SQL injection Concepts

The Web Application Hacker's Handbook: Finding and Exploiting Security Flaws

by Dafydd Stuttard and Marcus Pinto · 30 Sep 2007 · 1,302pp · 289,469 words

Domains with Proxy Service Applications 529 Other Client-Side Injection Attacks 531 HTTP Header Injection 531 Cookie Injection 536 Open Redirection Vulnerabilities 540 Client-Side SQL Injection 547 Client-Side HTTP Parameter Pollution 548 Local Privacy Attacks 550 Persistent Cookies 550 Cached Web Content 551 Browsing History 552 Autocomplete 552 Flash Local

…

using various client-side technologies, various attacks against the same-origin policy, FITTP header injection, cookie injection and session fixation, open redirection, client-side SQL injection, local privacy attacks, and exploiting bugs in ActiveX controls. The chapter concludes with a discussion of a range of attacks against users that do not

…

technologies, the changes brought by HTML5, and ways of crossing domains via proxy service applications. There are new sections on client-side cookie injection, SQL injection, and HTTP parameter pollution. The section on client-side privacy attacks has been expanded to include storage mechanisms provided by browser extension technologies and HTML5

…

site visited by the victim user to interact with the application to perform actions that the user did not intend. Broken authentication Broken access controls SQL injection Cross-site scripting Information leakage Cross-site request forgery Incidence in recently tested applications Figure 1-3: The incidence of some common web application vulnerabilities

…

the processing that is performed on it is inherently safe. In some situations, safe programming methods are available that avoid common problems. For example, SQL injection attacks can be prevented through the correct use of parameterized queries for database access (see Chapter 9). In other situations, application functionality can be designed

…

application may enforce some global input validation checks, such as sanitizing various kinds of potentially malicious input before it is processed. Having identified a blind SQL injection vulnerability, you may encounter problems exploiting it, because your crafted requests are being modified in unseen ways by the input validation logic. However, other

…

described. In many well-secured or mature applications, a consistent framework is employed that prevents numerous types of attacks, such as cross-site scripting, SQL injection, and unauthorized access. In these cases, the most fruitful areas for hunting vulnerabilities generally are the portions of the application that have been added retrospectively

…

details of how you can detect and exploit each of these problems: ■ Client-side validation — Checks may not be replicated on the server ■ Database interaction — SQL injection ■ File uploading and downloading — Path traversal vulnerabilities, stored cross-site scripting ■ Display of user-supplied data — Cross-site scripting ■ Dynamic redirects — Redirection and header

…

subsequent processing that the application performs on the parameter, you may be able to leverage the defects in validation to exploit other vulnerabilities, such as SQL injection, cross-site scripting, or buffer overflows. Script-Based Validation The input validation mechanisms built into HTML forms themselves are extremely simple and are insufficiently fine

…

be used to extract arbitrary data from different database tables and to escalate privileges within the database and the database server. For this reason, any SQL injection vulnerability should be regarded as extremely serious, regardless of its precise context within the application's functionality. Injecting into Different Statement Types The SQL

…

verbs that may appear at the beginning of statements. Because it is the most commonly used verb, the majority of SQL injection vulnerabilities arise within select statements. Indeed, discussions about SQL injection often give the impression that the vulnerability occurs only in connection with select statements, because the examples used are all of

…

of applications expose the sort order keyword (asc or desc) to be specified by the user, perhaps believing that this has no consequence for SQL injection attacks. Finding SQL injection in a column name can be difficult. If a value is supplied that is not a valid column name, the query results in an

…

■ MySQL: SELECT CONCAT(table_name, 1 : 1 ,column_name) from information^schema.columns Bypassing Filters In some situations, an application that is vulnerable to SQL injection may implement various input filters that prevent you from exploiting the flaw without restrictions. For example, the application may remove or sanitize certain characters or

…

accounts--1 drop table customers-- Retrieving Data as Numbers It is fairly common to find that no string fields within an application are vulnerable to SQL injection, because input containing single quotation marks is being handled properly. However, vulnerabilities may still exist within numeric data fields, where user input is not

…

extracting interesting information. However, the time-delay technique can also be immensely useful when performing initial probing of an application to detect SQL injection vulnerabilities. In some cases of completely blind SQL injection, where no results are returned to the browser and all errors are handled invisibly, the vulnerability itself may be hard to

…

exec xp_cmdshell 'dir' Oracle A huge number of security vulnerabilities have been found within the Oracle database software itself. If you have found a SQL injection vulnerability that enables you to perform arbitrary queries, typically you can escalate to DBA privileges by exploiting one of these vulnerabilities. Oracle contains many built

…

unjustifiable overhead on development time. Parameterized Queries Most databases and application development platforms provide APIs for handling untrusted input in a secure way, which prevents SQL injection vulnerabilities from arising. In parameterized queries (also known as prepared statements), the construction of a SQL statement containing user input is performed in two steps

…

and its safe parameterized counterpart. In the first, the user-supplied name parameter is embedded directly into a SQL statement, leaving the application vulnerable to SQL injection: //define the query structure String queryText = "select ename,sal from emp where ename = //concatenate the user-supplied name queryText += request.getParameter("name"); queryText += ; // execute

…

queries. When does this occur? 8. You have escalated privileges within an application such that you now have full administrative access. You discover a SQL injection vulnerability within a user administration function. How can you leverage this vulnerability to further advance your attack? 9. You are attacking an application that holds

…

an intricate attack surface that is always present but often overlooked. Many code reviews and penetration tests focus exclusively on common "headline" vulnerabilities such as SQL injection and cross-site scripting, because these have an easily recognizable signature and well-researched exploitation vector. By contrast, flaws in an application's logic

…

exploration of the attack surface, we decide to submit the following strings in turn within each parameter: ■ ‘ — This generates an error in some instances of SQL injection. ■ ; /bin/is — This string causes unexpected behavior in some cases of command injection. 588 Chapter 14 Automating Customized Attacks ■ /etc/passwd— This string causes

…

vulnerabilities, you submit a single quotation mark within each request parameter in turn. One of the results contains an HTTP 500 status code, indicating potential SQL injection. You check the full contents of the message, which are as follows: Microsoft VBScript runtime error '800a000d' Type mismatch: ' [string: ]' /scripts/confirmOrder.asp, line

…

compromise both that application and all others hosted within the shared environment. Many types of common vulnerability fall into this category. For example: ■ A SQL injection flaw in one application may enable an attacker to perform arbitrary SQL queries on the shared database. If database access is inadequately segregated between different

…

Defective trust relationships or vulnerabilities within these components may allow malicious customers or users to gain access to data in other applications. For example, a SQL injection vulnerability in a shared stored procedure that runs with definer privileges may result in the compromise of the entire shared database. HACK STEPS 1. Examine

…

means of compromising the environment itself and individual applications running within it. Chapter 17 ■ Attacking Application Architecture 665 3. If you can achieve command execution, SQL injection, or arbitrary file access within one application, investigate carefully whether this provides any means of escalating your attack to target other applications. 4. If you

…

server. Can you exploit this vulnerability to retrieve sensitive application data held within the database? 2. In a different case, you have discovered a SQL injection flaw that can be exploited to execute arbitrary operating system commands on the database 668 Chapter 17 Attacking Application Architecture server. Can you leverage this

…

different parameter (type) has a specific value ( 3 ). Standard fuzz testing and vulnerability scanning of the relevant request may well fail to detect the vulnerability. SQL Injection SQL injection vulnerabilities most commonly arise when various hard-coded strings are concatenated with user-controllable data to form a SQL query, which is then executed within

…

.Statement.execute ■ java.sql.Statement.executeQuery If user-controllable input is part of the string being executed as a query, it is probably vulnerable to SQL injection. For example: String username = "admin' or 1=1--"; String password = "foo"; Statement s = connection.createStatement(); s.executeQuery("SELECT * FROM users WHERE username = "' + username + "' AND

…

■ java.sql.PreparedStatement.setObject ■ j ava.sql.PreparedStatement.execute ■ java.sql.PreparedStatement.executeQuery and so on. If used as intended, these are not vulnerable to SQL injection. For example: String username = "admin' or 1=1--"; String password = "foo"; Statement s = connection.prepareStatement( "SELECT * FROM users WHERE username = s.setstring(1, username);

…

of the various Execute methods. If user-controllable input is part of the string being executed as a query, the application is probably vulnerable to SQL injection. Lor example: string username = "admin' or 1=1--"; string password = "foo"; OdbcCommand c = new OdbcCommand("SELECT * FROM users WHERE username = + username + "' AND password = "' + password + ,

