Web Application Penetration Testing SQL Injection Basics

Penetration Testing web applications is a must for securing them . SQL injection is Top rated Vulnerability by OWASP and must be penetration tested against it .

Penetration testing Web Application for SQL Injection

SQL Basics : SQL is a relational database . SQL Databases consists of Rows and Columns. The rows are sometimes reffered as Tuples also .Now in a DBMS (Database Management System) there are 3 main parts :

Creating structure of table
Entering data
Making queries (and getting meaningful results from data)

Queries is the most important part of any database . Queries give the users of a Web Application the power of getting the meaning full results from the database . So our Focus in this artical will be on how queries can be used to manipulate the database and tricking it into giving us valuable information in an Un-Authorised way .

Whenever SQL is used to display data on a web page, it is common to let web users input their own queries. For example, if you go to a shopping website to buy a T-shirt,then you might specify what kind of T-Shirt you want. The site would probably be storing data about T-shirts in a table with columns like BrandName, Price, Company, Size, Fabric and what not .

Now the website allows you to create a query using some sort of a user friendly drop down based form which also consists of checkboxes (well we all might have shoped at Flipkart or ebay )which lets you select your price , preferred company, etc. So basically, you, the user, can create queries and request data from their SQL servers. Well this is brilliant and exactly what a hacker looks for in a Web Application . Now the main point to note here is that SQL queries can be sent to the server even by a non registered user . So the SQL servers are open for the interaction with the website visitors .

Now this automated method of creating queries for you is relatively safe, there is another method of creating queries which can be exploited by penetration testers or hackers. A url ending in .php is a direct indication that the website/blog uses sql to deliver a lot of it’s data, and that you can execute queries directly by changing the url. Now basically the data in the SQL tables is protected. However, when someone sends some rogue commands to the SQL server, it doesn’t understand what to do, and returns an error. This is a clear indication that with proper coding, we can send queries that will make the database malfunction, and give us all the otherwise private data of its tables. This attack can be used to obtain confidential data like a list of username and passwords of all users on a website.

This can be summarised as a 3 Steps Process

Find a web application that is vulnerable to SQL injection (SQLi) attacks. Vulnerability has 2 criteria. Firstly, it has to allow execution of queries from the url, and secondly, it should show an error for some kind of query or the other. An error is an indication of a SQL vulnerability.
After we know that a site is vulnerable, we need to execute a few queries/sql commands to know what all makes it act in an unexpected manner. Then we should obtain information about SQL version and the number of tables in database and columns in the tables.
Finally we have to extract the fruitfull information from the tables.

Vulnerabilities can be found using your own creativity along with famous Google dorks. Remember that we have tools in Kali Linux that can be used for scanning a targeted web application for the vulnerabilities related to SQLi . But it is always advisable for security researchers to learn how to look for the new SQL vulnerabilities in a website without the aid of any tools .

If the vulnerability is found in the website then to exploit it further , we can :

Manually using some standard codes available online (and if you know SQL then you can figure most of the stuff out yourself). For example, you can instruct the database to give you all the data from a table by executing the command-

SELECT * FROM Users WHERE UserId = 109 or 1=1

Now, while the first part of the query “UserID=109” may not be true for all user, the condition 1=1 will always be true. So basically the query will be prompted to return all the data about the user for all the users for whom 1=1. Effectively, you have the username and passwords and all other information about all the users of the website.

Using some tool – Some tools help in making the process easier. You still have to use commands but using tools is much more practical after you have an idea what is actually happening. In Kali linux, there is a great tool called SQLMap that we’ll be using.

This was the basics of SQL injection Attack . We will further dig deeper into SQL Injection in the coming posts . Please let in your valuable comments about this tutorial on Basics of SQL Injection Attack . The Next Post is about how to perform SQL Injection Manually . In the latter posts we will be discussing the SQL Injection attacks in depth with live Attack Examples .

Web Application Penetration Testing SQL Injection Basics

Penetration testing Web Application for SQL Injection

Did you enjoy this post?

Comments

Leave a Reply Cancel reply