- [Instructor] SQL injection
or SQL injection vulnerabilities can be catastrophic.
Because basically they can allow an attacker to view,
to insert, to delete or modify records in a database.
In a SQL injection attack, the attacker actually injects
or inserts, partial or complete SQL queries
via a web application.
Basically, the attacker can inject these commands
into input fields in an application or via a URL.
And he can actually do that in order to execute
predefined SQL commands and manipulate the database.
Now I want to give you a brief introduction to SQL,
but only for your reference.
Many of you already are familiar with SQL
and SQL statements.
In the screen, I'm actually sharing
the most common SQL statements for your reference.
So you have things like select
that is used to obtain data from a database
update, to update database, you know records,
delete, insert to create database, alter database,
create tables to use and you know, to create a new table,
drop tables, alter tables, create index,
drop index and so on.
Now, typically SQL statements
are divided into different categories.
The first one is actually
the Data Definition Language statements or DDL,
Data Manipulation Language statements, DML,
Transaction Control Statements,
Session Control Statements,
System Control Statements,
and Embedded SQL Statements as well.
Now the W3Schools website has a tool
called the TryIt SQL editor that actually allows you
to practice with SQL statements using an online database
that again, you can actually use to become familiar
with the actual protocol
if you have never been exposed to the protocol.
So another good resource that explains SQL queries in detail
is the GeeksforGeeks.org SQL tutorial,
as I'm actually sharing in the screen.
Now what I want to actually share with you
is an SQL statement that is actually trying to gather
a specific record within a table in a database
and the table name is customers.
And basically, I'm doing a select all from customers
and I'm filtering them where I only want to see
the contents with a record that matches Saavedra.
And basically, there's a field
or a column called ContactName
and basically I'm using the word ContactName LIKE
and then Saavedra in between wildcards.
Now, what I want to highlight is
what the application is actually sending to the database.
So all that SELECT statement that I'm showing in the screen,
or that I'm highlighting in the screen
is the one that actually is sent from the application
to the database and the user should not see that request,
the only thing that the user can do
is enter the word Saavedra in the input of a web form.
So that's why we actually want to manipulate.
We want to supply crafted input,
in an attempt to make the original SQL statement
execute further actions in the database.
So SQL injections can actually be done user pre,
user supplied strings, or numeric inputs as well.
In this demonstration, basically,
I'm actually using
the WebGoat intentionally vulnerable application,
and I'm demonstrating how I can inject, you know
my own SQL statement in this case, actually, a Boolean
SQL syntax, and where the string Smith
and then followed by a single quote
and then after that, followed by an OR statement,
that's an SQL OR statement, followed by one equals one,
and one equals one is basically true equals to true.
And that actually causes the application
and more specifically the database
to reply back to the application
and display all records in that database table
to the attacker.
Now another example that I'm actually showing you here
is, in this case, using a numeric input
to cause the vulnerable application
to dump the database tables,
as I'm actually showing in the screen.
Now in many cases, you can actually even use
comments delimiters or any other type of inputs, right
as well as other SQL keywords, including AND and OR,
or simple test applications with a single quote.
And as a matter of fact, manual pen-testers
is just to basically test and do a quick test
of an application and make sure
that there's no SQL injection.
People actually start by adding a single quote,
or a semicolon to the field parameter in a web form.
That single quote, is actually used in SQL
as a string terminator.
So if the application doesn't filter it,
then you may be able to retrieve records
or additional information, like error messages,
that can actually help you enhance your query
or your statement and do other type of attacks.
Now there are different SQL injection categories.
SQL injection attacks can be divided into
in-band SQL injection, basically,
that's the type of injection that the attacker
obtains the data by using the same channel
that is actually using the SQL code.
And this is actually the most basic form of SQL injection
out there, and that's where the data is actually
dumped directly in a web application or webpage.
Then you also have out-of-band SQL injection
and that's actually a type of injection
where the attacker retrieves data using a different channel.
So, for example, it can be an email, a text
or an instant message that can be sent by the attacker
or to the attacker rather with the results of the query
or the attacker actually may be able to send
the compromised data to another web server
another system and so on.
Then you also have blind or inferential SQL injection.
And this type of SQL injection
is the one that actually the attacker
does not make the application display or transfer any data
thus the name blind SQL injection.
Instead, basically, the attacker is able
to reconstruct the information
by sending specific SQL statements
and also by discerning the behavior
of the application and the database.
Now there are several techniques that can be used
to exploit SQL injection vulnerabilities.
You have union operators, this actually typically is used
when a SQL injection vulnerability allows a SELECT statement
to combine two queries in a single result
or a set of results.
Then you also have Boolean, which is actually used to verify
whether a certain condition is true or false.
And that's the example that we went over a few minutes ago.
You also have the error-based technique.
And this is actually used to force a database
to generate some type of error in order to enhance
and refine the attack or the injection.
