This is a talk geared towards developers who have heard of SQL Injection, but haven’t seen it in action, or are unsure about how to do anything about it. Contains demos of what SQL injection looks like, and why escaping quotes is nowhere near sufficient.

1. Text
How to lose your database and your job
Ryan Gooler
http://ayay.co.uk/backgrounds/action_games/hitman/bullet-holes.jpg

2. Text
http://talesofmyexploits.com/posts/talk-how-to-lose-your-database-and-your-job

3. SQL Injection

4. What is it?
Improperly filtered input
Lets anyone write SQL to query your database
Severely underrated attack
The subject of a lot of boring talks

5. https://upload.wikimedia.org/wikipedia/commons/7/79/Operation_Upshot-Knothole_-_Badger_001.jpg

6. http://i.ytimg.com/vi/8GyVx28R9-s/maxresdefault.jpg

7. The example everyone uses
SELECT * FROM
users
WHERE (
username = ‘$username’ AND
password = ‘$password’
)

8. What the programmer expects
SELECT * FROM
users
WHERE (
username = ‘admin’ AND
password = ‘p@ssw0rd’
)

9. What hackers try
SELECT * FROM
users
WHERE (
username = ‘admin’ AND
password = ‘’ OR ‘a’=‘a’
)

10. But we teach people to write
secure code, right?
http://lmgtfy.com/?q=Login+using+a+MySQL+database

11. But surely PROFESSIONALS
don’t write that bad of code

12. Are there different types of SQL Injection vulnerabilities?

13. http://www.techsupportall.com/wp-content/uploads/2014/01/blue-screen-error.jpg
http://laportadacanada.com/userfiles/images/editorial(17).jpg
http://images.medicaldaily.com/sites/medicaldaily.com/files/2014/09/19/blind.jpg

14. Error based SQL Injection

15. Easy to find - just put a ‘ in somewhere
Very common
Usually filtered ineffectively
Only works when you inject BEFORE a where clause
Usually patched quickly
Usually VERY easy to find abuse in logs

16. DEMO

17. Union based SQL Injection

18. Usually found the same way Error-based is
Works when you inject AFTER a where clause
Another tool in your toolbox
Depending on the page, may be able to put multiple
injections in one query!

19. DEMO

20. Blind SQL Injection

21. Injection without seeing the output
Works by inferring data, not reading it out
Technically a timing side channel attack
Hard to find (for attackers and defenders)
Annoying to exploit
Takes fooooorrrrever
Still works!

22. DEMO

23. https://mortongrovenews.files.wordpress.com/2015/06/stressandfrustration1.jpg

24. http://www.wikihow.com/images/9/9c/Tie-a-Noose-Step-10-Version-2.jpg

25. http://pstrooper.deviantart.com/art/Ancient-Aliens-Guy-HD-Meme-465505021

26. Meh Defenses

27. Lets strip spaces!
$id = escape_spaces(“1/**/OR/**/1=1”);
“SELECT * FROM table WHERE id = $id”;
"SELECT * FROM table WHERE id = 1/**/OR/**/1=1”;
/**/ comment acts like a space

28. Lets strip out SQL keywords
Don’t check for SELECT, INSERT, UNION, etc.
UN/**/ION works just as well
So does UniOn
And you probably didn’t cover all keywords

29. Check to see if ‘id’ is a number?
if is_numeric($_POST['id'])
9 union all (SELECT GROUP_CONCAT(schema_name) FROM
information_schema.schemata)
Convert to hex…
0x3920756e696f6e20616c6c202853454c4543542047524f55505f
434f4e43415428736368656d615f6e616d65292046524f4d20696
e666f726d6174696f6e5f736368656d612e736368656d61746129
Thats a number!

30. Good Defenses

31. Lets escape quotes!
$id = escape_quotes(“1 OR 1=1”);
"SELECT * FROM table WHERE id = $id”;
"SELECT * FROM table WHERE id = 1 OR 1=1”;

32. SELECT *
FROM users
WHERE id = mysql_real_escape_string(“1 UNION SELECT id,
user_id, content, NULL FROM notes WHERE user_id = 1”);
SELECT *
FROM users
WHERE id =1
UNION
SELECT id, user_id, content, NULL
FROM notes
WHERE user_id = 1

33. Works ok if you use single quotes around your
variables, though.
$id = escape_quotes(“1’ OR 1=1”);
"SELECT * FROM table WHERE id = ‘$id’”;
"SELECT * FROM table WHERE id = ‘1’ OR 1=1’”;
INVALID SQL QUERY! :D

34. Great Defenses

35. Cast to int / float / whatever
Only works for numbers
SELECT * FROM whatever WHERE id = ‘X’;
Really solid defense when you can use it
Super easy to add in

36. Prepared Statements
SELECT * FROM users where id=? AND password=?
Can’t choose table name in this way
Some limitations with what prepared statements can do
Still could hit a buffer overflow or something
But pretty darn sturdy

37. ?