International Journal on Recent and Innovation Trends in Computing and Communication

Volume: 1 Issue: 4 293 – 296

______________________________________________________________________________
SQL INJECTION ATTACKS AND PREVENTION TECHNIQUES
Sampada Gadgil1, Sanoop Pillai2, Sushant Poojary3
1
Asst.professor, Information Technology, 2,3Student,Information Technology
SIES GST Graduate School of Technology
Nerul ,Navi Mumbai
[email protected],[email protected],[email protected]

Abstract: SQL injection attacks are a serious security threat to Web applications. They allow attackers to obtain unrestricted access to
the databases underlying the applications and to the potentially sensitive information these database contain. Various researchers have
proposed various methods to address the SQL injection problem. To address this problem, we present an extensive review of the various
types of SQL injection attacks. For each type of attack, we provide descriptions and examples of how attacks of that type could be
performed. We also present a methodology to prevent the SQL injection attacks.

Keywords: SQL Injection, Attack Intent, Blind Injection, Prevention, Attack Intent, Prepared Statement, Stored procedure

_______________________________________________________*****________________________________________________________

Romanian Hackers by the name of “Tin Kode” and “Ne0h”

I. INTRODUCTION attacked MySQL.com and Sun.com. They did this with a
SQL injection attack, to gather table names, col names and
A common break-in strategy is to try to access sensitive email addresses stored in one of the tables
information from a database Although current database
systems have little vulnerability, the Computer Security II. WORKING OF SQL INJECTION
applying this query to the desired database. Such an
approach to gaining access to private be over four million SQL injection can be used using variousmethods. In this
dollars. Additionally, recent research by the “Imperva tutorial we will explain to the basic concepts behind the
Application .By first generating a query that will cause the SQL injection. Suppose you are on a shopping site and you
database parser to malfunction, followed by from the have selected of showing all the accessories that costless
internet, dealing with SQL injection has become more then and its URL is like
important than ever.
In recent years, widespread adoption of the internet has http://www.shoppingsite.com/products.php? val=100
resulted in to rapid advancement in information
technologies. The internet is used by the general population To test this website for SQL injection try appending your
for the information, in a way that allows the information SQL injection commands in the Val parameter „OR „1‟=‟1
owners quick access while blocking break-in attempts http://www.shoppingsite.com/products.php?
from unauthorized users. Institute discovered that every val=100‟OR‟1‟=‟1
year about 50% of databases experience at least one
purposes such as financial transactions, educational If the above injection works and shows the list of all the
endeavours, and countless other activities. The use of accessories then the website is vulnerable type of SQL
the internet for accomplishing important tasks, such as injection. This means that at the backend the script executed
transferring a balance from a bank account, always comes as shown:
with a security risk. Today‟s web sites strive to keep
their users‟ data confidential and after years of doing SELECT * FROM Products WHERE OR „1‟=‟1‟ ORDER
secure business online, these companies have become BY Product description
experts in information security. The database systems
behind these secure websites store non-critical data along As the condition 1=1 so this will give you list of all the
with sensitive security breach. The loss of revenue products.
associated with such breaches has been estimated to be
over four million dollars. Additionally, recent research • How this SQL injection Attack is launched. Suppose a
by the “Imperva Application Defence Centre” website uses the following logging into admin panel
concluded that at least 92% of web applications are
susceptible to “malicious attack” (Ke Wei, M. Mprasanna, http://www.website.com/cms/login.php?username=saini
Suraj Kothari, 2007). &password=go
Simply put, the end goals of a SQL injection attack is to
gain private (maybe confidential) data, perform a create or Now if the above website is vulnerableinjection as
change on data which is not meant to be changed, or mentioned in the above example then by entering any
altogether purge the data, data object or dataset. Just a username and password in the can login
couple of months back, i.e. March 27th 2011 to be precise,

293
IJRITCC | APR 2013, Available @ http://www.ijritcc.org
______________________________________________________________________________
International Journal on Recent and Innovation Trends in Computing and Communication

Volume: 1 Issue: 4 293 – 296

______________________________________________________________________________
http://www.website.com/ms/login.php?username=dnt&pass In union-query attacks , Attackers do this by injecting a
word=dnt‟OR‟1‟=‟1 statement of the form: UNION