…

statement containing parameter placeholders and set their values in a secure and type-safe way. If used as intended, this mechanism is not vulnerable to SQL injection. Lor example: string username = "admin' or 1=1--"; string password = "foo"; OdbcCommand c = new OdbcCommand("SELECT * FROM users WHERE username = ©username AND password = ©password",

…

The SQL statement is passed as a simple string. If user-controllable input is part of the string parameter, the application is probably vulnerable to SQL injection. Lor example: $username = "admin' or 1=1--"; $password = "foo"; $sql="SELECT * FROM users WHERE username = 1 $username' AND password = '$password'"; $result = mysql_query($sql,

…

and type-safe way: ■ mysqli->prepare ■ stmt->prepare ■ stmt->bind_param ■ stmt->execute ■ odbc_prepare If used as intended, this mechanism is not vulnerable to SQL injection. For example: $username = "admin 1 or 1=1--"; $password = "foo"; $sql = $db_connection->prepare( "SELECT * FROM users WHERE username = ? AND password = ?"); $sql->bind_param("

…

execution, 730-731 file access, 727-729 OS command execution, 731 potentially dangerous, 727-732 sockets, 732 URL redirection, 731-732 server-side redirection, 392 SQL injection, 291 versatility, 358 Apple iDisk Server, path traversal vulnerabilities, 690 application. See web application application architecture. See tiered architectures application logic flaws access controls vulnerabilities

…

source code, 710-711 SQL, 312 Comparer, Burp Suite, 167 compiled applications. See native client components concealed sequences, 213-215 concurrent logins, 250 conditional errors, SQL injection, 320-322 conjunctive queries filters, 350 LDAP injection, 352-353 CONNECT method, 682, 755 content enumerating and functionality, 74-97 hidden brute-force techniques discovering

…

468 eval function alternatives, 466 JavaScript escaping, 465-466 multiple technique combination, 466-467 VBScript, 467 VBScript and JavaScript, 467-468 simple match conditions, 350 SQL injection bypassing, 311-313 XSS anti-, 452, 748 blacklist-based, 451-452 IE, 479-481 web browsers, 479-481 financial services application logic flaws, 412-416

…

511-513 framebusting, 514-515 mobile devices, 515 preventing, 515 variations, 513 XSS attack payloads, 445-446 inference information disclosure, 626-627 search engines, 626 SQL injection, 319-324 infinite loops, 29 information disclosure error messages, 615-625 generic, 628 inference, 626-627 leaks client-side, 629 preventing, 627-629 protecting, 628

…

problems, 26 stored XSS, reflected XSS, 492-493 varieties, 21-23 input-based vulnerabilities, hacker's methodology, 824-836 function-specific, 836-841 INSERT statements SQL injection, 295-296 WHERE clause, 295 insurance, application logic flaws, 412-413 integer vulnerabilities causes, 640 detecting, 642-643 hacker's methodology, 838 overflows, 640-

…

function, 344 length limits, 471 logging keystrokes, 560 open redirection vulnerabilities, 546 port scanning, 561, 566 script code bypassing filters using VBScript and, 467-468 SQL injection, errors in, 299 third-party applications currently used, 560-561 web functionality, 61 XSS, 436-438 XSS exploits executing, in XML responses, 478-479

…

XSS, 493-495 p padding oracle attack, 626 .NET, 685-687 page id parameter, 598 parameter-based access controls, 265-266 parameterized queries provisos, 341 SQL injection, 339-341 parameters application mapping, input entry points, 99 hidden, application mapping, 96-97 URL, client-side data transmission, 121-122 parseResponse method, 585,

…

software, 695-697 website evolution and, 2 XSS, evolution, 433 SELECT NULL value, UNION operator, 306-307 SELECT queries, UNION operator, 304-305 SELECT statements SQL injection, 294-295 WHERE clause, 321 self-registration, usernames, 182,196 semantic checks, input, 25 semicolon character, batch function, 363 serialization, 70 serialized data browser extensions

…

546 uniform resource locator (URL) account activation, 184 application mapping, input entry points, 98-99 buffer overflow and length of, 639 bytecode, 140 encoding, 67 SQL injection, 300-301 truncating, 378 format, 44 HTTP requests, 40,44 open redirection vulnerabilities, 542 absolute prefix, 545-546 blocking absolute, 544-545 parameters, client-

The Art of Software Security Assessment: Identifying and Preventing Software Vulnerabilities

by Justin Schuh · 20 Nov 2006 · 2,054pp · 359,149 words

-View-Controller Problem Areas Client Visibility Client Control Page Flow Sessions Authentication Authorization and Access Control Encryption and SSL/TLS Phishing and Impersonation Common Vulnerabilities SQL Injection OS and File System Interaction XML Injection XPath Injection Cross-Site Scripting Threading Issues C/C++ Problems Harsh Realities of the Web Auditing Strategy Summary

…

primary charges of the code review process. Implementation vulnerabilities encompass several well-publicized vulnerability classes you’ve probably heard of, such as buffer overflows and SQL injection. Going back to the TELNET example, you can also find implementation vulnerabilities in specific versions of TELNET software. Some previous implementations of TELNET daemons didn

…

range of vulnerabilities lend themselves to identification based on simple pattern-matching schemes (the CP3 strategy shown in Table 4-11). Format string vulnerabilities and SQL injection are two obvious examples. In identifying these vulnerabilities, the reviewer uses a utility such as grep or findstr to generate a list of candidate points

…

in normal SQL syntax. Chapter 17, “Web Applications,” expands this coverage to address parameterized queries and stored procedures. The most common SQL-related vulnerability is SQL injection. It occurs when input is taken from request data (post variables, forms, or cookies) and concatenated into a query string issued against the database. Listing

…

8-20 is a simple example in PHP and MySQL. Listing 8-20. SQL Injection Vulnerability $username = $HTTP_POST_VARS['username']; $password = $HTTP_POST_VARS['passwd']; $query = "SELECT * FROM logintable WHERE user = '" . $username . "' AND pass = '" . $password. "'"; ... $result = mysql_query($query

…

); if(!$result) die_bad_login(); ... This query is vulnerable to SQL injection because users can supply unfiltered input for the passwd and username variables. Attackers could easily submit a string such as “bob' OR pass <> 'bob” for

…

filtering routines. Chapter 17 discusses parameterized queries as an out-of-band query method that provides a more effective method of protection. * * * The impact of SQL injection vulnerabilities varies depending on the RDBMS and database structure. Some databases limit injected queries to the scope of the initial statement; for instance, a vulnerability

…

to exploit a control that otherwise appears safe. A site-restricted control is less vulnerable to this type of attack; however, Web application vulnerabilities (such SQL injection and cross-site scripting) might allow attackers to exploit the underlying vulnerability. For this reason, Microsoft introduced the ActiveX kill bit, which is used to

…

application displays. These error messages can contain real pathnames as well as information that can be used in launching other types of attacks, such as SQL injection. * * * Auditing Tip Examine all exposed static HTML and the contents of dynamically generated HTML to make sure nothing that could facilitate an attack is exposed

…

in dynamically constructed SQL, they can run into a lot of trouble. First, numeric columns in SQL queries don’t require metacharacters to pull off SQL injection. For example, consider the following query: SELECT * FROM authtable WHERE PASSWORD = '$password' AND USERNUMBER = $usernumber Suppose that authtable.USERNUMBER is a numeric column. If users

…

restrictions on what statements can be accepted. Take a look at the following statement: "SELECT * FROM " + tableName + " WHERE value = ?" This statement is still vulnerable to SQL injection if users supply input for the tableName parameter; however, the developer might have no other choice for a dynamic table name. When the statement is

…

parameters are bound as they should be or whether the procedure is called like this: "SELECT xp_myquery('" + userData + "')" This example is vulnerable to standard SQL injection if the userData variable is attacker malleable. This mistake might seem unlikely, but it does happen often enough. The usual response from developers is that

…

other than the application you’re reviewing, so you might have to consider it a vulnerability of unknown potential risk. * * * Black Box Testing for SQL Injection Testing for SQL injection vulnerabilities from a black-box perspective isn’t difficult. The first thing you need is a proxy specifically designed to facilitate Web security testing

…

related, you can start to explore the potential ramifications of the exposure, if you’re so inclined. There are several good papers on advanced SQL injection and blind SQL injection that you should read for ideas on how to proceed. Be sure to visit these sites for more information: www.nextgenss.com, www.spidynamics

