SQL injection attacks occur when malicious SQL statements are injected into an application's existing SQL commands, potentially allowing attackers to alter or destroy database contents. Attackers can exploit vulnerabilities like unvalidated user input or direct use of dynamic SQL queries. To prevent this, developers should follow practices like input validation, parameterizing queries, and limiting database account privileges to only what is necessary.

1. DAT356 Hackers Paradise SQL Injection Attacks Doug Seven, Microsoft MVP Cofounder of SqlJunkies.com [email_address]

4. SQL Injection Causes public void OnLogon(object src, EventArgs e){ SqlConnection con = new SqlConnection( "server=(local);database=myDB;uid=sa;pwd;" ); string query = String.Format( "SELECT COUNT(*) FROM Users WHERE " + "username='{0}' AND password='{1}'", txtUser.Text, txtPassword.Text ); SqlCommand cmd = new SqlCommand(query, con); conn.Open(); SqlDataReader reader = cmd.ExecuteReader(); try{ if(reader.HasRows()) IssueAuthenticationTicket(); else TryAgain(); } finally{ con.Close() } }

5. The Problem Expected: Username: doug Password: p@$$w0rd SELECT COUNT(*) FROM Users WHERE username='doug' and password='p@$$w0rd' Malicious: Username: ' OR 1=1 -- Password: SELECT COUNT(*) FROM Users WHERE username='' OR 1=1 -- and password='p@$$w0rd'

6. Basic SQL Injection

9. Extended Stored Procedures

12. MachineSPNET -- Windows 2000 / XP EXEC sp_grantlogin [MachineNameSPNET] EXEC sp_grantdbaccess [MachineNameSPNET], [Alias] GRANT EXECUTE ON [ProcedureName] TO [Alias] GO -- Windows Server 2003 EXEC sp_grantlogin [NT AUTHORITYETWORK SERVICE] EXEC sp_grantdbaccess [NT AUTHORITYETWORK SERVICE] GRANT EXECUTE ON [ProcedureName] TO [NT AUTHORITYETWORK SERVICE] GO

13. Least Privilege

17. Stored Procedures

21. Input and Request Validation

23. Writing Secure Code (Second Edition) Michael Howard & David LeBlanc Microsoft Press, December 2002 Required reading at Microsoft!

24. Improving Web Application Security Building Secure ASP.NET Applications http://msdn.microsoft.com/security/default.aspx?pull= /library/en-us/dnnetsec/html/threatcounter.asp http://msdn.microsoft.com/security/default.aspx?pull= /library/en-us/dnnetsec/html/secnetlpmsdn.asp

25. Q1: Overall satisfaction with the session Q2: Usefulness of the information Q3: Presenter’s knowledge of the subject Q4: Presenter’s presentation skills Q5: Effectiveness of the presentation Please fill out a session evaluation on CommNet

26. © 2004 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.