International Journal of Computer Trends and Technology (IJCTT) - volume4Issue4 –April 2013

Website Hacking: SQL Injection Method

And Its Prevention
U.Nanaji#1, K.T.Mahesh Babu#2, P.Sai Sampath#3

#1
Associate Professor, Dept. of CSE, KL University, Vaddeswaram, AP, India
#2
Final Year B. Tech, Dept. of ECM, KL University, Vaddeswaram, AP, India
#3
Final Year B. Tech, Dept. of ECM, KL University, Vaddeswaram, AP, India

Abstract— In the Internet, the websites has an important role Ethical Hacking is testing the resources for a good
to fulfill user requirements. These websites are maintained to cause and for the betterment of technology. Technically
be secure. The third person may hack a website without Ethical Hacking means penetration testing which is
knowledge of developer and they may do any fraudulent focused on Securing and Protecting IT Systems. SQL
activities on the website. The websites can be hacked by using Injection is one of the most common vulnerability in web
any one of the hacking mechanisms such as SQL
Injection, Command Injection, Local File Inclusion injection, applications today. It allows attacker to execute database
and etc… The website may use personal details of it’s users in query in url and gain access to some confidential
online environment. These personal details must be secured. Information etc...( In shortly). SQL injection refers to the
There are many types of mechanisms are available to secure act of someone inserting a MySQL statement to be run on
the websites and user’s data. This paper makes a survey your database without your knowledge. Injection usually
about such types of protection mechanism and makes occurs when you ask a user for input, like their name, and
awareness to the people.
instead of a name they give you a MySQL statement that
you will unknowingly run on your database.
Keywords—Hacking, SQL Injection, Website.
SQL Injection [1] is a type of web application
I. INTRODUCTION security vulnerability in which an attacker is able to submit
a database SQL command which is executed by a web
application, exposing the back-end database. A SQL
The Art of exploring various security breaches is termed Injection attack can occur when a web application utilizes
as Hacking. Computer Hackers have been around for so user-supplied data without proper validation or encoding as
many years. Since the Internet became widely used in the part of a command or query. The specially crafted user data
World, We have started to hear more and more about tricks the application into executing unintended commands
hacking. Only a few Hackers, such as Kevin Mitnick, are or changing data. SQL Injection allows an attacker to
well known. In a world of Black and White, it’s easy to create, read, update, alter, or delete data stored in the back-
describe the typical Hacker. A general outline of a typical end database. In its most common form, a SQL Injection
Hacker is an Antisocial, Pimple-faced Teenage boy. But attack gives access to sensitive information such as social
the Digital world has many types of Hackers. Hackers are security numbers, credit card number or other financial
human like the rest of us and are, therefore, unique data. According to Vera code’s State of Software Security
individuals, so an exact profile is hard to outline. The best Report SQL Injection is one of the most prevalent types of
broad description of Hackers is that all Hackers aren’t web application security vulnerability.
equal. Each Hacker has Motives, Methods and Skills. But
some general characteristics can help you understand them. II. About Website Hacking
Not all Hackers are Antisocial, Pimple- faced Teenagers.
Regardless, Hackers are curious about Knowing new Hacking website means altering or manipulating the
things, Brave to take steps and they are often very Sharp website content or database i.e. manipulate website
Minded. contents say CSS or Java scripts , leak its users database,

ISSN: 2231-2803 http://www.ijcttjournal.org Page 903

International Journal of Computer Trends and Technology (IJCTT) - volume4Issue4 –April 2013

corrupt its database, deface the website's index page, vulnerabilities, programming, and even psychology, and
exploit the anonymous login and much more... their attacks are almost always automated. Strangely
Hacking websites is nowadays became a fashion among the enough, if your site was hacked, it probably wasn't done by
Hackers. They hack the website and deface its index page a person, but by another computer, which was hacked by
to display their own custom defaced page, mostly for another computer, which was hacked by yet another, and
popularity. There are several website Hacking techniques somewhere way back in the chain is a programmer who
like Injection attacks i.e. SQL Injection, Command initially unleashed the sequence of events that set all these
Injection, Local File Inclusion injection, X Path computers to attacking each other and building a giant
Injection, arc injection, Cross site scripting attacks, Cross network, a "botnet", a massively parallel virtual
site scripting forgery attacks, Header supercomputer whose purpose is to suck up all of the
manipulation, hackingrootdirectories, bypassing registratio world's information that the criminals can efficiently turn
n, unblocking websites ,Hacking premium into money. They need to have as many computers as
accounts, Cookie based attacks, domain hijacking and possible recruited into the enterprise, and that's why they
much more involved in achieving the abovementioned. wanted to hack your little website.

