
SQL Queries
One of the vulnerabilities related to databases is SQL injection attacks.
As a simple example of a web site that uses SQL queries, think of Amazon.com. When you enter a search term and click Go (as shown in the figure), the web application creates a SQL query, sends it to a database server, and formats the results into a web page that it sends back to you.
Web page querying a database with SQL
In the example, I selected the Books category and entered Darril Gibson. The result shows a list of books authored by Darril Gibson available for sale on Amazon. The query sent to the database from the Amazon web application might look like this:
SELECT * FROM Books WHERE Author =‘Darril Gibson’
The * is a wildcard and returns all columns in a table. Notice that the query includes the search term entered into the web page form (Darril Gibson) and encloses the search term in single quotes. If the web site simply plugs the search term into the SELECT statement, surrounded by single quotes, it will work, but it’s also highly susceptible to SQL injection attacks.
The 601 Version of the Study Guide
The CompTIA Security+: Get Certified Get Ahead: SY0-601 Study GuideEach of the eleven chapters presents topics in an easy to understand manner and includes real-world examples of security principles in action.
You’ll understand the important and relevant security topics for the Security+ exam, without being overloaded with unnecessary details. Additionally, each chapter includes a comprehensive review section to help you focus on what’s important.
Over 300 realistic practice test questions with in-depth explanations will help you test your comprehension and readiness for the exam. The book includes:
- A 75 question pre-test
- A 75 question post-test
- Practice test questions at the end of every chapter.
Each practice test question includes a detailed explanation to help you understand the content and the reasoning behind the question. You’ll be ready to take and pass the exam the first time you take it.
If you plan to pursue any of the advanced security certifications, this guide will also help you lay a solid foundation of security knowledge. Learn this material, and you’ll be a step ahead for other exams. This SY0-601 study guide is for any IT or security professional interested in advancing in their field, and a must-read for anyone striving to master the basics of IT security.
SQL Injection Attacks
In a SQL injection attack, the attacker enters additional data into the web page form to generate different SQL statements. SQL query languages use a semicolon (;) to indicate the end of the SQL line and use two dashes (–) as an ignored comment. With this knowledge, the attacker could enter different information into the web form like this:
Darril Gibson’; SELECT * FROM Customers;–
If the web application plugged this string of data directly into the SELECT statement surrounded by the same single quotes, it would look like this:
SELECT * FROM Books WHERE Author =‘Darril Gibson’;
SELECT * FROM Customers;
–’
The first line retrieves data from the database, just as before. However, the semicolon signals the end of the line and the database will accept another command. The next line reads all the data in the Customers table, which can give the attacker access to names, credit card data, and more. The last line comments out the second single quote to prevent a SQL error.
If the application doesn’t include error-handling routines, these errors provide details about the type of database the application is using, such as an Oracle, Microsoft SQL Server, or MySQL database. Different databases format SQL statements slightly differently, but once the attacker learns the database brand, it’s a simple matter to format the SQL statements required by that brand. The attacker then follows with SQL statements to access the database and may allow the attacker to read, modify, delete, and/or corrupt data.
This attack won’t work against Amazon (please don’t try it) because Amazon is using secure coding principles. I don’t have access to its code, but I’d bet the developers are using input validation and SQL-based stored procedures.
Many SQL injection attacks use a phrase of or ‘1’ = ‘1’to create a true condition. For example, if an online database allows you to search a Customers table looking for a specific record, it might expect you to enter a name. If you entered Homer Simpson, it would create a query like this:
SELECT * FROM Customers WHERE name =‘Homer Simpson’
This query will retrieve a single record for Homer Simpson. However, if the attacker enters ‘ or‘1’=’1’– instead of Homer Simpson, it will create a query like this:
SELECT * FROM Customers WHERE name =‘ ‘ or ‘1’=’1’ –’
Although this is a single SELECT statement, the or clause causes it to behave as two separate SELECT statements:
SELECT * FROM Customers WHERE name =‘ ‘ SELECT * FROM Customers WHERE ‘1’=’1’
The first clause will likely not return any records because the table is unlikely to have any records with the name field empty. However, because the number 1 always equals the number 1, the WHERE clause in the second statement always equates to True, so the SELECT statement retrieves all records from the Customers table.
In many cases, a SQL injection attack starts by sending improperly formatted SQL statements to the system to generate errors. Proper error handling prevents the attacker from gaining information from these errors, though. Instead of showing the errors to the user, many web sites simply present a generic error web page that doesn’t provide any details.
Input validation and stored procedures reduce the risk of SQL injection attacks.
Q. Looking at logs for an online web application, you see that someone has entered the following phrase into several queries:
‘ or ‘1’=’1’ —
Which of the following is the MOST likely explanation for this?
A. A buffer overflow attack
B. An XSS attack
C. A SQL injection attack
D. A DLL injection attack
Answer is C. Attackers use the phrase (‘ or‘1’=’1’–) in SQL injection attacks to query or modify databases.
A buffer overflow attack sends more data or unexpected data to an application with the goal of accessing system memory.
A cross-site scripting (XSS) attack attempts to insert HTML or JavaScript code into a web site or email.
A Dynamic Link Library (DLL) injection attack attempts to inject DLLs into memory, causing DLL commands to run.
See Chapter 7 of the CompTIA Security+: Get Certified Get Ahead: SY0-501 Study Guide for more information on application attacks.
