SQL Injection Last Few Lectures XSS - Cross-site scripting - PowerPoint PPT Presentation

SQL Injection

Last Few Lectures • XSS - Cross-site scripting • XSRF/CSRF - Cross-site request forgery

Code Injection Attacks • Attacker executes arbitrary code on server • “Programming the program” • Not sanitizing user inputs/outputs

SQL Injection • Attacker enters bad information which is sent to the server • Server executes a SQL query with unintended outcomes.

Sample SQL query • dogs(name, breed, owner name) • Danger, lab, Fred • Tinkerbell, poodle, Teri • select * from dogs where owner=‘$name’; • select name from dogs where breed=‘$btype’;

Problem? • $name and $btype are directly passed to the function • select * from dogs where owner=‘$name’; • select name from dogs where breed=‘$btype';

SQL Injection 1. Post malicious input to form 2. Requests unintended SQL query 3. Returns unintended data to attacker

Malicious Input https://xkcd.com/327/

Malicious Input • select * from dogs where owner=‘$name’; • suppose $name was ‘or 1=1- - • or even ′ ; drop table dogs --

How to Thwart • Don’t build SQL commands yourself. • Use parameterized functions where you specify what input you expect.

Demo • hackthissite.org