Pubcon Las Vegas 2012 SQL Injection

Todd Keup :: magnifisites.com

What Every Webmaster Should Know About

Code Installation

Cracking and Hacking

Todd Keup@toddkeup


Cracker versus hacker


Overview

• Motivation• Tools of the trade• Common attacks• Defending yourself


Motivation• Drop links or cookies• Steal logins, blackmail people• Building botnets• Redirect advertising• Crush competition• Steal credit cards• Abuse your server (email, attacks, etc.)


Tools of the trade

• Basic hacking became easier• Portscanners, evil software suites

are available to the public• SARA, brutus, etc.: endless list


Common attacks

• SQL injection• Additional software problems• How to protect yourself• Your checklist


SQL Injection

• How it looks• What happens when it succeeds• Recovery

– Cleanup– Plugging the hole (prevention)

• Monitoring and discovery


SQL Injection


SQL Injection<form method="post" action="process">

Username: <input name="username" type="text" value="">

Password: <input name="password" type="password" value="">

<input name="submitform" type="submit" value="Submit">

</form>

Incorrectly filtered escape characters

query = "SELECT * FROM users WHERE

name = '" + username + "' AND pass = '" + password + "';"


SQL Injection



name = '" + username + "' AND pass = '" + password + "';"

Renders:


name = '' OR 1=1 -- '' AND pass = 'doesNotMatter';"


SQL Injection


<?php

$offset = $_GET['start'];

$query = "SELECT id, name FROM products ORDER BY name

LIMIT 20 OFFSET $offset;";

$result = pg_query($connection, $query);

?>

// cracker encodes the following into the "start" value of the url

0;

insert into pg_shadow(usename,usesysid,usesuper,usecatupd,passwd)

select 'cracker', usesysid, 'yes','yes','jack'

from pg_shadow where usename='postgres'; --


SQL InjectionIncorrectly filtered escape characters

query = "UPDATE users SET pwd='$pwd' WHERE uid='$uid';";

// user enters: ' OR name LIKE '%admin%'; -- ' and it renders:

UPDATE users SET pwd='abc' WHERE uid='me' OR name LIKE '%admin%'; -- ';

Incorrect type handling

query = "SELECT * FROM students WHERE id = " + expectedInteger + ";"

// user enters: 1;DROP TABLE students

SELECT * FROM students WHERE id = 1;DROP TABLE students;


SQL Injection

Image courtesy of http://xkcd.com/327/


SQL InjectionCleanup, aisle nine

Check your access logsCheck file modification timeRevert to backup?Change passwordsPatch the hole


SQL InjectionCasting a type value

$ticket = (integer) $_POST['ticketnumber'];

Properly filtering data

$query =

sprintf(

"SELECT * FROM Users WHERE user='%s' AND pass='%s'",

mysql_real_escape_string($user),

mysql_real_escape_string($pass)

);

mysql_query($query);


SQL InjectionMonitor and Discover

Audit your site regularly• Log form submissions• Monitor changes to user files• Use your system tools• Use the same tools crackers employ• Identify access patterns of automated

tools• Blacklist hosts that initiate attacks


SQL InjectionMonitor and Discover

• Never connect to the database as a superuser or as the database owner.

• Check expected data type• Escape user supplied values• Do not print out any database specific

information, especially about the schema

• Do not dump raw errors to the display


Botnets


Thank You

Todd [email protected]

@toddkeup

Pubcon Las Vegas 2012 SQL Injection

Technology

Transcript of Pubcon Las Vegas 2012 SQL Injection