Download Sql Injection in cyber security and more Lecture notes Cybercrime, Cybersecurity and Data Privacy in PDF only on Docsity!
Module 15: SQL Injection
SQL injection is a basic attack used to either gain unauthorized access to a database or retrieve information directly from the database. It is a flaw in web applications and not a database or web server issue.
Objective
The objective of this lab is to provide expert knowledge on SQL Injection attacks and other responsibilities that include: ● Understanding when and how web application connects to a database server in order to access data ● Extracting basic SQL Injection flaws and vulnerabilities ● Testing web applications for Blind SQL Injection vulnerabilities ● Scanning web servers and analyzing the reports ● Securing information in web applications and web servers
Scenario
SQL injection is the most common website vulnerability on the Internet and is used to take advantage of non-validated input vulnerabilities to pass SQL commands through a web application, for execution by a backend database. SQL injection is a code injection technique that exploits security vulnerability in a website's software. SQL injection attacks use a series of malicious SQL queries or SQL statements to directly manipulate the database. Applications often use SQL statements to authenticate users to the application, validate roles and access levels, store, obtain information for the application and user, and link to other data sources. The reason why SQL injection attacks work is that the application does not properly validate input before passing it to a SQL statement. As an Expert Ethical Hacker, you must use diverse solutions, prepare statements with bind variables and whitelisting input validation and escaping. Input validation can be used to detect unauthorized input before it is passed to the SQL query.
Exercise: 1 SQL Injection Attacks on an MS SQL
Database
SQL injection attacks use a series of malicious SQL queries or SQL statements to directly manipulate the database. Lab Scenario Today, SQL Injection is one of the most common and perilous attacks that website’s software experience. This attack is performed on SQL databases that have weak codes and this vulnerability can be used by an attacker to execute database queries to collect sensitive information, modify the database entries or attach a malicious code resulting in total compromise of the most sensitive data. As an Expert Penetration Tester and Security Administrator, you need to test web applications running on the MS SQL Server database for vulnerabilities and flaws. Lab Objectives The objective of this lab is to provide students with expert knowledge on SQL Injection attacks and to analyze web applications for vulnerabilities. In this lab, you will learn how to: ● Log on without valid credentials ● Test for SQL Injection ● Create your own user account ● Create your own database ● Directory listing ● Enforce Denial-of-Service attacks
- By default, Windows Server 2016 machine is selected click Ctrl+Alt+Delete button under Windows Server 2016 thumbnail in Resources tab. Alternatively navigate to Commands ( Thunder icon) menu and click
click Type Password.
- Click Windows Server 2012 thumbnail from the Resources pane, and click Ctrl+Alt+Delete under the Windows Server 2012 thumbnail. Alternatively click Ctrl+Alt+Delete from Commands menu ( Thunder
icon).
- In the Password field type Pa$$w0rd and press Enter to login. Alternatively navigate to Commands ( Thunder icon) menu Type Text and
- Double-click Google Chrome short-cut icon present on the Desktop in order to launch the browser.
- In the address bar type http://www.goodshopping.com and press Enter. GoodShopping main page appears as shown in the screenshot. Assume that you are new to this site and have never registered with it. Now
click LOGIN.
- Type the query blah' or 1=1 -- in the Username field (as your login name), and leave the password field empty.
the vulnerable site, and close the web browser.
- Before performing the next task i.e., Creating a User Account with the SQL Injection query, first let us confirm with the Login database of the GoodShopping. Switch to Windows Server 2016 machine, click Windows Server 2016 and launch Microsoft SQL Server Management Studio. Microsoft SQL Server Management Studio window appears with Connect to Server pop-up, choose Windows Authentication in the Authentication field and click Connect. To launch Microsoft SQL Server Management Studio, navigate to Start --> Microsoft SQL Server Tools 17 and click Microsoft SQL Server
Management Studio 17. 10.Microsoft SQL Server Manament Studio window appears as shown in the screenshot. In the left pane of Object Explorer expand Databases --> GoodShopping -->Tables. In Tables right-click dbo.Login and click Select
Management Studio running. 12.Now, click Windows Server 2012. Launch a browser and type http://www.goodshopping.com in the address bar of the browser and press Enter. The GoodShopping home page appears, as shown in the
screenshot. Click LOGIN. 13.Type blah';insert into login values ('john','apple123'); -- in the Username field (as your login name), and leave the password field empty as shown in the screenshot, and click Log in. If no error message is displayed, it means that you have successfully
apple123 in the Password field, and click Log in. 15.You will login successfully with the created login. Now you can access all the features of the website. Click Logout after browsing the required pages, and
close the browser window 16.Switch back to the Windows Server 2016 virtual machine from Resources pane. Microsoft SQL Server Management Studio appears (if not minimised or closed), right-click on dbo.Login , and click Select Top 1000 Rows from
Management Studio window open. 18.Switch back to Windows Server 2012 machine, launch the browser, type http://www.goodshopping.com in the address bar, and press Enter. The home page of GoodShopping appears. Click LOGIN , type blah';create database mydatabase; -- in the Username field, leave the Password field empty, and click Log in. In the above query, mydatabase is the name of the database, that you are going to create using the SQL Injection query. If no error message (or any message) displays on the web page, it means that the site is vulnerable to SQL injection; a database with the name
mydatabase has been created at the database server. Close the browser. 19.Click Windows Server 2016 machine, launch the Microsoft SQL Server Manager Studio. Microsoft SQL Server Management Studio window appears with Connect to Server pop-up, choose Windows Authentication in the Authentication field and click Connect. To launch Microsoft SQL Server Management Studio , navigate to Start --> Microsoft SQL Server Tools 17 and click Microsoft SQL Server
