Database SQL injection security problem handling with examples
This presentation delves into the detection, prevention, and handling of SQL injection attacks, showcasing examples and tools for enhancing database security measures.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
Database SQL injection security problem handling with examples Lehman College, The City University of New York 2019 International Conference on Computational Science and Computational Intelligence (CSCI) 110525015 1
Outline Introduction Detection and Prevention Attack with Kali Linux sqlmap Manual SQLI Handling Example Conclusion My experience 2
Introduction Hackers inject illegal query in original sql command to obtain sensitive data. 4
Introduction Structured Query Language Injection(SQLI) 1. 2. SQLI tool example 3. Manual attack example 4. Prevention code example Detection and prevention 5
Detection and Prevention 1. 2. Java Database Connectivity(JDBC) 3. Static Analysis Framework for discovering SQL Injection(SAFELI) 4. SQL DOM 5. Stored Procedure 6. Aho-Corasick Candidate evaluation for Discovering Intent Dynamically(CANDID) 7
Detection and Prevention Candidate evaluation for Discovering Intent Dynamically(CANDID) Check front-end structure is match with back-end structure 8
Detection and Prevention CANDID performance 9
Detection and Prevention Java Database Connectivity(JDBC) Checking if type mismatches during the run time 10
Detection and Prevention Static Analysis Framework for discovering SQL Injection(SAFELI) Analysis application with byte-code in compile time According to original thesis, this framework consists: 1. 2. Symbolic Execution Engine 3. Library of Attack Patterns 4. Constraint Solver 5. Test Case Generator Microsoft Intermediate Language(MSIL) Instrumentor 11
Detection and Prevention SQL Domain Object Model(SQL DOM) Validate with strongly-typed to a database schema at compile time. Based on reference, SQL DOM work with these 2 fundamental parts 1. 2. SQL DOM generator Abstract object model 12
Detection and Prevention Stored procedure. Executing procedure with paramters. 13
Detection and Prevention Aho-Corasick in SQLI prevetion Using pattern matching algorithm 14
Attack with Kali Linux sqlmap Introduce sqlmap tool 1. 2. Having command in tool -> sqlmap -u test.php.vulweb.com/artists.php?artist=2 --dbs Show what the table schema is 3. Save or use the data obtained in previous step. Find target web with http get link, like /php?id = 17
Manual SQLI 18
Manual SQLI The website is vulnerable once it worked after pasting an apostrophe in the end of link. 19
Manual SQLI http://testphp.vulnweb.com/artists.php?artist=- 2%20union%20select%201,2,group_concat(pass)%20from%20users 20
Handling Example Using stored procedure and dynamic query with parameters. 22
Handling Example Using JDBC checker on Ubuntu Linux 23
Conslusion 24
Conclusion To prevent SQLI attacks, developer must implement proper SQLI detection and prevention mechanisms which are mentioned previously. Besides, security measures needs to be considered and implemented to protect our data and applications on the cloud in cyber space. 25
My experience 1. 2. Encrypt or hash sensitive information in database. 3. Limit the accessibility of browser. 4. Validate http get parameters before calling procedures. 5. Use verification code to verify if the request is legal. Access Data with procedures. 27
END 28
