Relational Databases - Lecture 5 - SQL injection
•
0 j'aime•148 vues
SQL injection attack example
Recommandé
Contenu connexe
Tendances
Similaire à Relational Databases - Lecture 5 - SQL injection
Similaire à Relational Databases - Lecture 5 - SQL injection (20)
Dernier
Dernier (20)
Relational Databases - Lecture 5 - SQL injection
- 2. 1 0 1 0 0 1 0 1 0 1 0 0 1 0 1 0 0 1 0 0 1 0 ✐ ✐ ✑ ✐ ✑ ✐ ✐ ✑ ✑ ✐ ✐ ✑ ✐ ✐ ✑ ✐ ✑ ✑ 1 1 1 0 0 1 0 1 0 0 1 1 0 0 1 1 1 0 0 0 1 0 1 1 ✑ ✐ ✑ ✐ ✐ ✑ ✑ ✐ ✐ ✑ ✐ 1 1 1 0 0 1 0 1 0 0 1 0 1 0 0 1 1 0 1 0 1 1 0 1 1 0 0 1 ✑ ✑ 1 ✑ ✑ 1 0 1 SQL injection • Injection of an SQL query via an input from the client application • Vulnerability comes from the dynamic SQL request construction
- 4. 1 0 1 0 0 1 0 1 0 1 0 0 1 0 1 0 0 1 0 0 1 0 ✐ ✐ ✑ ✐ ✑ ✐ ✐ ✑ ✑ ✐ ✐ ✑ ✐ ✐ ✑ ✐ ✑ ✑ 1 1 1 0 0 1 0 1 0 0 1 1 0 0 1 1 1 0 0 0 1 0 1 1 ✑ ✐ ✑ ✐ ✐ ✑ ✑ ✐ ✐ ✑ ✐ 1 1 1 0 0 1 0 1 0 0 1 0 1 0 0 1 1 0 1 0 1 1 0 1 1 0 0 1 ✑ ✑ 1 ✑ ✑ 1 0 1 Typical example String loginQuery = “SELECT * FROM useraccounts WHERE userID = ‘“ + request.getParameter(“userID”) + “‘ AND password = ‘“ + request.getParameter(“password") + “‘“; userID = ' or 1=1 -- password = doesNotMatter SELECT * FROM useraccounts WHERE userID = '' or 1=1 -- AND password='doesNotMatter'
- 5. 1 0 1 0 0 1 0 1 0 1 0 0 1 0 1 0 0 1 0 0 1 0 ✐ ✐ ✑ ✐ ✑ ✐ ✐ ✑ ✑ ✐ ✐ ✑ ✐ ✐ ✑ ✐ ✑ ✑ 1 1 1 0 0 1 0 1 0 0 1 1 0 0 1 1 1 0 0 0 1 0 1 1 ✑ ✐ ✑ ✐ ✐ ✑ ✑ ✐ ✐ ✑ ✐ 1 1 1 0 0 1 0 1 0 0 1 0 1 0 0 1 1 0 1 0 1 1 0 1 1 0 0 1 ✑ ✑ 1 ✑ ✑ 1 0 1 Threat • Execute SQL queries • Select, Insert, Delete • Explore error messages • Column 'users.username' is invalid • Identity theft • Data leakage
- 9. 1 0 1 0 0 1 0 1 0 1 0 0 1 0 1 0 0 1 0 0 1 0 ✐ ✐ ✑ ✐ ✑ ✐ ✐ ✑ ✑ ✐ ✐ ✑ ✐ ✐ ✑ ✐ ✑ ✑ 1 1 1 0 0 1 0 1 0 0 1 1 0 0 1 1 1 0 0 0 1 0 1 1 ✑ ✐ ✑ ✐ ✐ ✑ ✑ ✐ ✐ ✑ ✐ 1 1 1 0 0 1 0 1 0 0 1 0 1 0 0 1 1 0 1 0 1 1 0 1 1 0 0 1 ✑ ✑ 1 ✑ ✑ 1 0 1 Android example Curson curson = db.rawQuery(“select * from login where USERNAME = ‘“ + param1 + “‘ and PASSWORD = ‘“ +param2 + “‘;”, null); Curson curson = db.rawQuery(“select * from login where USERNAME = ? and PASSWORD = ?;”, new String[]{param1, param2}); • Bad • Good