Hi, all !
I know that Security Testing is very important. I working with a application web and need knowledge about the SQL injection, so i researched and asked someone. I show it below and hope you comment for me than more about it. Thanks.

SQL - injection: How to Test web applications against SQL attacks

Security testing of web applications against SQL Injection, explained with simple examples By Inder P Singh.

Many applications use some type of a database. An application under test might have a user interface that accepts user input that is used to perform the following tasks:

1.    Show the relevant stored data to the user e.g. the application checks the credentials of the user using the log in information entered by the user and exposes only the relevant functionality and data to the user

2.    Save the data entered by the user to the database e.g. once the user fills up a form and submits it, the application proceeds to save the data to the database; this data is then made available to the user in the same session as well as in subsequent sessions

Some of the user inputs might be used in framing SQL statements that are then executed by the application on the database. It is possible for an application NOT to handle the inputs given by the user properly. If this is the case, a malicious user could provide unexpected inputs to the application that are then used to frame and execute SQL statements on the database. This is called SQL injection. The consequences of such an action could be alarming.

The following things might result from SQL injection:

1. The user could log in to the application as another user, even as an administrator.

2. The user could view private information belonging to other users e.g. details of other users profiles, their transaction details etc.

3. The user could change application configuration information and the data of the other users.

4. The user could modify the structure of the database; even delete tables in the application database.

5. The user could take control of the database server and execute commands on it at will.

Since the consequences of allowing the SQL injection technique could be severe, it follows that SQL injection should be tested during the security testing of an application. Now with an overview of the SQL injection technique, let us understand a few practical examples of SQL injection.

Important: The SQL injection problem should be tested only in the test environment.

If the application has a log in page, it is possible that the application uses a dynamic SQL such as statement below. This statement is expected to return at least a single row with the user details from the Users table as the result set when there is a row with the user name and password entered in the SQL statement.

SELECT * FROM Users WHERE User_Name = 섃 & strUserName & 쒋 AND Password = 섃 & strPassword & 쒋;

If the tester would enter John as the strUserName (in the textbox for user name) and Smith as strPassword (in the textbox for password), the above SQL statement would become:

SELECT * FROM Users WHERE User_Name = 쁉ohn AND Password = 쁓mith;

If the tester would enter John쇺 as strUserName and no strPassword, the SQL statement would become:

SELECT * FROM Users WHERE User_Name = 쁉ohn쇺 AND Password = 쁓mith;

Note that the part of the SQL statement after John is turned into a comment. If there were any user with the user name of John in the Users table, the application could allow the tester to log in as the user John. The tester could now view the private information of the user John.

What if the tester does not know the name of any existing user of the application? In such a case, the tester could try common user names like admin, administrator and sysadmin. If none of these users exist in the database, the tester could enter John or 쁷=셹 as strUserName and Smith or 쁷=셹  as strPassword. This would cause the SQL statement to become like the one below.

SELECT * FROM Users WHERE User_Name = 쁉ohn or 쁷='x AND Password = 쁓mith or 쁷=셹;

Since 쁷=셹 condition is always true, the result set would consist of all the rows in the Users table. The application could allow the tester to log in as the first user in the Users table.

Important: The tester should request the database administrator or the developer to copy the table in question before attempting the following SQL injection.

If the tester would enter John; DROP table users_details;쇺봞s strUserName and anything as strPassword, the SQL statement would become like the one below.

SELECT * FROM Users WHERE User_Name = 쁉ohn; DROP table users_details; 볛 AND Password = 쁓mith;

This statement could cause the table 쐕sers_details to be permanently deleted from the database.

Though the above examples deal with using the SQL injection technique only the log in page, the tester should test this technique on all the pages of the application that accept user input in textual format e.g. search pages, feedback pages etc.

SQL injection might be possible in applications that use SSL. Even a firewall might not be able to protect the application against the SQL injection technique.

I have tried to explain the SQL injection technique in a simple form. I would like to re-iterate that SQL injection should be tested only in a test environment and not in the development environment, production environment or any other environment. Instead of manually testing whether the application is vulnerable to SQL injection or not, one could use a web vulnerability scanner that checks for SQL injection.


Share
Related Documents
  1. Security Testing Reference : SQL Injection (2448)
  2. [Free] Havij : A Advanced SQL Injection Tool (4074)
  3. New Advanced SQL Injection For Advanced Security Testing (1963)
  4. SQL Injection Test Data (1622)
  5. [Free] Exploit-Me : Web application security testing tools (3898)
  6. OWASP Testing Guide (2851)
  7. Software Security: Building Security In (1063)
  8. Testing SQL injection with SQLMap (1601)
  9. [Free] BFBTester : Brute Force Binary Tester (2075)
  10. [Video] Software Security Testing: Strengthening Your Defense Strategy (998)
  11. [Video] Take Control of your IT Security and Compliance without the Complexity of Traditional SIM Systems (1054)
  12. SQL Injection (2487)
  13. [Free] LAPSE : Web Application Security Scanner for Java (4313)
  14. SQL Injection Security Testing? (1657)
  15. cgisecurity.com : web application testing site (1185)
  16. 2010-10-27, SecureWorld Expo @ USA (1648)
  17. How to Secure CXF Web Services with SSL/TLS and WS-Security (3744)
  18. Definition of SQL injection in Security Testing? (2350)
  19. Using JTest for Security Testing (2397)
  20. [Free] x5s : XSS security testing assistant tool (2168)