…

out where the application interacts with the database, you can often isolate every end-activity of interest. Be sure to inspect database interaction carefully for SQL-injection possibilities. • HTML display—Every Web application has to render HTML to users in response to requests. Sometimes this mechanism can be quite obfuscated, but it

…

or testing application components you don’t have code for. Be sure to read the sidebar in this chapter on testing for SQL injection vulnerabilities. If you can cause a SQL injection vulnerability and then trace it back to its cause in the source code, you can often find a mistake developers repeat in

…

body of the SOAP message does provide additional potential for data filtering. Validation against an XML schema can help prevent a variety of attacks, including SQL injection, cross-site scripting (XSS), memory manipulation, and various XML-based attacks. A schema isn’t a foolproof method, however; it might still allow harmful data

…

” is involved, with expressions performing nuanced behaviors behind the scenes to make things work smoothly. Needless to say, Perl has plenty of security pitfalls, too. SQL Injection Database access is usually done through the Perl DBI module, although other mechanisms can be used. In general, you should do a non-case-sensitive

…

less secure than any of its competitors. So, with a proper knowledge of the major PHP APIs, you can identify and diagnose potential security issues. SQL Injection Most database interaction in PHP is done through a handful of simple common interfaces. MySQL database interaction typically involves the mysql_connect() and mysql_query

…

the core aspects of the Java architecture. These patterns should help you understand the basic issues and apply this knowledge to any framework you encounter. SQL Injection Database access is usually performed with Java Database Connectivity (JDBC) API using the java.sql and javax.sql packages. A Web application usually creates a

…

Connection object, and then uses that object to create a Statement object. Statement and CallableStatement objects are often susceptible to SQL injection, whereas PreparedStatment is usually safe because it supports bound parameters. Typical vulnerable JDBC database code looks like the following: Connection conn = null; conn = getDBConnection(); /* This

…

to anyone familiar with PHP or JSP. The general structure and techniques are very similar, and the major differences are just language and platform semantics. SQL Injection Database access in ASP is typically performed using ActiveX Data Objects (ADO). You want to look for three main objects: Connection, Command, and RecordSet. The

…

users WHERE name='" & user & "'" Set rs = Server.CreateObject("ADODB.Recordset") rs.Open querystr, "DSN=testdsn" All three of these types of statements are vulnerable to SQL injection attacks when handling user supplied data, so you should look for any instances of their use. ADO also supports parameterized queries via the Command object

…

(Active Server Pages), 1113 configuration settings, 1118 cross-site scripting, 1118 file access, 1115 file inclusion, 1116-1117 inline evaluation, 1117-1118 shell invocation, 1115 SQL injection queries, 1113-1115 ASP.NET, 1118 configuration settings, 1121-1123 cross-site scripting, 1121 file access, 1119-1120 file inclusion, 1120 inline evaluation, 1121 shell

…

invocation, 1120 SQL injection queries, 1118-1119 assessments applications, 91 code, 92-93 application review phase, 93, 97-106 code auditing, 111-133 code navigation, 109-111 documentation and

…

-1113 cross-site scripting, 1110-1111 file access, 1107-1108 file inclusion, 1108-1109 inline evaluation, 1110 JSP file inclusion, 1109-1110 shell invocation, 1108 SQL injection queries, 1106-1107 threading, 1111-1112 Web server APIs versus, 1106 Java Virtual Machine (JVM), 6 JavaScript Object Notation (JSON), 1085 JavaServer Pages (JSP), 1013

…

(Format String Vulnerability in a Logging Routine), 424 8-18 (Shell Metacharacter Injection Vulnerability), 426 8-19 (Example of Dangerous Program Use), 428 8-20 (SQL Injection Vulnerability), 431 8-21 (SQL Truncation Vulnerability), 433 8-22 (Character Black-List Filter), 435 8-23 (Character White-List Filter), 436 8-24 (Metacharacter

…

), 979-983 Perl, 1093 cross-site scripting, 1096 file access, 1094 file inclusion, 1095 inline evaluation, 1095-1096 open( ) function, 429-431 shell invocation, 1095 SQL injection queries, 1093-1094 taint mode, 1096 permission bitmasks, 495-497 permissions DCOM (Distributed Component Object Model), subsystem access permissions, 733-734 Directories, UNIX, 498-499

…

, 1096-1097 configuration settings, 1104-1105 cross-site scripting, 1103 file access, 1098-1099 file inclusion, 1101 inline evaluation, 1101-1103 shell invocation, 1099, 1101 SQL injection queries, 1097-1098 php_error_docref( ) function, 332 phrack magazine, 168 physical layer, network segmentation, 84 PIDs (process IDs), UNIX, 464 pipe squatting, Windows NT

…

execution, 1067 file uploading, 1068-1069 null bytes, 1068 path traversal, 1067-1068 programmatic SSI, 1068 phishing and impersonation, 1059-1060 policies, enforcing, 36-49 SQL injection, 1061-1062 parameterized queries, 1062-1063 prepared statements, 1062 second order injection, 1064-1065 stored procedures, 1063-1064 testing for, 1065-1066 threading issues, 1074

…

, 917-919 distant spoofing, 914-917 encapsulation, 920 source routing, 920 sprintf( ) functions, 177, 389-391, 414 SQL (Structured Query Langauge) queries, metacharacters, 431-434 SQL injection, 1061-1062 ASP, 1113, 1115 ASP.NET, 1118-1119 Java servlets, 1106-1107 parameterized queries, 1062-1063 Perl, 1093-1094 PHP, 1097-1098 prepared statements

…

, 1062 second order injection, 1064-1065 stored procedures, 1063-1064 testing for, 1065-1066 SQL Injection Vulnerability listing (8-20), 431 SQL Truncation Vulnerability listing (8-21), 433 SSIs (server-side includes), 1011 SSL (Secure Sockets Layer), 71 SSL/TLS (Secure

…

, 139-147 constraint establishment, 144-145 extraneous input thinning, 145-146 multiple inputs, 143 unconstrained data types, 146-147 testing black box testing, 1079 for SQL injection, 1065-1066 SDLC (Systems Development Life Cycle), 13 Web applications, 1080-1081 text character sets, 446 metacharacters, 387, 407-408 embedded dilimiters, 408-411 filtering

…

(Active Server Pages), 1113 configuration settings, 1118 cross-site scripting, 1118 file access, 1115 file inclusion, 1116-1117 inline evaluation, 1117-1118 shell invocation, 1115 SQL injection queries, 1113, 1115 ASP.NET, 1118 configuration settings, 1121-1123 cross-site scripting, 1121 file access, 1119-1120 file inclusion, 1120 inline evaluation, 1121 shell

…

invocation, 1120 SQL injection queries, 1118-1119 auditing, 1078-1081 activities to isolate, 1079 avoiding assumptions, 1080 black box testing, 1079 enumerating functionality, 1081 goals, 1081 multiple approaches, 1080

…

-1113 cross-site scripting, 1110-1111 file access, 1107-1108 file inclusion, 1108-1109 inline evaluation, 1110 JSP file inclusion, 1109-1110 shell invocation, 1108 SQL injection queries, 1106-1107 threading, 1111-1112 Web server APIs versus, 1106 N-tier architectures, 1041, 1043 business tier, 1042-1044 client tier, 1042 data tier

…

, 1025-1026 query strings, 1023-1024 Perl, 1093 cross-site scripting, 1096 file access, 1094 file inclusion, 1095 inline evaluation, 1095-1096 shell invocation, 1095 SQL injection queries, 1093-1094 taint mode, 1096 phishing and impersonation, 1059-1060 PHP (PHP Hypertext Preprocessor), 1096-1097 configuration settings, 1104-1105 cross-site scripting, 1103

…

file access, 1098-1099 file inclusion, 1101 inline evaluation, 1101-1103 shell invocation, 1099, 1101 SQL injection queries, 1097-1098 presentation logic, 1040-1041 redundancy, 1040 security environment, 1075-1078 server-side scripting, 1013-1014 sessions, 1049-1052 security vulnerabilities, 1051-1052

…

session management, 1052-1053 session tokens, 1053-1056 SQL injection, 1061-1062 parameterized queries, 1062-1063 prepared statements, 1062 second order injection, 1064-1065 stored procedures, 1063-1064 testing for, 1065-1066 SSIs (server-side

SQL Hacks

by Andrew Cumming and Gordon Russell · 28 Nov 2006 · 696pp · 111,976 words

, and unions Stay on top of the performance of your queries and the server that runs them Avoid common SQL security pitfalls, including the dreaded SQL injection attack Let SQL Hacks serve as your toolbox for digging up and manipulating data. If you love to tinker and optimize, SQL is the perfect

