SQL Injection, often known as SQLI, is a typical attack vector that employs malicious SQL code to manipulate Backend databases in order to obtain information that was not intended to be shown. This information might contain sensitive corporate data, user lists, or confidential consumer information.
Types of SQL Injection:
1. Error-based SQLi: Error-based SQLI obtains information about the database structure from error messages issued by the database server. In rare circumstances, an attacker may enumerate an entire database using only error-based SQL injection.
2. Union-Based SQLi: Union-based SQLI uses the UNION SQL operator to aggregate the results of two or more SELECT queries into a single result, which is subsequently returned as part of the HTTP response.
3. Blind Boolean-based SQLi: Boolean-based SQL Injection works by submitting a SQL query to the database and forcing the application to produce a different response depending on whether the query returns TRUE or FALSE.
4. Blind Time-Based SQLi: Time-based SQL Injection works by sending a SQL query to the database and forcing it to wait for a predetermined length of time (in seconds) before answering. The response time will tell the attacker if the query result is TRUE or FALSE.
Example:
Let’s look at how to use the SQLMAP penetration testing tool to determine whether a website is safe against SQL injection. For demonstration purposes, we will utilize a website created with vulnerabilities in this article:
http://testphp.vulnweb.com/listproducts.php?cat=1
Step 1: Compile the list of existing databases.
So, initially, we must provide the web URL to be checked together with the -u argument. If we want to test the website using proxies, we may use the -tor argument. Typically, we would want to test whether we can acquire access to a database. So we utilize the –dbs option to do this. –dbs displays a list of all accessible databases.
sqlmap.py -u http://testphp.vulnweb.com/ listproducts.php?cat=1 --dbs
Cryogenics Impact Factor. We discover two databases, acuart, and information schema.
Step 2: Make a list of all the tables in a certain database.
We must slightly change our command to attempt to access any of the databases. We now use -D to indicate the name of the database that we want to access, and once there, we want to test if we can access the tables. We’ll use the –tables query for this. Allow us to search the acuart database.
sqlmap.py -u http://testphp.vulnweb.com/ listproducts.php?cat=1 -D acuart --tables
SQLI Prevention:
Developers can prevent SQL Injection with the help of the following techniques.
1. Use extensive data Sanitization: All user input must be filtered by websites. Ideally, user data should be context-filtered. Email addresses, for example, should be filtered to allow only the characters permitted in an e-mail address, phone numbers should be filtered to allow only the characters permitted in a phone number, and so on.
2. Make use of a web application firewall: Mod Security, a free and open-source module for Apache, Microsoft IIS, and Nginx web servers, is a prominent example. Mod Security offers a complex and constantly changing collection of rules for filtering potentially hazardous online requests. Most attempts to smuggle SQL across web channels are caught by its SQL injection safeguards.
3. Patch software on a regular basis: Because SQL injection vulnerabilities are frequently discovered in commercial software, it is critical to keep up with updating.
4. Contextually limit database rights: Create numerous database user accounts with the least amount of permission necessary for their usage scenario. For example, the code powering a login page should query the database using a restricted account that only has access to the appropriate credentials table.
5. Monitor SQL statements from database-connected apps in real-time: This will aid in the detection of rogue SQL statements and vulnerabilities. Machine learning and/or behavioral analysis monitoring technologies can be extremely effective.
