SQL Injection

SQL Injection (SQLi) is a security vulnerability that occurs when an attacker can manipulate SQL queries executed by a database. This can happen when an application does not properly sanitize user input, allowing malicious SQL code to be inserted into a query. SQLi can lead to unauthorized data access, data modification, and even complete system compromise.

Types of SQL Injection

1. In-band SQLi:
   • Error-based SQLi: The attacker uses the database’s error messages to gather information about the database structure.
   • Union-based SQLi: The attacker uses the UNION SQL operator to combine the results of two or more queries, allowing access to data from other tables.
2. Blind SQLi:
   • Boolean-based Blind SQLi: The attacker sends queries that cause the application to return different results based on a true or false condition, allowing the attacker to infer information.
   • Time-based Blind SQLi: The attacker sends queries that cause a delay in the response if a certain condition is true, allowing inference based on the response time.
3. Out-of-band SQLi: The attacker uses methods other than the primary communication channel to exfiltrate data, such as DNS or HTTP requests.

Example Scenario

Simple SQL Query: A web application uses the following SQL query to authenticate users:

SELECT * FROM users WHERE username = '$username' AND password = '$password';

If the application does not properly sanitize user inputs, an attacker could enter the following credentials:

• Username: admin' --
• Password: anything

This would result in the following SQL query:

SELECT * FROM users WHERE username = 'admin' --' AND password = 'anything';

The -- indicates a comment in SQL, causing the rest of the query to be ignored. The resulting query effectively becomes:

SELECT * FROM users WHERE username = 'admin';

This query would return data for the admin user, potentially allowing unauthorized access.

How to Find SQLi Vulnerabilities

1. Manual Testing: Manually inject SQL-specific syntax (like ' OR '1'='1) into input fields and observe the application’s behavior.
2. Automated Tools: Use automated scanners like SQLMap, Burp Suite, or OWASP ZAP to detect potential SQLi vulnerabilities.
3. Code Review: Analyze the codebase for unsafe database interactions, particularly where user inputs are directly incorporated into SQL queries.

Common SQLi Payloads

• ' OR '1'='1
• ' UNION SELECT NULL, NULL, version() --
• ' OR 1=1 --
• ' AND SLEEP(5) --

Mitigation

1. Prepared Statements (Parameterized Queries): Use prepared statements with bound parameters to ensure that user input is treated as data and not executable code.
2. Stored Procedures: Use stored procedures to execute predefined SQL queries, reducing the risk of injection.
3. Input Validation: Validate and sanitize all user inputs to ensure they conform to expected formats and types.
4. Least Privilege: Ensure the database user has the minimum necessary permissions to limit potential damage.
5. Error Handling: Suppress detailed database error messages to avoid revealing sensitive information.

Example of Testing for SQLi

1. In a login form, try inputting ' OR '1'='1 as both the username and password. If the application logs you in without valid credentials, it may be vulnerable to SQLi.
2. In a search box, input anything' UNION SELECT NULL, NULL, version() --. If database information is displayed, the application is likely vulnerable.

SQL Injection is a critical vulnerability that can have severe consequences. Ensuring secure coding practices and proper input handling is essential to protect applications from this type of attack.