UNDERCODE COMMUNITY

🦑 SQL INJECTION FOR BEGINERS FULL TUTORIAL

1) SQL injection is one of the more common network attack methods. Instead of using the BUG of the operating system to implement the attack, he aims at the negligence of the programmer when programming, through SQL statements, to achieve accountless login, or even tamper with the database.

2) When an application uses input to construct a dynamic SQL statement to access the database, a SQL injection attack occurs . If the code uses stored procedures, and these stored procedures are passed as strings containing unfiltered user input, SQL injection can also occur .

3) SQL injection may cause an attacker to use an application to log in and execute commands in the database. If the application uses an overprivileged account to connect to the database, this problem can become very serious. In some forms, the content entered by the user is directly used to construct dynamic SQL commands or used as input parameters of stored procedures. These forms are particularly vulnerable to SQL injection attacks. While many website programs are written, they do not judge the validity of user input or improper handling of variables in the program itself, which poses potential security risks to the application.

4) In this way, the user can submit a piece of database query code, obtain some sensitive information or control the entire server based on the results returned by the program, and SQL injection occurs.

🦑 The general idea of SQL injection attacks,

1) Find the location of SQL injection

2)Determine the server type and background database type

3) Perform SQL injection attacks against unsuitable server and database features

🦑 A simple example,

SQL> create table account(id number primary key, name varchar2(10), password varchar2(20));
Table created.

SQL> insert into account values(1, 'bisal', '111111');
1 row created.

SQL> commit;
Commit complete.

SQL> select * from account;
ID NAME PASSWORD
---------- ---------- --------------------
1 bisal 111111

SQL> select * from account where name='' or 1=1 -- and password='';
ID NAME PASSWORD
---------- ---------- --------------------
1 bisal 111111

After the condition, "username = 'xx' or 1 = 1", the user name is equal to "empty or1 = 1", because 1 = 1 is always ture, then this condition will succeed, in addition, add two "-" after this, this It means comments, it will comment the following statements, so that they will not work, so that the statements can always be executed correctly, and users can easily cheat the system and obtain a legal identity.

The reason for the SQL injection vulnerability is to splice SQL parameters. That is, the query parameters used for input are directly spliced into the SQL statement, resulting in a SQL injection vulnerability. E.g,

select id, password from user where id = 2;

If the statement is obtained by stitching SQL strings, for example,

String sql = "select password from user where id =" + id;

Where id is a parameter entered by the user, then, if the user enters "2 or 1 = 1" to perform the SQL injection attack, the above statement (select id, password from user where id = 2 or 1 = 1;), All the records in the user table are found out, which is a typical SQL injection.

Imagine that if the user inputs some dangerous operations, such as drop table, the attack through SQL injection is not just a data leak, it may be a damage to the database.

🦑 As for the solution, someone summed it up,

1) Never trust user input. To verify the user's input, you can use regular expressions, or limit the length, convert single quotes and double "-", etc.

2) Never use dynamic assembly SQL, you can use parameterized SQL (bound variables) or directly use stored procedures for data query access.

3) Never use a database connection with administrator rights, use a separate database connection with limited rights for each application.

4) Do not store confidential information directly, encrypt or hash passwords and sensitive information.

242 views16:36