So you will just login without valid username and password SELECT <rest of injected query> because the attackers
to the admin panel of a website. completely control the seond/injected query they can use
that query to retrieve information from a specified table. The
III. ATTACK INTENT result of this attack is that the database returnsa dataset that
is the union of the results of the original first query and the
Identifying injectable parameters: results of the injected second query.
The attacker wants to probe a Web application to discover
which parameters and user input fields are vulnerable to Example: An attacker could inject the text “‟ UNION
SQL injection Attacks SELECT pass1 from user_info where LoginID=‟secret - -”
into the login field, which produces the following query:
Performing database finger-printing:
The attacker wants to discover the type and version of SELECT pass1 FROM user_info WHERE loginID=‟‟
database that a Web application is using. Certain types of
databases respond differently to different queries and UNION SELECT pass1 from user_info where
attacks, and this information can be used to “fingerprint” the LoginID=‟secret‟ -- AND pass1=‟‟
database. Knowing the type andversion of the database used
by a Web application allows an attacker to craft database Assuming that there is no login equal to “”, the original first
specific attacks. query returns the null set, whereas the second query returns
data from the “user_info” table. In this case, the database
Determining database schema: would return column “pass1” for account “secret”. The
To correctly extract data from a database, the attacker database takes the results of these two queries, unions them,
often needs to know database schema information, such as and returns them to the application.
table names, column names, and column data types. Attacks
with this intent are created to collect or infer this kind of In many applications, the effect of this operation is that the
information. These types of attacks employ techniques that value for “pass1” is displayed along with the account
will extract data values from the database information.

IV. ATTACKS

4.1 Tautologies 4.3 Blind Injection

Tautology-based attack is to inject code in one or more Web applications commonly use SQL queries with client-
conditional statements so that they always evaluate to true. supplied input in the WHERE clause to retrieve data from a
The most common usages of this technique are to bypass database. By adding additional conditions to the SQL
authentication pages and extract data. If the attack is statement and evaluating the web application‟s output, you
successful when the code either displays all of the returned can determine whether or not the application is vulnerable to
records or performs some action if at least one record is SQL injection.
returned.
For instance, many companies allow Internet access to
Example: In this example attack, an attacker submits “ ‟ or archives of their press releases.A URL for accessing the
1=1 - -” company‟s fifth press release might look like this:
The Query for Login mode is:
http://www.thecompany.com/pressRelease.jsp?pressRelease
SELECT * FROM user info WHERE ID=5
loginID=‟‟ or 1=1 - - AND pass1=‟‟
The SQL statement the web application would use to
The code injected in the conditional (OR 1=1)transforms the retrieve the press release might look like this (client-
entire WHERE clause into a tautology the query evaluates to supplied input is underlined):
true for each row in the table and returns all of them. In our
example, the returned set evaluates to a not null value, SELECT title, description, releaseDate, body FROM
which causes the application to conclude that the user pressReleases WHERE pressReleaseID = 5
authentication was successful. Therefore, the application
would invoke method user_main.aspx and to access the The database server responds by returning the data for the
application. fifth press release. The web application will then format
the press release data into an HTML page and send the
4.2 Union Query response to the client.

294
IJRITCC | APR 2013, Available @ http://www.ijritcc.org
______________________________________________________________________________
International Journal on Recent and Innovation Trends in Computing and Communication

Volume: 1 Issue: 4 293 – 296

______________________________________________________________________________

To determine if the application is vulnerable to SQL 5.1 Prepared Statement

injection, try injecting an extra true condition into the
WHERE clause. For example, if you request this URL . . . The Java API‟s PreparedStatement interface is superior to
the Statement interface because it provides methods that
http://www.thecompany.com/pressRelease.jsp?pressRelease take care of the encoding for you. By properly composing
ID=5 AND 1=1 the query (with question marks in place of the input) and
. . . and if the database server executes the following query . then using "setString(...)" or other methods, the encoding is
.. taken care of for you.However, if you compose the
PreparedStatement by concatenating strings that might
SELECT title, description, releaseDate, body FROM contain user input, you bypass the encoding and leave your
pressReleases WHERE pressReleaseID = 5 AND 1=1 software open to attack.

. . . and if this query also returns the same press release, then The following is an example of passing two parameters
the application is susceptible to SQL injection "loginID" and "password" safely to a query:

Suppose you have a Web-based application which stores

usernames alongside other session information. Given a PreparedStatement pstmt=conn.prepareStatement
session identifier such as a cookie you want to retrieve the ("SELECT * FROM users WHERE loginID=? AND
current username and then use it in turn to retrieve some password=?");
user information. You might therefore have code for an pstmt.setString(1, ""+loginID);
"Update User Profile" screen somewhat similar to the pstmt.setString(2, ""+password);
following: resultset = pstmt.executeQuery();