III. SQL Injection

The files of your website are stored on a computer
somewhere. The computer, called a "server" or "web
A SQL injection attack exploits vulnerabilities in a web
server",[2] is not too much different from your home PC,
except that its configuration is specialized for making files server database that allow the attacker to gain access to the
available to the world wide web, so it has a lot of hard database and read, modify, or delete information. SQL
drive capacity and a very high speed internet connection. It Injection is a type of web application security vulnerability
probably doesn't have its own monitor or keyboard because in which an attacker is able to submit a database SQL
everyone who communicates with it does so through its command which is executed by a web application,
internet connection, just like you do. exposing the back-end database. A SQL Injection attack
Your website and server have several security systems can occur when a web application utilizes user-supplied
that determine what kind of access each person has. You data without proper validation or encoding as part of a
are the owner, so you have passwords that give you command or query. The specially crafted user data tricks
read/write access to your site. You can view files (read)
the application into executing unintended commands or
and you can also change them (write). Everybody else only
has read access. They can view your files, but they are changing data. SQL Injection allows an attacker to create,
never, ever supposed to be able to change them, delete read, update, alter, or delete data stored in the back-end
them, or add new ones. database. In its most common form, a SQL Injection attack
gives access to sensitive information such as social security
A hack occurs when somebody gets through these numbers, credit card number or other financial data.
security systems and obtains write access to your server, According to Vera code’s State of Software Security
the same kind you have. Once they obtain that, they can
Report SQL Injection is one of the most prevalent types of
change, add, or delete files however they want. If you can
imagine someone breaking into your home and sitting web application security vulnerability.
down at your PC with a box of installation CD's, that's
what a website hack is like. They might do only a little Input validation on the SQL Injection:
damage, or a lot. The choice is up to them. Altering the
page was simply the thing they chose to do after they got There are measures that can be applied to mitigate SQL
in. Once they get in, they can do ANYTHING, including injection attacks. Web developer can check whether some
alter your pages that are pure HTML. That is the reason suspicious characters are sent from the Login Page like ‘, “,
why, after a hack, the most important thing isn't repairing ;, -- , etc. . Always store the Passwords in the Database
the damage they did (which most people focus on), server in the Encrypted Form. Use of these practices does
but finding out how they got in. not guarantee that SQL injection can be completely
Website hacking is one of the modern enterprises of
organized crime, but if you think that means it's being done eliminated, but they will make it more difficult for Hackers
amateurishly by a bunch of elderly mobsters who took to conduct these attacks.
night classes in Computer ABC's to learn what "this
Internet Explore thing is", think again. These organizations
have professional programmers. Their campaigns to take
control of thousands of the world's computers are well
planned and sophisticated, drawing on an in-depth
knowledge of operating system software, browser

ISSN: 2231-2803 http://www.ijcttjournal.org Page 904

International Journal of Computer Trends and Technology (IJCTT) - volume4Issue4 –April 2013

V. CONCLUSION
Buffer
overflow Even though the Usage of internet had become essential
now a day. The Security issues are not that much
convincing, so the website developers must take care by
Quetry
Cross Site
patching the code thoroughly during the development stage
String
Scripting only.
for Input
REFERENCES

Canonicalizat SQL
[1]SQLINJECTION:
ion Injection
http://www.veracode.com/security/sql-injection>.
attac [2]Website Hacking: Referred from
Fig.1.Attacks input validation can help prevent. http://www.101sitehosting.com/members/knowledgebase/142/What-is-a-
Website-hack-Basic-information-to-help-webmaster-block-hackers.html>.
[3]Input Validation: Referred from the text “Hacking for Beginners”.
Prevention:
[4] Typed parameterized query APIs <http://
http://www.veracode.com/security/sql-injection >.
SQL injection can be prevented if you adopt an input [5] SQL INJECTION BASICS:
validation technique in which user input is authenticated http://msdn.microsoft.com/en-us/library/ms161953(v=SQL.105).aspx
against a set of defined rules for length, type, and syntax [6] SQL Injection Walkthrough
http://www.securiteam.com/securityreviews/5DP0N1P76E.html
and also against business rules. You should ensure that [7] Sql injection What is It?
users with the permission to access the database have the http://www.acunetix.com/websitesecurity/sql-injection/
least privileges. Additionally, do not use system [8] Stop SQL Injection Attacks Before They Stop You
http://msdn.microsoft.com/en-us/magazine/cc163917.aspx
administrator accounts like “sa” for Web applications.
Also, you should always make sure that a database user is
created only for a specific application and this user is not
able to access other applications. Another method for
preventing SQL injection attacks is to remove all stored
procedures that are not in use. Use strongly typed
parameterized query APIs [4] with placeholder substitution
markers, even when calling stored procedures. Show care
when using stored procedures since they are generally safe
from injection. However, be careful as they can be
injectable (such as via the use of exec () or concatenating
arguments within the stored procedure).

IV.Proposed Technology

For quite some time now hackers have used SQL injection
attack methods to quickly find and exploit website
vulnerabilities and effectively spread malware. In order to
prevent SQL injections, enterprise information security
teams must go above and beyond the old SQL defense of
testing and patching Web application code.

We can prevent hacking a website through sql injection by

patching the code developed by the programmers.

ISSN: 2231-2803 http://www.ijcttjournal.org Page 905