…

. Tunnel into MySQL from Microsoft Access Hack 45. Process Web Server Logs Hack 46. Store Images in a Database Hack 47. Exploit an SQL Injection Vulnerability Hack 48. Prevent an SQL Injection Attack Chapter 7. Organizing Data Hack 49. Keep Track of Infrequently Changing Values Hack 50. Combine Tables Containing Different Data Hack 51

…

you have a potential syntax error, but also you may be leaving yourself open to an SQL injection attack [Hack #48]. A placeholder is a way to put a program variable into an SQL statement so that SQL injection cannot work. These are also known as bind variables and query parameters. The common way

…

date: $!"; } } Note that we in-lined the user-supplied values directly into the INSERT statement. In theory, this would have opened us up to an SQL injection attack [Hack #48]. However, the input is fully sanitized in that the regular expression guarantees that $y, $m, and $d contain only digits (\d matches

…

VALUES (TO_DATE('$v', 'dd Mon yyyy'))"; If your dates are coming from an untrusted source, you should still check the pattern to guard against SQL injection attacks: if ($v !~ /^\d+ \w\w\w \d\d\d\d$/) { warn "Injection attack."; } If you were using XSLT, you might want to use code

…

web scraping. Despite these benefits, however, it can be dangerous to use SQL in online applications. This chapter includes advice on how to exploit an SQL injection vulnerability and how to avoid becoming a victim of such an attack. Hack 41. Copy Web Pages into a Table You can copy data from

…

. The pnm library used here contains many options for changing images; you can convert formats, crop, and scale. Hack 47. Exploit an SQL Injection Vulnerability To guard against an SQL injection attack you need to know the dangers. If you have a name such as O'Reilly, you are probably quite used to seeing

…

directly into an SQL statement. You can also set up the system to hide the error more discreetly, so a system may be vulnerable to SQL injection even though it does not report an error like this. In this case, the program to build the SQL query uses the variable entered on

…

to choose the magic string ' OR ''=' as both your name and your password, as shown in Figure 6-13. Figure 6-13. Gaining access with SQL injection The odd-looking WHERE condition will always return true in MySQL, SQL Server, PostgreSQL, and Access: mysql> SELECT name FROM users -> WHERE name='' OR ''='' AND

…

safe. (Highly secure systems such as banking sites will limit the number of password guesses you can have on a particular account name.) With the SQL injection attack shown here, you have a doorman who is just as taciturn; he still answers only "yes" or "no." But now he will answer any

…

http://sqlzoo.net/hack. 6.7.7. See Also "Prevent an SQL Injection Attack" [Hack #48] Hack 48. Prevent an SQL Injection Attack You can take steps to prevent an SQL injection attack. You can also minimize the consequences of an SQL injection attack. Preventing an SQL injection attack is simply a matter of escaping values that come from web

…

O''Reilly''s. Each single quote becomes two single quotes: SELECT name FROM users WHERE name='O''Reilly' AND passwd='tiger' If someone attempts an SQL injection attack [Hack #47] he could enter the magic string ' OR ''=' as both the username and the password. If you handle the input properly the result

…

is composed of digits only. If you don't check that, the numeric input can easily be used to launch an SQL injection attack. Even if you are not concerned about SQL injection, you should check the data format before putting it into an SQL statement because a runtime error generated by a type

…

-18. Listing variables, including hidden variables Figure 6-19. Listing cookies associated with a page 6.8.7. Exploits Using Hidden Variables and Cookies An SQL injection attack based on hidden variables is not any more difficult than one using visible components, such as textboxes or a password. You can't do

…

Tara Calishain (O'Reilly) for information on how to do this. 6.8.8. Restrict the Rights of the SQL Account As well as preventing SQL injection attacks by escaping, it is sensible to limit the privileges of the account that you use to access your SQL system. It is good practice

…

to ensure that the account being used has exactly the right permissions required and no more. 6.8.9. Don't Overreact The basic SQL injection attack will not reveal your SQL user password or your operating system passwords. Only data in the database is exposed. It may be possible for

…

chosen a sound password, that does not constitute a threat. You should not underestimate the power of an SQL injection attack, but neither should you overestimate it. My site, http://sqlzoo.net, is vulnerable to SQL injection attacks by its very nature, and it has been running fairly smoothly for several years. I can

…

't guard against SQL injection because I allow users to execute any SQL command they want against several different SQL engines. I use SQL GRANT and REVOKE commands to hide

…

, and I deny write permission to the tables that I want users to see but not to change. 6.8.10. See Also "Exploit an SQL Injection Vulnerability" [Hack #47] "Implement Application-Level Accounts" [Hack #90] "Find and Stop Long-Running Queries" [Hack #98] Chapter 7. Organizing Data When representing complex data

…

once. But thats ok!</p>'; print '<p>Your account has been created, password '.$pass.'</p>'; } elseif ($found == 0) { if (!preg_match("/^\d+$/", $_POST['random'])){ print "SQL Injection Attack Alert."; exit(1); } $sql = sprintf("INSERT INTO usertable VALUES('%s','%s',%d)", mysql_real_escape_string($_POST['username']),$pass ,$_POST['random']); $cursor = mysql_query

…

) or die(mysql_error( )); $who = mysql_fetch_array($cursor,MYSQL_ASSOC); if ($who) { print "Welcome ".$who{nickname}."\n"; } ?> 11.1.6. See Also "Exploit an SQL Injection Vulnerability" [Hack #47] PHP Hacks, by Jack D. Herrington (O'Reilly), includes Hack #58 on hashing passwords and Hack #59 on fixing a system that

…

: Line 4 The SQL statement is assembled using JavaScript string functions. Note that the escaping of the quote does not protect this application from an SQL injection attack, but it does prevent an SQL syntax error when querying the country Cote d'Ivoire. Line 7 phpMyAdmin encodes the SQL and other parameters

…

in SQL Server % (percent sign) modulus operator wildcard character & (ampersand) append operator SQL files imported into Oracle ' (apostrophe), escaping in SQL ' (quotes, single) ' OR ''=' and SQL injection attacks escaping XSLT transformation handling in Unicode output (semicolon) replacing GO instructions in SQL Server separating statements * (asterisk) wildcard 2nd + (string concatenation) operator 2nd 3rd

…

] [J] [K] [L] [M] [N] [O] [P] [Q] [R] [S] [T] [U] [V] [W] [X] [Y] hash directory structure hashing algorithms hashing passwords hidden variables SQL injection attacks based on history tables Oracle PostgreSQL processing SQL Server HTML fields, size limits on hung transactions Index [SYMBOL] [A] [B] [C] [D] [E] [F

…

] [U] [V] [W] [X] [Y] page rank calculations parameters personalized creating list of defining storing in database parameters, query partial index matching passwords accessing with SQL injection easypass generator tool hashing Oracle recorded in plain text specifying with command-line switches strength of pattern-matching FULLTEXT, MySQL solving crossword puzzle using SQL

…

conventions for different databases DDL (Data Definition Language) running from command line Access DB2 MySQL Oracle pipes PostgreSQL SQL Server switches solving a crossword puzzle SQL injection attacks exploiting vulnerability asking for strings asking yes/no questions getting metadata questions and injection phrases preventing or minimizing consequences avoiding overreaction escaping in C

…

. || operator concatentating Access converting dates to MySQL SQL Server converting dates to in SQL Server converting to dates Oracle escaping special characters 2nd getting with SQL injection numbers sorted as UPDATE statements strings command (Unix) stylesheets, XSLT gross.xsl (example) subqueries aggregate, converting to JOINs converting to JOINs steps in process correlated

…

-level hashing passwords storing user information creating MySQL Oracle PostgreSQL SQL Server creating database accounts for shell accounts user interface controls userid usernames accessing with SQL injection current username email address as specifying with command-line switches UUID UUID (universally unique identifier) Index [SYMBOL] [A] [B] [C] [D] [E] [F] [G] [H

…

changes VALUES list (INSERT ... VALUES) SELECT statement VARBINARY datatype (SQL Server) VARCHAR datatype character varying (PostgreSQL) varchar size variable binding variables bind variable (placeholder) hidden, SQL injection attacks and temporary version number of database system VIEWs calendar creating for complicated UPDATEs ordered replacing a table with turning derived table into user permissions

