SQL Injection
ABSTRACT
Over the past several years, hacktivists, criminals, and people just "out for lulz" have managed to find sensitive data owned by organizations like Sony, Yahoo, NASA, and the U.S. army, among many others. In all of these cases, the attackers exploited websites using SQL injection attacks. SQL injection is at the top of the Open Web Application Security Project (OWASP) top 10 list and is an important part of one of the SANS 20 critical security controls. This talk will go into what SQL injection is, how attackers can use it, and how to secure your sites so that your CIO and CISO never show up on the evening news. Although the talk will focus on using the Microsoft stack (IIS, ASP.Net, and SQL Server), the lessons will apply to all web systems everywhere.ADDITIONAL MEDIA
No recordings or additional media are available for this talk.SLIDES
Click here to access the slides for this presentation.
The slides are licensed under Creative Commons Attribution-ShareAlike.
DEMO CODE
Click here to access demo code for this presentation. These scripts give you an opportunity to play with a site vulnerable to SQL injection
The source code is licensed under the terms offered by the GPL.
LINKS & FURTHER INFO
References
This material was originally part of a blog series on SQL injection I did. That series got turned into a chapter of Tribal SQL.
Simple Talk later published my SQL injection chapter as an article, so you can read it for free.
Interesting Links
For more resources on SQL injection, I recommend checking out the following:
- Every year, the Open Web Application Security Project (OWASP) publishes a top 10 list for website vulnerabilities. Every year, injection attacks end up as #1 or #2 on the list.
- In a 2011 Imperva study, 83% of successful data breaches involved SQL injection.
- Listing the set of companies and organizations with high-profile SQL injection attacks would take too long. Fortunately, the Code Curmudgeon did it for me with his SQL Injection Hall of Shame. I laughed; I cried; I hoped my employers weren't on the list.
- The first time I gave this talk, I had a special Sony edition based on their numerous breaches during the year 2011. That's seven separate SQL injection attacks, not to mention the most recent one.
- HTTP Parameter Pollution is one of my favorite attack vectors. In .NET on IIS, multiple querystring parameters turn into a comma-separated list, which makes attackers happy.
- Kim Tripp on how to prevent SQL injection. Tripp also has a lot more detail on EXEC versus using sp_executesql. To be honest, I prefer Aaron Bertrand's argument, using sp_executesql instead of EXEC. My advice is, if you are a smart and as good as Kim Tripp, use EXEC; otherwise, use sp_executesql.
- Microsoft's Conor Cunningham notes Microsoft's official guidance on avoiding SQL injection attacks. It's good reading.
- Bobby Tables is a website dedicated to writing injection-free application code in the language of your choice.
Tools
- sqlmap is my favorite SQL injection tool. You can automate it, tie it into Metasploit, and it's a ridiculously smart tool.
- One of the other popular tools in this realm is Havij. Havij is great because of its UI. I see it as a tool you can use to play around with a site (given permission!) and to learn more about SQL injection, whereas sqlmap is a tool you can use to scale out testing across your environment.
Books and Other Resources
- Tribal SQL. My chapter is the only one on SQL injection, but there are other chapters on other interesting topics written by outstanding people.
- Securing SQL Server by Denny Cherry. I read the first edition of his book shortly after I wrote the original blog series, and much of his work on SQL injection coincides with mine. Check it out for another take on the topic.
- SQL Injection Attacks and Defense by Justin Clarke, et al. Get this book if you want a more detailed look into the topic.
- OWASP Top 10 for .NET Developers by Troy Hunt. It's a few years old now, but it is a fantastic work and is a free ebook. Also check out his Pluralsight video on the topic. Troy has a number of Pluralsight videos and I recommend every one of them.