SQL Injection
Download as PPTX, PDF0 likes395 views
According to a 2015 study, 86% of over 30,000 websites tested had at least one serious vulnerability. Of the vulnerabilities found, 61% were resolved within 193 days. SQL injection is a type of attack where an attacker tries to alter SQL statements by inserting new SQL keywords or operators. Examples provided demonstrate how an attacker can use SQL injection to drop all databases or return all records. Prevention techniques like escaping characters and using prepared statements can help protect against SQL injection attacks.
SQL Injection
- 2. of 30,000 websites tested by WhiteHat Sentinel had at least one serious vulnerability. 86% Source: https://www.whitehatsec.com/statistics-report/featured/2015/05/21/statsreport.html
- 3. of these vulnerabilities were resolved. 61% Source: https://www.whitehatsec.com/statistics-report/featured/2015/05/21/statsreport.html
- 4. 193 Days
- 5. From a single injection we accessed EVERYTHING Why do you put such faith in a company that allows itself to become open to these simple attacks? “ ” “ ” LulzSec Source: http://www.theguardian.com/technology/2012/aug/29/lulzsec-hacker-arrest-sony-attack
- 6. SQL is used to communicate with a relational database. SQL
- 7. When an attacker attempts to change the logic, semantics or syntax of a legitimate SQL statement by inserting new SQL keywords or operators into the statement. Source: Halfond, William GJ, and Alessandro Orso. "AMNESIA: analysis and monitoring for NEutralizing SQL-injection attacks." Proceedings of the 20th IEEE/ACM international Conference on Automated software engineering. ACM, 2005. SQL Injection
- 10. SQL
- 11. Example #1
- 12. SELECT * FROM USERS WHERE Username = “sayed”
- 13. SELECT * FROM USERS WHERE Username = “sayed”“
- 14. SELECT * FROM USERS WHERE Username = “sayed”; Drop All DATABASES ;DROP ALL DATABASES;
- 15. Example #2
- 16. OR ‘1’ = ‘1’ SELECT * FROM USERS WHERE username = “sayed” AND Password =“1234” or ‘1’ = ‘1’
- 19. Scape Characters mysql_real_escape_string(Query) Prepared Stetement SELECT * FROM USERS WHERE username = ?
- 20. Conclusion • Your vulnerable if you do not use prepared statement. • Don’t forget As hacks go, there are worst ones!
- 21. any question …