SMT 1-4 Server Side Security (1)

Summary

This web security session delves into server-side vulnerabilities, focusing on SQL injection and SSRF attacks. It explains how improper validation of user input can lead to security breaches, detailing various types of SQL injections, including basic, blind, union-based, and time-based. The session also covers techniques to exploit databases and emphasizes the importance of input validation and the use of prepared statements in PHP to safeguard against such attacks, ensuring a more secure application environment.

Takeaways

• 🛡️ Web security is crucial to protect against server-side vulnerabilities such as SQL injection and SSRF, which are caused by improper validation of user input data.
• 🔍 SQL Injection is an attack where an attacker manipulates an SQL query by inserting malicious input, potentially altering the query's intended behavior.
• 🗃️ SQL stands for Structured Query Language, used for managing data in relational databases, and is vulnerable to injection if user input is directly included in query statements.
• 🔑 The primary objectives of SQL injection attacks are to gain unauthorized access to another user's account or to extract sensitive data from the database.
• 🔄 Types of SQL injection include basic, blind, union-based, and time-based, each requiring different techniques to exploit the vulnerability.
• 🎯 Basic SQL injection involves manipulating queries by using characters like a single quote to alter the SQL statement's logic.
• 🕵️‍♂️ Blind SQL injection is used when the attacker cannot see the server's response directly but can infer outcomes based on the server's behavior.
• 🔄 Union-based SQL injection leverages the UNION keyword to combine results from multiple SELECT statements, potentially exposing additional data.
• ⏱️ Time-based SQL injection uses time delays to infer the correctness of certain conditions, allowing attackers to enumerate data over time.
• ✅ Prevention of SQL injection involves validating all user inputs on the server-side and using prepared statements to separate SQL code from data.
• 💻 The script provides an example of using prepared statements in PHP to safely handle user input and execute SQL queries, emphasizing the importance of input validation and parameter binding.

Q & A

What are the main topics covered in the web security session described in the transcript?

The web security session covers server-side security, specifically SQL injection, SSRF (Server-Side Request Forgery), and defenses against server-side vulnerabilities.

What is a server-side vulnerability and how can it be caused?

A server-side vulnerability is a security weakness in web applications or databases that can be exploited due to improper validation of user's request data. It can be caused by the inclusion of user input in server processes without proper sanitization or validation.

What is SQL injection and how does it occur?

SQL injection is a type of attack where an attacker manipulates a web application's database query by inserting malicious SQL code through the user input. It occurs when the application combines user input with an SQL query without proper validation, allowing the execution of unintended queries.

What is the purpose of SQL injection attacks?

The purpose of SQL injection attacks is to gain unauthorized access to a database, which can be used to log into another user's account, extract database contents, or perform other malicious actions.

What are the different types of SQL injection mentioned in the transcript?

The different types of SQL injection mentioned are basic SQL injection, blind SQL injection, union-based SQL injection, and time-based SQL injection.

How does basic SQL injection manipulate the query?

Basic SQL injection manipulates the query by inserting special characters like a single quote to break the original query structure and inject additional SQL code that changes the query's logic.

What is blind SQL injection and how does it work?

Blind SQL injection is a technique used when the attacker cannot see the result of the query directly but can infer information based on the server's response. It involves making the server evaluate certain conditions and observing whether they are true or false to extract data from the database.

What is union-based SQL injection and how can it be used?

Union-based SQL injection leverages the UNION keyword in SQL to combine two or more SELECT statements. It can be used to retrieve additional data from the database by appending a union query to the original query, which returns the result of the attacker's query if the conditions are met.

How does time-based SQL injection work?

Time-based SQL injection works by introducing a delay in the server's response based on the truth value of a condition within the injected SQL code. This delay is used to infer information about the database by measuring the response time.

What are some prevention measures against SQL injection mentioned in the transcript?

Prevention measures include validating all user input on the server side, using input filtering, and employing prepared statements to separate SQL code from data, which helps prevent the execution of malicious SQL code.

Can you provide an example of how to use prepared statements in PHP to prevent SQL injection?

An example in PHP would involve using the filter_input function to sanitize user input and then preparing a query statement with placeholders (e.g., question marks). Afterward, bind the sanitized input to these placeholders and execute the query using prepared statements to prevent SQL injection.