WHAT IS A SQL DATABASE?
A database is a collection of information that pertains to the same subject and needs to be stored for security or future reference.
SQL is a standard declarative language used for relational databases. But what exactly is a relational database?
It is simply a system that models data in a way that it is presented as tables.
WHAT IS SQL INJECTION?
The vulnerability of SQL INJECTION is still widely exploited due to web developers not paying attention to the security of their systems. For beginners, SQL Injection is a type of attack where one can insert or manipulate queries created by the application, which are sent directly to the database.
With this, the attacker can perform operations directly on the database, deleting records, tables, or even gaining unauthorized access to the system. Depending on the version of the database, it is also possible to insert malicious commands and gain full permission (root access) to the web server where the database is running.
HOW DOES SQL INJECTION OCCUR?
Let's use this test site as an example: http://testphp.vulnweb.com/userinfo.php
It's worth mentioning that on our Cybersecurity Training platform, you can learn these techniques and more advanced ones.
Below, we will see some examples of STRINGS:
b' or ' 1='
' or '1
' or '|
' or 'a'='a
' or ''='
105 or 1=1
The attack works by inserting SQL commands in places not expected by the system, which ends up processing these commands as if they were legitimate.
In other words, if the session of the code where the query is made is not developed with the appropriate security measures, this query will be a true condition, allowing the application to grant access.
Select * from users where userId =105 or 1=1;
The above SQL attack will return all rows from the "Users" table, as OR 1 = 1 always results in True.
By using these techniques, the attacker can easily obtain all user information, including username and password, simply by entering 105 OR 1 = 1 in the input field.
Below we have a PHP login form with SQL Vulnerability:
$usuario = $_POST['usuario'];
$senha = $_POST['senha'];
$sql = "SELECT * FROM usuarios WHERE usuario = '".$usuario."' AND senha = '".$senha."' ";
$processa = mysql_query($sql);
All marked with $ are variables in PHP, which are:
$usuario
$senha
$sql
$processa
The logic of this code works like this:
Select all from the "usuarios" table where the "usuario" entered in the login form must match the one stored in the database and the "senha" must also match the one stored in the database.
The variables $usuario and $senha receive whatever is typed in the login fields through the POST method, which is used to request that the web server accept the submitted data.
If no data validation is performed, the attacker can log into the application without even having the login, using strings like the following example:
Username: ' or '1
Password: ' or '1
Currently, there are 5 types of SQL Injection:
- One of them is Poorly Filtered Strings, which we just saw;
- Incorrect type handling;
- Signature Evasion;
- Filter Bypassing;
- Blind SQL Injection.