Mauskar Technologies Inc

Description

Protecting Web Sites from Automated and Advanced SQL Injection SQL Injection continues to be one of the most predominant Web application threats. In the first half of 2008, SQL injection was the number one attack vector for malware, having compromised tens of thousands of Web sites including those of some high profile companies. Considering the widespread availability of valuable data on the Web, the popularity of ecommerce and dependency on the Web for all kinds of information, attackers are motivated to implement faster, more advanced SQL injection methods to launch high profile, widespread attacks on targeted Web sites. This paper provides an overview of SQL Injection 2.0, the new wave of SQL injection threats that dominates the application landscape. Specific attack techniques described include automation of SQL injection through usage of tools and popular search engines, SQL injection for Web site defacement, malware distribution and Denial of Service (DoS) attacks, and direct database SQL injection. There is also an overview of mitigation techniques organizations can use to address these types of application threats. Most of the information contained herewith is based on the advanced knowledge base of Imperva’s Application Defense Center, a premier research organization for security analysis, vulnerability discovery, and compliance expertise. Overview of SQL Injection This white paper assumes you have a working knowledge of SQL injection. However, a brief refresher on SQL injection is provided here. For additional information, you may refer to previous Imperva white papers on this topic: “SecureSphere SQL Injection Protection White Paper” and “Blindfolded SQL Injection.” SQL injection is an attack technique that takes advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a back-end database. Most SQL injection attacks are executed through an application that accepts user-supplied input for query parameters. The attacker supplies a carefully crafted string within a form field or URL parameter to form a new query with results that are very different from what the application developer intended. For example, consider a login form on a Web site that takes a username and password parameter to enable access to a certain section of the Web site by validating the username and password against entries in the back-end database. A very simple attack may be possible by simply providing something, like ‘a’ OR 1=1 -- in the username field. Here we illustrate the SQL query that is generated when a user logs into a Web application: SELECT * FROM users WHERE username =’$uid’ AND password = ‘$pwd’; Suppose the hacker enters the username as ‘a’ OR 1=1 --. Then the SQL query becomes SELECT * FROM users WHERE username =’a’ OR 1=1 --’ AND password = ‘pwd’ Because the double hyphens character is interpreted as the beginning of a comment by the SQL server, everything after ‘--’ is ignored. So the query effectively becomes: SELECT * FROM users WHERE username = ‘a’ OR 1=1; Since 1=1 is always true, the condition is always true and the login is always validated.

Products & services

Similar companies nearby