d

SQL Injection: The Complete Documentation

• This category contains 19 Papers
• The last paper was added on 2007-03-26 (YYYY-MM-DD)

(more) Advanced SQL Injection

Published on 2002-06-18, by Chris Anley, ©Next Generation Security Software Ltd..

This paper addresses the subject of SQL Injection in a Microsoft SQL Server/IIS/Active Server Pages environment, but most of the techniques discussed have equivalents in other database environments. It should be viewed as a "follow up", or perhaps an appendix, to the previous paper, "Advanced SQL Injection". The paper covers in more detail some of the points described in its predecessor, providing examples to clarify areas where the previous paper was perhaps unclear. An effective method for privilege escalation is described that makes use of the openrowset function to scan a network. A novel method for extracting information in the absence of "helpful" error messages is described; the use of time delays as a transmission channel. Finally, a number of miscellaneous observations and useful hints are provided, collated from responses to the original paper, and various conversations around the subject of SQL injection in a SQL Server environment. This paper assumes

Advanced SQL Injection

Published on 2002-06-18, by Chris Anley, ©NGSSoftware and HNS.

This paper addresses the subject of SQL Injection in a Microsoft SQL Server/IIS/Active Server Pages environment, but most of the techniques discussed have equivalents in other database environments.

Advanced SQL Injection in Oracle databases

Published on 2005, by Esteban Martínez Fayó, ©Esteban Martínez Fayó.

This presentation is about new ways to exploit SQL Injection vulnerabilities in Oracle Databases. It shows, with working examples, many ways in that the Oracle database security could be bypassed and how to protect from these threats. It is based on the presentation that Esteban Martínez Fayó gave at G-con III conference (Mexico City), with new material and larger explanations.

Advanced SQL Injection In SQL Server Applications

Published on 2002, by Chris Anley, ©Next Generation Security Software Ltd..

This document discusses in detail the common "SQL injection" technique, as it applies to the popular Microsoft Internet Information Server/Active Server Pages/SQL Server platform. It discusses the various ways in which SQL can be "injected" into the application and addresses some of the data validation and database lockdown issues that are related to this class of attack. The paper is intended to be read by both developers of web applications which communicate with databases and by security professionals whose role includes auditing these web applications.

Blind SQL Injection

Published on 2004, by Ofer Maor and Amichai Shulman, ©Imperva Inc..

In the past few years, SQL injection attacks have been on the rise. The increase in the number of database based applications, together with various publications that explain the problem and how it can be exploited (in both electronic and printed formats), have led to many attacks and abuse of this type of attack.

Blind SQL Injection: Are your Web Applications Vulnerable?

Published on 2003, by Kevin Spett, ©SPI Dynamics, Inc..

The World Wide Web has experienced remarkable growth in recent years. Businesses, individuals, and governments have found that web applications can offer effective, efficient and reliable solutions to the challenges of communicating and conducting commerce in the Twenty-first century. However, in the cost-cutting rush to bring their web-based applications on line — or perhaps just through simple ignorance — many software companies overlook or introduce critical security issues.

To build secure applications, developers must acknowledge that security is a fundamental component of any software product and that safeguards must be infused with the software as it is being written. Building security into a product is much easier (and vastly more cost-effective) than any post-release attempt to remove or limit the flaws that invite intruders to attack your site. To prove that dictum, consider the case of blind SQL injection.

Detection of SQL Injection and Cross-site Scripting Attacks

Published on 2004-03-17, by K. K. Mookhey and Nilesh Burghate, ©SecurityFocus.

In the last couple of years, attacks against the Web application layer have required increased attention from security professionals. This is because no matter how strong your firewall rulesets are or how diligent your patching mechanism may be, if your Web application developers haven’t followed secure coding practices, attackers will walk right into your systems through port 80. The two main attack techniques that have been used widely are SQL Injection (ref 1) and Cross Site Scripting (ref 2) attacks. SQL Injection refers to the technique of inserting SQL meta-characters and commands into Web-based input fields in order to manipulate the execution of the back-end SQL queries. These are attacks directed primarily against another organization’s Web server. Cross Site Scripting attacks work by embedding script tags in URLs and enticing unsuspecting users to click on them, ensuring that the malicious Javascript gets executed on the victim’s machine. These attacks leverage the trust between the user and the server and the fact that there is no input/output validation on the server to reject Javascript characters.

Essence of Command Injection Attacks in Web Applications (The)

Published on 2006, by Zhendong Su, Gary Wassermann, ©Zhendong Su, Gary Wassermann.

Web applications typically interact with a back-end database to retrieve persistent data and then present the data to the user as dynamically generated output, such as HTML web pages. However, this interaction is commonly done through a low-level API by dynamically constructing query strings within a general-purpose programming language, such as Java. This low-level interaction is ad hoc because it does not take into account the structure of the output language. Accordingly, user inputs are treated as isolated lexical entities which, if not properly sanitized, can cause the web application to generate unintended output. This is called a command injection attack, which poses a serious threat to web application security. This paper presents the first formal definition of command injection attacks in the context of web applications, and gives a sound and complete algorithm for preventing them based on context-free grammars and compiler parsing techniques. Our key observation is that, for an attack to succeed, the input that gets propagated into the database query or the output document must change the intended syntactic structure of the query or document. Our definition and algorithm are general and apply to many forms of command injection attacks. We validate our approach with SQLCHECK, an implementation for the setting of SQL command injection attacks.

We evaluated SQLCHECK on real-world web applications with systematically compiled real-world attack data as input. SQLCHECK produced no false positives or false negatives, incurred low runtime overhead, and applied straightforwardly to web applications written in different languages.