You also have out-of-band techniques.
And this is basically used to obtain records
from the database by using a different channel.
Remember that out-of-band is actually
by using a different channel, like making HTTP connection
to send the results to a different web server
or a local machine that is actually running a web service.
Then you also have the time delay technique.
It is possible to actually use database commands
to delete answers from the server.
And basically, an attacker may use this type of technique
whenever he or she doesn't get any output or error messages
from the application.
And of course, you can actually combine
any of these techniques that I actually mentioned.
For example, you may use the union operator
and the out-of-band techniques to perform an attack.
Now I'm gonna go over a different example
on how you can actually use different tools
like the Burp Suite, and SQL map
to find SQL vulnerabilities.
Basically, in this screen, I actually have
the Burp Suite tool, and I'm actually gonna be using it
as a proxy to intercept the transactions
between my web browser and the web application
or the web server.
In this case, I'm actually turning on intercept,
then my browser is actually configured already
to send old traffic to the proxy.
So I'm skipping those steps in here.
However, once I actually navigate, in this case
to the Damn Vulnerable Web Application or DVWA,
on the SQL injection, basically,
I am just typing my name in this form.
I am submitting that to the application,
and as you can see, in Burp, my transaction,
the GET transaction, the GET request, rather,
with the ID =omar is actually being sent
to the web application.
In this case, what I'm doing is actually
I'm highlighting that GET request
and I'm sending that or saving that
to a file called SQL test.
In my example, I already have a file
that actually was called SQL test,
so I'm overwriting that file.
Now that I have created that file with the GET request
from Burp, I'm gonna be using a tool in the command line
called SQL map.
So I'm launching that tool, with a -r option
follow to read the file,
followed by the file that I created,
and then at the end, I'm gonna type --dbs
to enumerate any databases, that the tool can actually,
you know, enumerate in that application.
So in this case, as you actually can see,
the tool is actually running basically, within seconds.
It already is telling me that the backend database
looks to be a MySQL statement.
It asked me if I want to skip the test payload
specific for other databases,
in this case, since I know that it's MySQL server,
I'm gonna say yes.
And then it actually asked me if I want to
include all the other tests for MySQL,
so in that case, I say yes.
And as you see main other tool is actually running
and was able to, within seconds,
enumerate different databases.
Now there's a database called dvwa,
that's the one that we are interested on.
The other three are the information schema,
the MySQL database and the performance schema
that come by default with MySQL.
So now that we know the database, what I'm going to do
is I'm gonna use exactly the same tool, SQL map,
I'm gonna read the same file,
and I'm gonna dump all the contents
of the database that I can encounter, right.
So the cool thing about this tool, as you can actually see
is that within seconds it was actually able to determine
that there is some table within that database
that is called users.
And it appears that the tool recognized
some possible password hashes in a column called password.
So it even asked me, "Hey, do you want to store these hashes
on a temporary file for eventually,
I mean or further processing with other tools."
In this case, I'm actually saying yes.
And also it has the capability to perform
a dictionary based attack,
to actually crack those passwords.
So just to go with the flow, I'm gonna say yes,
to crack those passwords.
And as you see actually it's using a default word list
to perform that dictionary attack, and you know,
a brute force attack.
And you know, of course, it's actually asking me
if I want to use the common password suffixes.
And I say yes.
And as you can see, the tool not only was actually able
to dump the contents of different tables in here,
but was also able to crack the passwords of these users.
So you have the admin account.
So if I own an account called admin,
and the password is password,
you also have another one called gordonb,
the password is abc123.
And you see the other ones here.
Now the other thing that you actually see
is the guest book, a database or a table rather,
in the dbwa database and the content of the that, you know,
that table with three entries in the screen.
So as you can see, this is actually
a very, very, very powerful tool.
But one thing that actually I want to highlight in here
is that these tools are actually using the same mechanisms
that I explained to you before,
they're actually using union queries,
they're using time based attacks,
they're using many different techniques
to find SQL injection.
So for you to become better familiar
of all these techniques, yes, you can run these tools
but what I will strongly suggest is for you
to also become familiar with those strings
that you see in the string
and what they are actually used for, right.
So practice, practice, practice, but also understand
what the actual tools are doing
and what the underlying flaws are within the database.
Now, one last thing that I want to highlight
is the mitigations for these.
At the end of the day, SQL injection is an input validation,
you know, type of vulnerability, right?
So you have to sanitize input.
Many different frameworks already provided many support,
and you know, functionality to filter, invalid transactions
and, you know, potentially block attackers
that are trying to actually do what I'm teaching you here,
trying to put a single quote, trying to escape
and put their own SQL statements, right.
So at the end of the day, always remember
that the mitigation is gonna be input validation.
Especially for things like SQL injection, command injection,
and many of the other vulnerabilities
that you're gonna be learning in this course.