…

copying web pages into a table badly formed web page extracting data from XHTML document running the hack XSLT processing XSLT stylesheet (gross.xsl) exploiting SQL injection vulnerability asking yes/no questions getting metadata getting strings questions and their injection phrase generating SVG images from SQL vendor-specific XML features processing web

…

server logs checking for broken links investigating user actions queries Webalizer tool, using SQL injection attack, preventing avoiding overreaction escaping in C# escaping in Java escaping in Perl escaping in PHP hidden variables and cookies JavaScript validation nonstring data restricting

Building Secure and Reliable Systems: Best Practices for Designing, Implementing, and Maintaining Systems

by Heather Adkins, Betsy Beyer, Paul Blankinship, Ana Oprea, Piotr Lewandowski and Adam Stubblefield · 29 Mar 2020 · 1,380pp · 190,710 words

Material Data Validation Conclusion 12. Writing Code Frameworks to Enforce Security and Reliability Benefits of Using Frameworks Example: Framework for RPC Backends Common Security Vulnerabilities SQL Injection Vulnerabilities: TrustedSqlString Preventing XSS: SafeHtml Lessons for Evaluating and Building Frameworks Simple, Safe, Reliable Libraries for Common Tasks Rollout Strategy Simplicity Leads to Secure and

…

behavior not covered by testing or in-depth code review will harbor bugs. It’s telling that well-understood common classes of software vulnerabilities like SQL injection, cross-site scripting (XSS), and buffer overflows have maintained leading positions in “top vulnerability” lists.2 Absence of evidence is not evidence of absence. On

…

OS kernel—are part of the TCB for the security property we want to provide: enforcement of the user data access policy. Risks include a SQL injection vulnerability in the catalog search code allowing an attacker to obtain sensitive user data, like names or shipping addresses, or a remote code execution vulnerability

…

-case scenario (see Part IV). You can use types to reason about more complex properties, too. For example, preventing injection vulnerabilities (such as XSS or SQL injection) depends on appropriately validating or encoding any external and potentially malicious inputs, at some point between when the inputs are received and when they’re

…

. For example, when using a SQL query API that accepts only values of type SafeSql (instead of String), you don’t have to worry about SQL injection vulnerabilities, since all values of type SafeSql are safe to use as a SQL query. Sinks may also accept values of basic types (such as

…

appropriate, to ensure at runtime that the value is safe. With this design, you can support an assertion that an entire application is free of SQL injection or XSS vulnerabilities based solely on understanding the implementations of the types and the type-safe sink APIs. You don’t need to understand or

…

Reliability As discussed in Chapter 6, the security and reliability of an application rely on domain-specific invariants. For example, an application is secure against SQL injection attacks if all of its database queries consist only of developer-controlled code, with external inputs supplied via query parameter bindings. A web application can

…

you discover a new vulnerability, you can address it in one place (or a few) instead of throughout the codebase. To provide one concrete example: SQL injection (SQLI) holds the top spot on both the OWASP and SANS lists of common security vulnerabilities. In our experience, when you use a hardened data

…

library such as TrustedSqlString (see “SQL Injection Vulnerabilities: TrustedSqlString”), these types of vulnerabilities become a nonissue. Types make these assumptions explicit, and are automatically enforced by the compiler. Benefits of Using Frameworks

…

mitigate each at a framework level. Table 12-1. Top 10 most common vulnerability risks according to OWASP OWASP top 10 vulnerability Framework hardening measures [SQL] Injection TrustedSQLString (see the following section). Broken authentication Require authentication using a well-tested mechanism like OAuth before routing a request to the application. (See “Example

…

-level library. See the logging interceptor described in the previous section for an example. a See the XXE Prevention Cheat Sheet for more information. SQL Injection Vulnerabilities: TrustedSqlString SQL injection is a common class of security vulnerability. When untrustworthy string fragments are inserted into a SQL query, attackers can potentially inject database commands. The

…

. The result could reset the password hash of a different user—in this case, the admin account. SQL injection vulnerabilities can be harder to spot in more complicated codebases. The database engine can help you prevent SQL injection vulnerabilities by providing bound parameters and prepared statements: Query q = db.createQuery( "UPDATE users SET pw

…

Frameworks” for other benefits of reviewed exemptions. Preventing XSS: SafeHtml The type-based safety approach we described in the previous section is not specific to SQL injection. Google uses a more complex version of the same design to reduce cross-site scripting vulnerabilities in web applications.3 At their core, XSS vulnerabilities

…

guarantees. If you see repeated similar requests for a use case, you can support that feature in the inherently safe library. As we observed in “SQL Injection Vulnerabilities: TrustedSqlString”, the review load is usually manageable. Because the volume of review requests is relatively small, security reviewers can look at the code in

…

fraction of callers use the deprecated string-based API, you can manually clean up the remainder. At that point, your code will be immune to SQL injection by design. Legacy conversions It is also often worthwhile to consolidate all of your exemption mechanisms into a single function that is obvious in the

…

can introduce automation for continuous builds, sanitizers, vulnerability discovery, and testing. Application frameworks and common libraries can help developers avoid common vulnerabilities like XSS and SQL injection. Guidance around choosing the appropriate programming languages or programming language features can help avoid memory corruption errors. This kind of automatic security aims to reduce

…

Motivations Space Shuttle Columbia incident, Culture of Inevitably Spanner, The Build or Buy Decision, Example: Temporary Files-Example: Temporary Files SQL injection (SQLI), Frameworks to Enforce Security and Reliability, SQL Injection Vulnerabilities: TrustedSqlString-SQL Injection Vulnerabilities: TrustedSqlString SRE (see Site Reliability Engineer/Engineering) SRE Security Exchange Program, Build Empathy SSL key rotation, Credential and Secret Rotation

…

base (TCB), Security Boundaries-TCBs and understandabilitysmall TCBs and strong security boundaries, Small TCBs and strong security boundaries understandability and, TCBs and understandability TrustedSqlString, SQL Injection Vulnerabilities: TrustedSqlString-SQL Injection Vulnerabilities: TrustedSqlString TTPs (tactics, techniques, and procedures), Tactics, Techniques, and Procedures, Scoping the Recovery two-factor authentication (2FA)3FA vs., Three-Factor Authorization (3FA

Engineering Security

by Peter Gutmann

talk about the things that it doesn’t contain. You’ll notice that there’s very little on secure coding practices, problems like buffer overflows, SQL injection, cross-site scripting, and similar issues. That’s because there are already, quite literally, shelves full of books that cover these areas, in some cases

…

coming from a trusted source, effectively laundering the attack data via an intermediary. Figure 75: Threat tunnelling via SQL injection is everywhere Another example of threat tunnelling occurs with second-order SQL injection. In standard SQL injection the attacker submits a malicious string to a database back-end (for example via a carefully-crafted HTTP query

…

’s just that we currently have very little experience in exploiting them and, conversely, almost no experience in defending them [163]). The standard defence against SQL injection is to use parameterised queries that separate the SQL command(s) sent to the database from the data items that they refer to. Second-order

…

SQL injection bypasses this by storing the attack string in the database (which is immune at this level, since it’s using parameterised queries) and then triggering

…

regarded as potentially tainted and so may not be subject to the careful handling via parameterised queries that it was originally [164]. This kind of SQL injection is really hard to detect because the act of laundering it via the database has removed any obvious connection from the original, tainted source to

…

the data that’s currently being acted on. Although SQL injection is the canonical example of this type of data laundering, another example of this that comes with a nice DFD-based threat analysis is the

…

new properties not present in the original, with the resulting combination no longer being secure. Examples of this were the Firefox URL and second-order SQL injection problems mentioned in “Threat Modelling with Data Flow Diagrams” on page 263. Another example occurs when you connect a PC with a personal firewall to

…

/en-us/library/cc722487.aspx. [163] “Weapons of Mass Assignment”, Patrick McKenzie, Communications of the ACM, Vol.54, No.5 (May 2011), p.54. [164] “SQL Injection Attacks and Defense”, Justin Clarke, Rodrigo Alvarez, Dave Hartley, Joseph Hemler, Alexander Kornbrust, Haroon Meer, Gary OlearySteele, Alberto Revelli, Marco Slaviero and Dafydd Stuttard, Syngress

…

applications using them [48]. (Randomisation of data can help defend against all sorts of other attacks as well. For example you can protect yourself against SQL injection attacks by replacing SQL keywords with random (but fixed) strings that an intermediate layer that sits above the database then maps back to proper SQL