Introduction to SQL Injection Attacks for Oracle Developers

Published on , by Stephen Kost, ©Integrigy Corporation..

Most application developers underestimate the risk of SQL injections attacks against web applications that use Oracle as the back-end database. Our audits of custom web applications show many application developers do not fully understand the risk of SQL injection attacks and simple techniques used to prevent such attacks. This paper is intended for application developers, database administrators, and application auditors to highlight the risk of SQL injection attacks and demonstrate why web applications may be vulnerable. It is not intended to be a tutorial on executing SQL attacks and does not provide instructions on executing these attacks.

Manipulating Microsoft SQL Server Using SQL Injection

Published on 2002, by Cesar Cerrudo, Application Security, Inc..

This paper will not cover basic SQL syntax or SQL Injection. It is assumed that the reader has a strong understanding of these topics already. This paper will focus on advanced techniques that can be used in an attack on a (web) application utilizing Microsoft SQL Server as a backend. These techniques demonstrate how an attacker could use a SQL Injection vulnerability to retrieve the database content from behind a firewall and penetrate the internal network. This paper is meant to educate security professionals of the potential devastating effects SQL Injection could have on an organization.

Second-order Code Injection Attacks

Published on 2006, by Gunter Ollmann, ©Next Generation Security Software Ltd.

Many forms of code injection targeted at web-based applications (for instance cross-site scripting and SQL injection) rely upon the instantaneous execution of the embedded code to carry out the attack (e.g. stealing a users current session information or executing a modified SQL query). In some cases it may be possible for an attacker to inject their malicious code into a data storage area that may be executed at a later date or time. Depending upon the nature of the application and the way the malicious data is stored or rendered, the attacker may be able to conduct a second-order code injection attack.

A second-order code injection attack can be classified as the process in which malicious code is injected into a web-based application and not immediately executed, but instead is stored by the application (e.g. temporarily cached, logged, stored in a database) and then later retrieved, rendered and executed by the victim.

SQL Injection

Published on 2004, by Imperva Inc., ©Imperva Inc..

SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database. Attackers take advantage of the fact that programmers often chain together SQL commands with user-provided parameters, and can therefore embed SQL commands inside these parameters. The result is that the attacker can execute arbitrary SQL queries and/or commands on the backend database server through the Web application.

SQL Injection

Published on 2007, by Web Application Security Consortium, ©Web Application Security Consortium.

SQL Injection is an attack technique used to exploit web sites that construct SQL statements from user-supplied input.

Structured Query Language (SQL) is a specialized programming language for sending queries to databases. Most small and industrial- strength database applications can be accessed using SQL statements. SQL is both an ANSI and an ISO standard. However, many database products supporting SQL do so with proprietary extensions to the standard language. Web applications may use user-supplied input to create custom SQL statements for dynamic web page requests.

SQL Injection - Are Your Web Applications Vulnerable?

Published on 2002, by SPI Dynamics, Inc., ©SPI Dynamics, Inc..

SQL injection is a technique for exploiting web applications that use client-supplied data in SQL queries without stripping potentially harmful characters first. Despite being remarkably simple to protect against, there is an astonishing number of production systems connected to the Internet that are vulnerable to this type of attack. The objective of this paper is to educate the professional security community on the techniques that can be used to take advantage of a web application that is vulnerable to SQL injection, and to make clear the correct mechanisms that should be put in place to protect against SQL injection and input validation problems in general.

SQL Injection Attacks by Example

Published on 2005, by Stephen J. Friedl, ©Stephen J. Friedl.

A customer asked that we check out his intranet site, which was used by the company’s employees and customers. This was part of a larger security review, and though we’d not actually used SQL injection to penetrate a network before, we were pretty familiar with the general concepts. We were completely successful in this engagement, and wanted to recount the steps taken as an illustration.

SQL Injection Protection by Variable Normalization of SQL Statement

Published on 2005-06-17, by Sam M.S. NG, ©Sam M.S. NG.

We present here a method to protect from SQL injection attack. The method involve using a virtual database connectivity drive as well as a special method named variable normalization to extract the basic structure of a SQL statement so that we could use that information to determine if a SQL statement is allowed to be executed. The method can be used in most scenarios and does not require changing the source code of database applications (i.e. the CGI web application). The presented method can also be used for auto-learning the allowable list of SQL statements, which makes the system very easy to setup. And since the decision of whether a SQL statement is allowed is to check if the normalized statement exists in our ready-sorted allowable list, the overhead of the system is very minimal.

SQL Injection Signatures Evasion

Published on 2004, by Ofer Maor and Amichai Shulman, ©Imperva Inc..

In recent years, Web application security has become a focal center for security experts. Application attacks are constantly on the rise, posing new risks for the organization. One of the most dangerous and most common attack techniques is SQL Injection, which usually allows the hacker to obtain full access to the organization’s Database.

SQL Injection Walkthrough

Published on 2002-05-26, by SK, ©Beyond Security.

The following article will try to help beginners with grasping the problems facing them while trying to utilize SQL Injection techniques, to successfully utilize them, and to protect themselves from such attacks.

Understanding SQL Injection

Published on 2006, by Hardik Shah, ©Infys Systems.

SQL injection is a technique used by a malicious user to gain illegal access on the remote machines through the web applications vulnerability. The basic idea behind this technique is to run the sql query which was not intended to run by a programmer. This technique is heavily relay on the logical operations like AND, OR, UNION etc. if this technique is used properly a malicious user can get complete access on a web server. If the application is creating SQL strings naively on the fly (dynamic queries) and then running them, it can create some real surprises as we see later on.