Sub: Web Security Name: Shubham Sati ROLL NO: 17BCA1100 Class: Bca5C

SUB: WEB SECURITY
NAME: SHUBHAM SATI
ROLL NO: 17BCA1100
CLASS: BCA5C
1.What is SQL Injections ?

Ans. SQL Injection is a type of an injection attack that
makes it possible to execute malicious SQL statements.
These statements control a database server behind a web
application. Attackers can use SQL Injection vulnerabilities
to bypass application security measures. They can go
around authentication and authorisation of a web page or
web application and retrieve the content of the entire SQL
database. They can also use SQL Injection to add, modify,
and delete records in the database.
SQL injection usually occurs when you ask a user for input,
like their username/userid, and instead of a name/id, the
user gives you an SQL statement that you
will unknowingly run on your database.
There are a wide variety of SQL injection vulnerabilities,

attacks, and techniques, which arise in different situations.
Some common SQL injection examples include:
• Retrieving hidden data, where you can modify an SQL

query to return additional results.
• Subverting application logic, where you can change a

query to interfere with the application's logic.
• UNION attacks, where you can retrieve data from

different database tables.
• Examining the database, where you can extract

information about the version and structure of the
database.
• Blind SQL injection, where the results of a query you

control are not returned in the application's responses.
example: Consider a shopping application that displays

products in different categories. When the user clicks on
the Gifts category, their browser requests the URL:
https://insecure-website.com/products?category=Gifts
This causes the application to make an SQL query to

retrieve details of the relevant products from the database:
SELECT * FROM products WHERE category = 'Gifts' AND

released = 1
This SQL query asks the database to return:
• all details (*)
• from the products table
• where the category is Gifts
• and released is 1.
2. Explain how users can Find SQL Injection

Bugs.  
Ans: SQL Injection Examples and ways to prevent SQL

Injection Attacks on Web Applications:
While testing a website or a system, the tester's aim is to

ensure if that tested product is as much protected, as
possible.
Security testing is usually performed for this purpose. In

order to perform this type of testing, initially, we need to
consider, which attacks are most likely to happen. SQL
Injection is one of those attacks.
SQL Injection is considered as one of the most common

attacks as it can bring serious and harmful consequences
to your system and sensitive data.
The only sure way to prevent SQL Injection attacks is input

validation and parametrised queries including prepared
statements. The application code should never use the
input directly. The developer must sanitise all input, not only
web form inputs such as login forms. They must remove
potential malicious code elements such as single quotes. It
is also a good idea to turn off the visibility of database
errors on your production sites. Database errors can be
used with SQL Injection to gain information about your
database.
If you discover an SQL Injection vulnerability, for example

using an Acuteness scan, you may be unable to fix it
immediately. For example, the vulnerability may be in open
source code. In such cases, you can use a web application
firewall to sanitize your input temporarily.
3. How user can Find and prevent XPath

InjectionFlaws? Explain  
ans: The XPath Injection Security Scan tries to attack the web
service by replacing the TestStep's original parameters with
malicious strings, designed to expose potential flaws in web
services that are using user input in XPath expressions. By using
assertions, you can assure that the attack didn't expose sensitive
data, return a session ID, etc.
How to prevent it :
• The user input needs to be sanitized such
as quote(‘) can be replaced with “'”. The validation
has to be added both in client and server side.
• We can use parametrized queries (like Prepared

Statements in SQL) in which queries are precompiled
and user input is passed as parameters rather than
expressions.
"//users[LoginID/text()= $LoginID and passwd/text()=

$password]"
• Proper error pages have to used that do not disclose

any information in the time of an error that could benefit
the attacker.
Disclaimer: The information published in this article is only

for educational purposes. The content of this article is
based on my personal learning and experience. Any misuse
of information will not be responsibility of the author.
4. What do you mean by the SQL injection

attack and also discuss the types of SQL
injection attack ?
Ans : Structured Query Language is a language designed to

manipulate and manage data in a database. Since its
inception, SQL has steadily found its way into many
commercial and open source databases. SQL injection is
a type of cybersecurity attack that targets these databases,
using specifically crafted SQL statements to trick the
systems into doing unexpected and undesired things.
 
Unsanitised Input
Unsanitised input is a common type of SQLi attack in which

the attacker provides user input that isn’t properly sanitized
for characters that should be escaped, and/or the input
isn’t validated to be the type that is correct/expected.
For example, a website used to pay bills online might

request the user’s account number in a web form and then
send that to the database to pull up the associated account
information. If the web application is building a SQL query
string dynamically with the account number the user
provided, it might look something like this:
“SELECT * FROM customers WHERE account = ‘“ +

userProvidedAccountNumber +”’;”
While this works for users who are properly entering their
account number, it leaves the door open for attackers.
Blind SQL Injection

Also referred to as Inferential SQL Injection, a Blind SQL
injection attack doesn’t reveal data directly from the database
being targeted. Rather, the attacker closely examines indirect clues
in behavior. Details within HTTP responses, blank web pages for
certain user input, and how long it takes the database to respond to
certain user input are all things that can be clues depending on the
goal of the attacker. They could also point to another SQLi attack
avenue for the attacker to try.
Out-of-Band Injection
This is a type of Out-of-Band Injection attack. In this case, the

attacker will provide an SQL injection that will get stored and
executed by a separate behavior of the database system. When the
secondary system behavior occurs (it could be something like a
time-based job or something triggered by other typical admin or
user use of the database) and the attacker’s SQL injection is
executed, that’s when the “reach out” to a system the attacker
controls happens.

Sub: Web Security Name: Shubham Sati ROLL NO: 17BCA1100 Class: Bca5C

Uploaded by

Copyright:

Available Formats

Sub: Web Security Name: Shubham Sati ROLL NO: 17BCA1100 Class: Bca5C

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Sub: Web Security Name: Shubham Sati ROLL NO: 17BCA1100 Class: Bca5C

Uploaded by

Copyright:

Available Formats

SUB: WEB SECURITY

NAME: SHUBHAM SATI

ROLL NO: 17BCA1100

1.What is SQL Injections ?

There are a wide variety of SQL injection vulnerabilities,

• Retrieving hidden data, where you can modify an SQL

• Subverting application logic, where you can change a

• UNION attacks, where you can retrieve data from

• Examining the database, where you can extract

• Blind SQL injection, where the results of a query you

example: Consider a shopping application that displays

This causes the application to make an SQL query to

SELECT * FROM products WHERE category = 'Gifts' AND

This SQL query asks the database to return:

• all details (*)

• from the products table

• where the category is Gifts

2. Explain how users can Find SQL Injection

Ans: SQL Injection Examples and ways to prevent SQL

While testing a website or a system, the tester's aim is to

Security testing is usually performed for this purpose. In

SQL Injection is considered as one of the most common

The only sure way to prevent SQL Injection attacks is input

If you discover an SQL Injection vulnerability, for example

3. How user can Find and prevent XPath

• We can use parametrized queries (like Prepared

"//users[LoginID/text()= $LoginID and passwd/text()=

• Proper error pages have to used that do not disclose

Disclaimer: The information published in this article is only

4. What do you mean by the SQL injection

Ans : Structured Query Language is a language designed to

Unsanitised input is a common type of SQLi attack in which

For example, a website used to pay bills online might

“SELECT * FROM customers WHERE account = ‘“ +

Blind SQL Injection

This is a type of Out-of-Band Injection attack. In this case, the

You might also like