Differences

This shows you the differences between two versions of the page.

--- sql_injection:example_attacks [2016/10/13 12:20] – peter
+++ sql_injection:example_attacks [2020/04/16 20:52] (current) – removed peter
@@ Line 1: / Line 1: @@
-====== SQL Injection - Example attacks ======
-[[SQL Injection - Example attacks:Basic SQL Injection attack|Basic SQL Injection attack]]
-[[SQL Injection - Example attacks:Basic SQL Injection attack with defence|Basic SQL Injection attack with defence]]
-[[SQL Injection - Example attacks:SQL Injection attack against PHP addslashes|SQL Injection attack against PHP addslashes]]
-===== Example attacks =====
-**Scenario #1**: The application uses untrusted data in the construction of the following vulnerable SQL call:
-<code java>
-String query = "SELECT * FROM accounts WHERE custID='" + request.getParameter("id") + "'";
-</code>
-**Scenario #2**: Similarly, an application’s blind trust in frameworks may result in queries that are still vulnerable, (e.g., Hibernate Query Language (HQL)):
-<code sql>
-Query HQLQuery = session.createQuery(“FROM accounts WHERE custID='“ + request.getParameter("id") + "'");
-</code>
-In both cases, the attacker modifies the ‘id’ parameter value in her browser to send: ' or '1'='1.
-For example:  http://example.com/app/accountView?id=' or '1'='1
-This changes the meaning of both queries to return all the records from the accounts table.   More dangerous attacks could modify data or even invoke stored procedures.
-**Scenario #3**:  Code to do an insert into the database could also be vulnerable.
-<code sql>
-$sql = "INSERT INTO Students (Name) VALUES ('" . $studentName . "');";
-execute_sql($sql);
-</code>
-The first line creates a string containing an SQL INSERT statement. The content of the **$studentName** variable is glued into the SQL statement. The second line sends the resulting SQL statement to the database. The pitfall of this code is that outside data, in this case the content of $studentName, becomes part of the SQL statement.
-First let's see what the SQL statement looks like if we insert a student named John:
-<code sql>
-INSERT INTO Students (Name) VALUES ('John');
-</code>
-This does exactly what we want: it inserts John into the Students table.
-Now we insert some injection code by setting $studentName to **<nowiki>Robert'); DROP TABLE Students;--</nowiki>**. The SQL statement becomes:
-<code sql>
-INSERT INTO Students (Name) VALUES ('Robert'); DROP TABLE Students;--');
-</code>
-This inserts Robert into the Students table. However, the INSERT statement is now followed by a **DROP TABLE** statement which removes the entire Students table. Ouch!
-===== Other attacks =====
-Passing the following in as input.
-<code php>
- -1 union all select table_name from information_schema.tables
-</code>
-and now just extract table structure:
-<code sql>
-SELECT ... WHERE id = -1 union all select column_name from information_schema.column where table_name = 0x61727469636c65
-</code>
-===== References =====
-  * http://shiflett.org/blog/2006/jan/addslashes-versus-mysql-real-escape-string
-  * http://ilia.ws/archives/103-mysql_real_escape_string-versus-Prepared-Statements.html