execute immediate 'SELECT username FROM sessiontable 5.2 Stored Procedures

WHERE session='''||sessionid||'''' into username;
SQL Injection is caused chiefly by the use of dynamic SQL
execute immediate 'SELECT ssn FROM users WHERE queries. There is, however, nothing to stop the stored
username='''||username||'''' into ssn; procedure being composed of dynamic SQL statements.
Although only typed parameters will be accepted by a call
This will be injectable if the attacker had earlier on the to a stored procedure, there is no saying how the parameters
"Create Account" screen created a username such as: XXX' will be used once inside the procedure. Therefore, it is
OR username='JANE important to ensure that the stored procedures do not
themselves undo the benefits that accrue from their use. In
Which creates the query: Java, The CallableStatement interface in java.sql is
SELECT ssn FROM users WHERE username='XXX‟ OR employed to call stored procedures. The following is an
username='JANE' example corresponding to the one presented above, this time
using the java.sql.CallableStatement interface:
If the user XXX does not exist, the attacker has successfully
retrieved Jane‟s social security number. CallableStatement cstmt = conn.prepareCall("{CALL
check_user(?,?,?)}");
The attacker can create malicious database objects such as a cstmt.setString(1, ""+loginID);
function called as part of an API, or a maliciously named cstmt.setString(2, ""+password);
table by using double quotation marks to introduce
dangerous constructs. cstmt.registerOutParameter(3, java.sql.Types.TINYINT);
cstmt.executeQuery();
For example, an attacker can create a table using a table
name such as "tab') or 1=1--", which can be exploited later
in a second order SQL injection attack. In .NET, the System.Data.SqlClient namespace provides
means for using parameterized
V. PREVENTION TECHNIQUES queries and stored procedures.

To prevent SQL injection, we are primarily concerned with

the double quote, single quote, and backslash characters. 5.3 Patch your SQL server regularly
Without encoding, the double and single quotes will be
interpreted as string delimiters and backslashes can be used Before we get into the coding part of the advice how to
to subvert any encoding that only escapes string delimiters. prevent an SQL injection, we need to start with the
The ability to inject string delimiters into a SQL statement is fundamental issues. SQLinjections might be a frequent
one of the primary ways of executing a SQL injection programming error but they aren‟t the only way for a hacker
attack. to break into. If your underlying software – i.e. the database
295
IJRITCC | APR 2013, Available @ http://www.ijritcc.org
______________________________________________________________________________
International Journal on Recent and Innovation Trends in Computing and Communication

Volume: 1 Issue: 4 293 – 296

______________________________________________________________________________
and the operating system have vulnerabilities, then your coding best practices into their attack prevention
efforts to secure your code become obsolete. This is why mechanisms.
you should always patch your system, especially your SQL
server. VII. FUTURE WORK

5.4 Use the principle of least privilege Future work should focus on evaluating the techniques
precision and effectiveness in practice.Empirical evaluations
The principle of least privilege is a security cornerstone and will be performed which allow comparing the performance
it applies to SQL injections as well. For instance, when you of the different technique swhen they are subjected to real-
grant a user access only to the tables he or she needs rather world attacks and legitimate inputs. As well as precision,
to the whole database; this drastically reduces the damage accuracy and add on will be incorporated for the prevention
potential. of much complex attacks such as Linked Server, Internal
Network Attack etc.

VIII. ACKNOWLEDGEMENT
5.5 Disable shells
We would like to thank our college SIES Graduate school of
Many databases offer shell access which essentially is what Technology for their constant encouragement. We would
an attacker needs. This is why you need to close this door. also like to thank the faculties for their guidance. The
Consult your DB‟s documentation about how to disable Library staff for providing us with the resources that they
shell access for your particular database. had regarding our topic.

5.6 Test your code

IX. REFERENCES
Finally, the last step to ensure your code is SQL injections
proofed is to test it. There are automated tools you can use [1] MeiJunjin: “An approach for SQL injection
to do this and one of the most universal is the SQL Inject vulnerability detection”. 2009 Sixth International
Me Firefox extension. This tool has many options and many Conference on Information Technology: New
tests the best is if you have the time to run all of them. Generations.

VI. CONCLUSION [2] Joao Antunes,Nuno Neves,Miguel Correia, Paulo

Verissimo and Rui Neves has suggested the attack
In this paper, we have presented a survey of current injection methodology in their paper named "Using
techniques of SQL injection as well as a solution Attack Injection to Discover New Vulnerabilities"
methodology for preventing the attacks. To perform this
evaluation, we first identified the various types of SQL [3] http://www.sqlsecurity.com/
Injection attacks .We also studied the different mechanisms
through which SQL Injection Attacks can be introduced into [4] http://www.developerdrive.com/2011/10/how-to-
an application and identified the techniques that are able to prevent-a-sql-injection-attack/
handle the mechanisms. Many of the techniques have
problems handling attacks that take advantage of poorly [5] SQL Injection Cheat Sheet http://ferruh.
coded stored procedures and SQL queries cannot handle mavituna.com/sql-injection-cheatsheetoku/
attacks. This difference could be explained by the fact that
prevention-focused techniques try to incorporate defensive [6] Basics And Working of SQL Injection Attacks
http://www.pctipstricks.net/hacking/basicworking-sql-
injection/

296
IJRITCC | APR 2013, Available @ http://www.ijritcc.org
______________________________________________________________________________