11. Web Exploit : SQL Injection

Summary

This video explains SQL Injection as a method of exploiting vulnerabilities in websites by manipulating SQL queries. The presenter uses a site called tesphweb.com to demonstrate how attackers can manipulate input fields to interact with databases. Using tools like Burp Suite, the video covers techniques such as identifying vulnerable parameters, testing with error-inducing queries, and using `UNION SELECT` to extract sensitive data like database version information. The goal is to understand how SQL Injection works, why input validation is crucial, and how attackers might exploit insecure web applications for unauthorized access.

Takeaways

• 😀 SQL Injection is a vulnerability where an attacker can manipulate SQL queries via user inputs, potentially allowing unauthorized access to a database.
• 😀 Burp Suite is a powerful tool used to intercept, modify, and test HTTP requests, which is demonstrated for exploiting SQL injection vulnerabilities.
• 😀 The demonstration starts by analyzing the URL parameters in a website, such as `id=1`, which can be manipulated to test for SQL injection vulnerabilities.
• 😀 An error-based SQL injection occurs when a query generates an error response, revealing potential SQL injection vulnerabilities.
• 😀 The speaker uses `ORDER BY` to determine the number of columns in a SQL query, a technique known as column enumeration.
• 😀 By testing different values in the `ORDER BY` clause, an attacker can identify how many columns exist in the database query.
• 😀 The `UNION SELECT` technique allows attackers to combine results from multiple SQL queries to extract data from other columns in the database.
• 😀 Identifying the version of the database software (e.g., using `SELECT version()`) can help attackers adjust their approach based on the database system in use.
• 😀 Remote Code Execution (RCE) is a more advanced attack that could occur if an attacker gains root privileges or access to the underlying system.
• 😀 Ethical hacking should always be performed with permission and authorization. Unauthorized SQL injection is illegal and unethical.
• 😀 The demonstration provides insight into how an attacker can exploit SQL injection vulnerabilities to interact with a database through web interfaces.

Q & A

What is SQL injection?

SQL injection is a web exploitation technique where an attacker inserts or 'injects' malicious SQL code into input fields to manipulate database queries. This can lead to unauthorized access or manipulation of the database.

What is the purpose of SQL in web applications?

SQL (Structured Query Language) is used to interact with databases in web applications. It allows for querying, updating, and managing data stored in a database.

How can SQL injection be detected?

SQL injection can be detected through error messages generated by the database when invalid or malicious SQL queries are executed. These errors often reveal information about the database structure, which attackers can exploit.

What tool does the presenter use to perform SQL injection in the demonstration?

The presenter uses Burp Suite, a popular web security tool, to perform SQL injection attacks. However, the demonstration also suggests that it can be done using just a browser.

What is the significance of the URL 'listproduc.php.cut' in the demonstration?

The URL 'listproduc.php.cut' is the target for the SQL injection. It contains a query string where the presenter manipulates the input to test the website’s vulnerability to SQL injection.

What does the error message 'Unknown columns' indicate during SQL injection?

The 'Unknown columns' error indicates that the attacker attempted to reference a column in the database that does not exist. This helps the attacker deduce the number of available columns in the database.

How does the 'ORDER BY' clause help in SQL injection?

The 'ORDER BY' clause is used to identify how many columns are present in the database. By incrementally changing the number, attackers can observe error messages that reveal the database structure.

What is the purpose of using 'UNION SELECT' in SQL injection?

'UNION SELECT' allows the attacker to combine the results of multiple SELECT queries. This helps in retrieving additional data from other tables in the database, often including sensitive information.

What other types of SQL injection attacks are mentioned in the video?

Besides basic SQL injection, the presenter mentions advanced techniques like querying the database version using 'version()', and potentially conducting a remote code execution (RCE) attack if the attacker has sufficient privileges.

What is the main takeaway from this SQL injection demonstration?

The main takeaway is that SQL injection can be used to gather information about a website’s database structure and potentially exploit vulnerabilities for unauthorized access. Tools like Burp Suite can facilitate the process, but it can also be done manually with a browser.