…

the process isn’t quite as straightforward for the bad guys. For example attackers don’t have complete control over the output of an XSS, SQL injection, or similar injection attack, resulting in malformed strings, repeated or out-of-place tags, and other patterns that indicate that something untoward is going on

…

denial-of-service via MurmurHash algorithm collision”, oCERT Advisory 2012-001, 23 November 2012, http://www.ocert.org/advisories/ocert-2012-001.html. “SQLrand: Preventing SQL Injection Attacks”, Stephen Boyd and Angelos Keromytis, Proceedings of the 2nd Applied Cryptography and Network Security (ACNS) Conference, Springer-Verlag LNCS No.3089, June 2004, p

…

. There are many other ways to perform this type of spoofing, for example through the creative use of escape characters in URLs, a variation of SQL injection that allows an attacker to specify content that’s seen by the user when the URL is displayed but ignored when it’s accessed [91

…

string “Do you want to block the installation of this unsigned application” coming from the malware. A variation of this involves the textual equivalent of SQL injection in which a filename of “app_name’ is safe to open. ‘app_name” turns the message “‘app_name’ is an application that was downloaded from

…

authentication data in SQL databases running on the same machine as the web service itself, from which it can often be easily retrieved through an SQL injection attack or similar exploitation of AJAX loopholes. A quick way of detecting sites that practice poor password management of this kind is to look for

…

additional benefit in that it makes the database tamper-resistant. An attacker who can inject their own credentials into your database (for example through an SQL injection exploit) can bypass even sophisticated authentication systems like ones based on smart cards and similar encrypted authentication tokens. If the credentials in the database are

The Nature of Software Development: Keep It Simple, Make It Valuable, Build It Piece by Piece

by Ron Jeffries · 14 Aug 2015 · 444pp · 118,393 words

on the Net ever again!) Injection “Injection” is an attack on a parser or interpreter that relies on user-supplied input. The classic example is SQL injection, where ordinary user input is crafted to turn one SQL statement into more than one. This is the “Little Bobby Tables” attack.[55] In that

…

, a school administrator asks if the character’s son is really named “Robert’); DROP TABLE Students;- -”. While an odd moniker, Bobby Tables illustrates a typical SQL injection attack. If the application concatenates strings to make its query, then the database will see an early sequence of ’); to terminate whatever query the application

…

a comment so the database will ignore the remainder of the input (whatever was left over from the original query). There’s no excuse for SQL injections in this day and age. It happens when code bashes strings together to make queries. But every SQL library allows the use of placeholders in

…

query = "SELECT * FROM STUDENT WHERE NAME = ?;" PreparedStatement stmt = connection.prepareStatement(query); stmt.setString(1, name); ResultSet results = stmt.executeQuery(); For more defenses, see the OWASP SQL Injection Prevention Cheat Sheet.[56] Other databases are also vulnerable to injection attacks. In general, if a service builds queries by bashing strings together and any

…

is not to parse the XML yourself with regular expressions! Just use the OWASP XXE Prevention Cheat Sheet to configure your parser for safety.[57] SQL injection and XXE are just two of the many ways user input can corrupt your service. Format string attacks, “Eval injection,” XPATH injection...Injection attacks have

…

[53] http://www.outsideonline.com/2186526/nut-job [54] http://www.owasp.org [55] http://bobby-tables.com [56] http://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet [57] https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet [58] http://www.owasp.org/index.php/OWASP

Fancy Bear Goes Phishing: The Dark History of the Information Age, in Five Extraordinary Hacks

by Scott J. Shapiro · 523pp · 154,042 words

to know her phone number. Since Paris Hilton had many friends, hackers could easily have learned of her personal phone number from some mutual contact. SQL Injection Still, the leading theory in the security community was not that hackers had exploited information about Paris Hilton’s Chihuahua. T-Mobile’s entire customer

…

base had been compromised the previous year by a twenty-one-year-old hacker named Nicholas Jacobsen. Using a so-called SQL injection, Jacobsen compromised the accounts of 16 million T-Mobile customers. One of those customers was Peter Cavicchia, a Secret Service cybercrime agent in New York

…

password, Jacobsen had access to a treasure trove of highly sensitive communications of the Secret Service and its ongoing criminal investigations. To understand how an SQL injection works, and how it could have been used to hack Hilton’s data, let’s first talk about SQL. SQL stands for Structured Query Language

…

every record, and all of the associated information, in the entire database. A hacker can retrieve all the information in a database by using an SQL injection. Instead of submitting data, the hacker injects code. In our example, Tom doesn’t submit his username: Tom (data); he injects a partial SQL query

…

original code to produce a result that the original coder had not intended. SQL injections can be devastating. Jacobsen had used an SQL injection to gain access to the entire database of T-Mobile customers. But while dangerous and quite common, SQL injections are easy to prevent. Web application developers should “sanitize” inputs. Instead of accepting

…

of social engineering—tricking employees to release private information—and exploiting vulnerabilities in the company’s website. It didn’t require anything fancy like an SQL injection. It wasn’t black magic. As we will see, it was child’s play. The Invisible Code Paris Whitney Hilton was born on February 17

…

time) on October 21. Exactly a year earlier, a fifteen-year-old boy named Aaron Sterritt, hacker handle Vamp, from Larne, Northern Ireland, used an SQL injection and hacked the British telecom TalkTalk. Because British police suspected that Sterritt might also be involved in the Dyn DDoS, they questioned him, but did

…

Man The universal feature shared by the cybercriminals in this book is that they have engaged in cyber-dependent crime: unauthorized access, release of viruses, SQL injections, token stealing, DDoS-ing, and so forth. Moreover, they started young. Cameron LaCroix was ten years old, Robert Morris twelve, Yarden Bidani and Itay Huri

…

12, 2005, https://www.theregister.com/2005/01/12/ hacker_penetrates_t-mobile/. deliver its file to my browser: kingthorin, “SQL Injection,” OWASP, accessed June 8, 2021, owasp.org/www-community/attacks/SQL_Injection. simple example: Example from Peter Yaworski, Real-World Bug Hunting: A Field Guide to Web Hacking (San Francisco: No Starch

…

maid”; financial damages from; history; IP addresses and; kernels; lingo; for public interest; Russian history and education in; social stigma around; solutionism and; speculative execution; SQL injections and; white-hat/ethical; see also specific topics HAL (fictional computer) Harvard University Hawkins, Adrian heuristics: Affect; Availability; dual-process theories and; Loss Aversion; nudging

…

tactics; public opinion of social inequities software development, see programming and software development SolarWinds supply-chain attack Solomon, Alan solutionism Spafford, Eugene speculative execution attacks SQL injections Stellarwind Sterritt, Aaron Stimson, Henry Stone, Roger stressor services Stuxnet Sudduth, Andy Sunstein, Cass supply-chain attacks surveillance; capitalism; government; see also cyberespionage; espionage Swimmer

We Are Anonymous: Inside the Hacker World of LulzSec, Anonymous, and the Global Cyber Insurgency

by Parmy Olson · 5 Jun 2012 · 478pp · 149,810 words

. Jackpot. Though its job was to help other companies protect themselves from cyber attacks, HBGary Federal itself was vulnerable to a simple attack method called SQL injection, which targeted databases. Databases were one of the many key technologies powering the Internet. They stored passwords, corporate e-mails, and a wide variety of

…

types of data. The use of Structured Query Language (SQL, commonly mispronounced “sequel”) was a popular way to retrieve and manipulate the information in databases. SQL injection worked by “injecting” SQL commands into the server that hosted the site to retrieve information that should be hidden, essentially using the language against itself

…

the search bar or text box that represented a weak entry point. This could be devastating to a company. If DDoSing meant a sucker punch, SQL injection was secretly removing someone’s vital organs while they slept. The language it required, a series of symbols and key words like “SELECT,” “NULL,” and

…

how to bypass them. Soon she was immersing herself in scripting languages like Perl, Python, and PHP, learning how to attack Web databases with the SQL injection method. It was mostly harmless, but by the time she was fourteen, Kayla claimed she was writing scripts that could automate cyber attacks. It had

…

she had picked up from her dad and online research, she claimed she hacked into one forum site and deleted much of its contents using SQL injection. It was an attack unlike any the regulars had seen before. “Wow you’re only 14 and you can do this?” Kayla recalled one of

…

found “a bunch of” XSS vulnerabilities on Scientology.org. XSS, or cross-site scripting, was said to be the second most common hacking technique after SQL injection. “I’LL TRY TO MAKE AN EXPLOIT OUT OF IT.” The address of the IRC channel kept being spammed. There was a sense the thread

