Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Scribd Logo
Upload

Welcome to Scribd!

  • 13 views

    SQL Injection

    Uploaded by

    vukicevic.djordjedva
    SQL Injection guide

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd

    SQL Injection

    Uploaded by

    vukicevic.djordjedva
    13 views5 pages
    SQL Injection guide

    Copyright

    © © All Rights Reserved

    Available Formats

    PPTX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    SQL Injection guide

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    13 views5 pages

    SQL Injection

    Uploaded by

    vukicevic.djordjedva
    SQL Injection guide

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    You are on page 1of 5

    SQL Injection

    What is SQL
    Injection (SQLi)
    SQL injection is a web security
    vulnerability that allows an attacker
    to interfere with the queries that an
    application makes to its database. It
    generally allows an attacker to view
    data that they are not normally able
    to retrieve. This might include data
    belonging to other users, or any
    other data that the application itself
    is able to access. In many cases, an
    attacker can modify or delete this
    data, causing persistent changes to
    the application's content or
    behavior.
    In some situations, an attacker can
    escalate an SQL injection attack to
    compromise the underlying server
    or other back-end infrastructure or
    perform a denial-of-service attack.
    SQL injection examples
    There are a wide variety of SQL injection vulnerabilities, attacks, and techniques, which arise in
    different situations. Some common SQL injection examples include:
    •Retrieving hidden data, where you can modify an SQL query to return additional results.
    •Subverting application logic, where you can change a query to interfere with the application's
    logic.
    •UNION attacks, where you can retrieve data from different database tables.
    •Examining the database, where you can extract information about the version and structure of
    the database.
    •Blind SQL injection, where the results of a query you control are not returned in the
    application's responses.
    What was the problem?
    In our application we have filed (gsccode) where we could set value to something that is a true
    statement like%' AND 8634=8634 AND 'Knjf%'='Knjfled to a larger application response. From
    this, we conclude that it is basically possible for an attacker to manipulate the SQL statement,
    which could potentially be exploited to send malicious commands to the database. Gsccode
    represent contract code so attacker could potentially see some data that could harm our users.
    Some options how to prevent SQLi
    Option 1: Use of Prepared Statements (with Parameterized Queries)
    Option 2: Use of Properly Constructed Stored Procedures
    Option 3: Allow-list Input Validation
    Option 4: Escaping All User Supplied Input
    Conclusion
    Because Adobe Flash Player is not supported by any browser from
    12.01.2021. we should delete our crossdomain.xml file. I’m not aware at
    the moment of writing that we use any Adobe Flash Player application
    right now, but in the past, we use it for Vehicle Manager.
    Today’s modern way of accessing multiple domains is CORS. Cross-Origin
    Resource Sharing (CORS) is an HTTP-header based mechanism that allows
    a server to indicate any origins (domain, scheme, or port) other than its
    own from which a browser should permit loading resources. CORS also
    relies on a mechanism by which browsers make a "preflight" request to
    the server hosting the cross-origin resource, in order to check that the
    server will permit the actual request.
    Helpful link: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS

    You might also like