SQL Injection (definition)
SQL injection is a code injection technique that exploits a security vulnerability occurring in the database layer of an application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed. It is an instance of a more general class of vulnerabilities that can occur whenever one programming or scripting language is embedded inside another. SQL injection attacks are also known as SQL insertion attacksSource: http://en.wikipedia.org/wiki/SQL_injection
Example #1
Microsoft SQL Server has its own dialect of SQL, which is called Transact SQL, or TSQL for short. We can exploit the power of TSQL in a number of ways to show how SQL injection attacks work. Consider the following query, which is based on the users table we created on the last page:
select userName from users where userName='' having 1=1If you're an SQL buff, then you'll no doubt be aware that this query raises an error. We can easily make our login.asp page query our database with this query by using these login credentials:
Username: ' having 1=1 --- Password: [Anything]When I click on the submit button to start the login process, the SQL query causes ASP to spit the following error to the browser:
Microsoft OLE DB Provider for SQL Server (0x80040E14)Column '
users.userName' is invalid in the select list because it is not contained in an aggregate function and there is no GROUP BY clause./login.asp, line 16Well well. It appears that this error message now tells the unauthorized user the name of one field from the database that we were trying to validate the login credentials against:
users.userName. Using the name of this field, we can now use SQL Server's LIKE keyword to login with the following credentials:Username: ' or users.userName like 'a%' --- Password: [Anything]Once again, this performs an injected SQL query against our users table:
select userName from users where userName='' or users.userName like 'a%' --' and userPass=''When we created the users table, we also created a user whose userName field was admin and userPass field was wwz04ff. Logging in with the username and password shown above uses SQL's like keyword to get the username. The query grabs the userName field of the first row whose userName field starts with a, which in this case is admin:
Logged In As adminExample #2
SQL Server, among other databases, delimits queries with a semi-colon. The use of a semi-colon allows multiple queries to be submitted as one batch and executed sequentially, for example:
select 1; select 1+2; select 1+3;...would return three recordsets. The first would contain the value 1, the second the value 3, and the third the value 4, etc. So, if we logged in with the following credentials:
Username: ' or 1=1; drop table users; -- Password: [Anything]Then the query would execute in two parts. Firstly, it would select the userName field for all rows in the users table. Secondly, it would delete the users table, so that when we went to login next time, we would see the following error:
Microsoft OLE DB Provider for SQL Server (0x80040E37) Invalid object name 'users'. /login.asp, line 16