…

one in the website CopyrightAlliance.org. About a week after the DDoS attack on Aiplex, the hackers in Tflow’s group carried out the first SQL injection attack in their campaign, possibly one of the first to be committed under the banner of Anonymous. They hacked into the CopyrightAlliance.org Web server

…

these people not all from the same group, more often than not they weren’t even hackers and didn’t know the first thing about SQL injection. They were armed mostly with an ability to coordinate others and with access to free software tools they could get on 4chan’s /rs/ board

…

trained. Kayla was a quick learner and liked to teach other hackers tips and tricks. She was patient but pushy. One student remembered Kayla teaching SQL injection by first explaining the theory and then telling the hackers to do it over and over again using different approaches for two days straight. “It

…

was hell on your mind, but it worked,” the student said. Kayla understood the many complex layers to methods like SQL injection, a depth of knowledge that allowed her to exploit vulnerabilities that other hackers could not. On tr0lll, Kayla and her friends discussed the intricacies of

…

Nations “vulns.” This, for example: http://www.un.org.al/subindex.php?faqe=details&id=57 was a United Nations server that was vulnerable to SQL injection, specifically subindex.php. And this page at the time: http://www.un.org.al/subindex.php?faqe=details&id=57%27 would throw an SQL

…

had gone to great lengths to access the company’s e-mails, when actually the process had not been difficult at all. It was an SQL injection, the simplest of attacks. Ted Vera’s password, satcom31, had been easy to crack. Only Hoglund had used a random string of numbers and letters

…

.org/unicorns-dragons-and-chix-with-swords. Topiary wanted to respond to some of the group’s detractors who were accusing it of using simple SQL injection techniques to get into PBS. He wrote up a note explaining how the hack was done and published it to Pastebin with a tweet saying

…

up tips from the others. If they used hacker terminology he didn’t understand, he would Google it: jargon like virtual machines, hacking methods like SQL injection, various types of attack vectors and programming terminology. If he hit a brick wall, they could give him a quick summary. Soon there were eleven

…

franchise. To his astonishment, there was a gaping hole in the innocuous Ghostbusters page that left the network wide open, once again, to a simple SQL injection attack. “Hey guys, we need to dump all this now,” he said excitedly. He rushed to map out the area and gather everyone together so

…

much in terms of “money, time and resources.” All told, the operation had cost $0, had been carried out with the relatively simple method of SQL injection, and was made worse because an admin’s cracked password, “st33r!NG,” had been reused to get administrative access to the Infragard site itself. As

…

cyber security industry were thinking: “So why do we like LulzSec? ‘I told you so.’ That’s why.” LulzSec’s flagrant use of often simple SQL injection methods had brought home how vulnerable people’s private data was, and done it more compellingly than any IT security’s marketing campaign had. Cisco

…

its creation by what are believed to be Iranian programmers, Havij had become, by the summer of 2012, one of the most popular tools for SQL injection attacks. The program was so simple that one Imperva executive taught his eleven-year-old how to use it in fifteen minutes. The free-to

…

, then Tflow. SQL reads like a stream of formulas. An example is: “Select creditcard from person where name=SMITH.” If someone were to perform an SQL injection attack, they might inject code saying, “Select a from b where a=SMITH.” How did the hackers know that Barr was CogAnon? Topiary later explained

…

the January 2008 Globe and Mail article “Scientology vs. the Internet, part XVII.” The detail that XSS is the second most common hacking technique after SQL injection is sourced from the Web Hacking Incident Database (WHID) of 2011, an online database that tracks media-reported security incidents and is led by Ryan

…

from various online news reports, while the notion that the campaign “went into hiatus” comes from testimony by Tflow and Topiary. Tflow claimed that the SQL injection attack on copyrightalliance.org was the first of its kind under the banner of Anonymous, though it is possible that similar attacks were carried out

…

DigitalGangster.com domains to point at their own servers. My own observation of DigitalGangsters.com showed posts advertising jobs that required hacking into websites via SQL injection, stealing databases of names and e-mail addresses, or just stealing addresses and sending them to spammers. A database with passwords was worth more, since

…

of Sony Japan. It failed to cause a stir, since Topiary had simply pasted specific Web addresses that were vulnerable to a hack by simple SQL injection. One of them, for example, looked like this: http://www.sonymusic.co.jp/bv/cro-magnons/track.php?item=7419 (no longer available). Topiary announced

…

of lying to or speaking to a person in the guise of a false identity, or under false pretenses, in order to weed out information. SQL injection: Also known as SQLi and sometimes pronounced “sequel injection,” this term refers to a method of gaining access to a vulnerable Web database by inserting

Python Web Penetration Testing Cookbook

by Cameron Buchanan, Terry Ip, Andrew Mabbitt, Benjamin May and Dave Mound · 28 Jun 2015 · 224pp · 45,431 words

-site scripting Getting ready How to do it… How it works… See also Shellshock checking Getting ready How to do it… How it works… 4. SQL Injection Introduction Checking jitter How to do it… How it works… There's more… Identifying URL-based SQLi How to do it… How it works… There

…

's more… Exploiting Boolean SQLi How to do it… How it works… There's more… Exploiting Blind SQL Injection How to do it… How it works… There's more… Encoding payloads How to do it… How it works… There's more… 5. Web Header

…

and validating potential credentials. Chapter 3, Vulnerability Identification, covers recipes based on identifying potential vulnerabilities on websites, such as Cross-site scripting, SQL Injection, and outdated plugins. Chapter 4, SQL Injection, covers how to create scripts that target everyone's favorite web application vulnerability. Chapter 5, Web Header Manipulation, covers scripts that focus specifically

…

hacking community. It focuses around sending a large amount of invalid content to a page and recording the results. It is the reprobates version of SQL Injection and arguably the base form of penetration testing (though you LOIC users out there are probably the base form of life form). We will create

…

attack string against them, we launch our request. If successful, the message should appear in our logs: req = requests.post(url, headers=headers) Chapter 4. SQL Injection In this chapter, we will cover the following topics: Checking jitter Identifying URL-based SQLi Exploiting Boolean SQLi Exploiting Blind SQLi Encoding payloads Introduction

…

SQL Injection is the loud and noisy attack that beats you over the head in every tech-related media provider you see. It is one of the

…

most common and most devastating attacks of recent history and continues to thrive in new installations. This chapter focuses on both performing and supporting SQL Injection attacks. We will create scripts that encode attack strings, perform attacks, and time normal actions to normalize attack times. Checking jitter The only difficult thing

…

about performing time-based SQL Injections is that plague of gamers everywhere, lag. A human can easily sit down and account for lag mentally, taking a string of returned values, and

…

) Identifying URL-based SQLi So, we've looked at fuzzing before for XSS and error messages. This time, we're doing something similar but with SQL Injection, instead. The crux of any SQLi starts with a single quotation mark, tick, or apostrophe, depending on your personal choice of word. We throw a

…

URL targeted and check the response to see what version of SQL is running if successful. We will create a script that sends the basic SQL Injection string to our targeted URL, record the output, and compare to known phrases in error messages to identify the underlying system. How to do it

…

(answer) There's more… Potentially, this script could be altered to handle iterating through tables and recovering multiple values through better crafted SQL Injection strings. Ultimately, this provides a base plate, as with the later Blind SQL Injection script, for developing more complicated and impressive scripts to handle challenging tasks. See the Exploiting Blind

…

SQL Injection script for an advanced implementation of these concepts. Exploiting Blind SQL Injection Sometimes, life hands you lemons; blind SQL Injection points are some of those lemons. When you're

…

reasonably sure you've found an SQL Injection vulnerability but there are no errors and you can't

…

line: print line.strip(“<li>”) if “wrong” not in submit.text: print “possible success!” #subprocess.Popen([“beep”], shell=True) Encoding payloads One method of halting SQL Injection is filtering through either server side text manipulation or Web App Firewalls (WAFs). These systems target specific phrases commonly associated with attacks such as SELECT

…

a Bcrypt hash, How to do it…, How it works… about / Generating a Bcrypt hash BeautifulSoup library / There’s more… blind SQL Injectionexploiting / Exploiting Blind SQL Injection, How it works… Boolean SQLiexploiting / Exploiting Boolean SQLi, How it works…, There's more… brute forcing loginthrough authorization header / Brute forcing login through the Authorization

Hands-On RESTful API Design Patterns and Best Practices

by Harihara Subramanian · 31 Jan 2019 · 422pp · 86,414 words

injection Injects Lightweight Directory Access Protocol (LDAP) statements and executes them Modifies contents of LDAP tree and grants illegitimate permissions, privilege escalations, and bypass authentication SQL injection Injects fabricated SQL commands to exercise database read or modify data Leads to data loss, data theft, data integrity loss, DoS, and can even result

…

in full system compromise due to advanced variations of SQL injections XPath injection Executes fabricated XPath queries by injecting false data into an application Results in information disclosure and bypass authentication Insecure direct object references Insecure

…

of design and development is to keep APIs as simple as possible, as complexity may lead to less coverage and vulnerability. Poor user input validation, SQL injection loopholes, and buffer overflows are a few other causes. Chapter 2, Design Strategy, Guidelines, and Best Practices, discussed various aspects of design strategies and RESTful

…

are the process of simulating cyber attack against a the system or API to expose/determine exploitable vulnerabilities such as intra-network loopholes, XSS attacks, SQL injections, and code-injection attacks. Pen tests asses the threat vector from an external standpoint, such as supported functions, available resources, and the API's internal

…

and dynamic analysis is the focus of the Scanning phase. Gaining access This involves attempting to uncover API vulnerabilities with application attacks such as XSS, SQL injections, code injections, and backdoors. Once those vulnerabilities are uncovered, exploiting them with privilege escalations, data stealing methods, and traffic interceptions are part of the Gaining

…

logical decisions (true/false) inside the code The tests execute syntax checking, and so find typographical errors that are critical to finding code injections and SQL injection attacks The tests find design errors caused by a mismatch of the logical flow of the program and the actual execution (design for intent) There

Ajax: The Definitive Guide

by Anthony T. Holdener · 25 Jan 2008 · 982pp · 221,145 words

Clojure Programming

by Chas Emerick, Brian Carper and Christophe Grand · 15 Aug 2011 · 999pp · 194,942 words

Essential SQLAlchemy

by Rick Copeland · 4 Jun 2008 · 357pp · 63,071 words

Django Book

by Matt Behrens · 24 Jan 2015

Real World Haskell

by Bryan O'Sullivan, John Goerzen, Donald Stewart and Donald Bruce Stewart · 2 Dec 2008 · 1,065pp · 229,099 words

The Art of SQL

by Stephane Faroult and Peter Robson · 2 Mar 2006 · 480pp · 122,663 words

Beautiful security

by Andy Oram and John Viega · 15 Dec 2009 · 302pp · 82,233 words

The TypeScript Workshop: A Practical Guide to Confident, Effective TypeScript Programming

by Ben Grynhaus, Jordan Hudgens, Rayon Hunte, Matthew Thomas Morgan and Wekoslav Stefanovski · 28 Jul 2021 · 739pp · 174,990 words

Learning Android

by Marko Gargenta · 11 Mar 2011 · 378pp · 67,804 words

Programming Android

by Zigurd Mednieks, Laird Dornin, G. Blake Meike and Masumi Nakamura · 15 Jul 2011

Masterminds of Programming: Conversations With the Creators of Major Programming Languages

by Federico Biancuzzi and Shane Warden · 21 Mar 2009 · 496pp · 174,084 words

Bad Data Handbook

by Q. Ethan McCallum · 14 Nov 2012 · 398pp · 86,855 words

The Joy of Clojure

by Michael Fogus and Chris Houser · 28 Nov 2010 · 706pp · 120,784 words

Solr 1.4 Enterprise Search Server

by David Smiley and Eric Pugh · 15 Nov 2009 · 648pp · 108,814 words

The Debian Administrator's Handbook, Debian Wheezy From Discovery to Mastery

by Raphaal Hertzog and Roland Mas · 24 Dec 2013 · 678pp · 159,840 words

Apache Solr 3 Enterprise Search Server

by Unknown · 13 Jan 2012 · 470pp · 109,589 words

Designing Data-Intensive Applications: The Big Ideas Behind Reliable, Scalable, and Maintainable Systems

by Martin Kleppmann · 16 Mar 2017 · 1,237pp · 227,370 words

Kingpin: How One Hacker Took Over the Billion-Dollar Cybercrime Underground

by Kevin Poulsen · 22 Feb 2011 · 264pp · 79,589 words

Python Web Development With Django

by Jeff Forcier

PostgreSQL: Up and Running, 3rd Edition

by Unknown

PostGIS in Action

by Regina O. Obe and Leo S. Hsu · 2 May 2015

Designing Data-Intensive Applications: The Big Ideas Behind Reliable, Scalable, and Maintainable Systems

by Martin Kleppmann · 17 Apr 2017

PostGIS in Action, 2nd Edition

by Regina O. Obe and Leo S. Hsu · 2 May 2015

Essential Sqlalchemy

by Jason Myers and Rick Copeland · 27 Nov 2015 · 458pp · 46,761 words

Advanced Software Testing—Vol. 3, 2nd Edition

by Jamie L. Mitchell and Rex Black · 15 Feb 2015

Code Complete (Developer Best Practices)

by Steve McConnell · 8 Jun 2004 · 1,758pp · 342,766 words

Learning Ext Js

by Shea Frederick · 19 Dec 2008 · 324pp · 87,064 words

Building Web Applications With Flask

by Italo Maia · 25 Jun 2015 · 157pp · 35,874 words

Beautiful Testing: Leading Professionals Reveal How They Improve Software (Theory in Practice)

by Adam Goucher and Tim Riley · 13 Oct 2009 · 351pp · 123,876 words

Programming TypeScript

by Boris Cherny · 16 Apr 2019 · 629pp · 83,362 words

Shipping Greatness

by Chris Vander Mey · 23 Aug 2012 · 231pp · 71,248 words

JavaScript Cookbook

by Shelley Powers · 23 Jul 2010 · 1,038pp · 137,468 words

PostgreSQL: Up and Running

by Regina Obe and Leo Hsu · 5 Jul 2012 · 205pp · 47,169 words

Professional Node.js: Building Javascript Based Scalable Software

by Pedro Teixeira · 30 Sep 2012 · 325pp · 85,599 words

Programming HTML5 Applications

by Zachary Kessin · 9 May 2011 · 210pp · 42,271 words

Map Scripting 101: An Example-Driven Guide to Building Interactive Maps With Bing, Yahoo!, and Google Maps

by Adam Duvander · 14 Aug 2010 · 415pp · 95,261 words

Python Cookbook

by David Beazley and Brian K. Jones · 9 May 2013 · 1,606pp · 168,061 words

Cybersecurity: What Everyone Needs to Know

by P. W. Singer and Allan Friedman · 3 Jan 2014 · 587pp · 117,894 words

Learning Flask Framework

by Matt Copperwaite and Charles Leifer · 26 Nov 2015

Hacker, Hoaxer, Whistleblower, Spy: The Story of Anonymous

by Gabriella Coleman · 4 Nov 2014 · 457pp · 126,996 words

Node.js in Action

by Mike Cantelon, Marc Harter, Tj Holowaychuk and Nathan Rajlich · 27 Jul 2013 · 628pp · 107,927 words

Going Dark: The Secret Social Lives of Extremists

by Julia Ebner · 20 Feb 2020 · 309pp · 79,414 words

Humble Pi: A Comedy of Maths Errors

by Matt Parker · 7 Mar 2019

This Machine Kills Secrets: Julian Assange, the Cypherpunks, and Their Fight to Empower Whistleblowers

by Andy Greenberg · 12 Sep 2012 · 461pp · 125,845 words

Realtime Web Apps: HTML5 WebSocket, Pusher, and the Web’s Next Big Thing

by Jason Lengstorf and Phil Leggetter · 20 Feb 2013

Speaking Code: Coding as Aesthetic and Political Expression

by Geoff Cox and Alex McLean · 9 Nov 2012

Daemon

by Daniel Suarez · 1 Dec 2006 · 562pp · 146,544 words

Reamde

by Neal Stephenson · 19 Sep 2011 · 1,318pp · 403,894 words

Principles of Web API Design: Delivering Value with APIs and Microservices

by James Higginbotham · 20 Dec 2021 · 283pp · 78,705 words

Your Computer Is on Fire

by Thomas S. Mullaney, Benjamin Peters, Mar Hicks and Kavita Philip · 9 Mar 2021 · 661pp · 156,009 words

DarkMarket: Cyberthieves, Cybercops and You

by Misha Glenny · 3 Oct 2011 · 274pp · 85,557 words

Heart of the Machine: Our Future in a World of Artificial Emotional Intelligence

by Richard Yonck · 7 Mar 2017 · 360pp · 100,991 words