Scribd
Upload
62 views9 pages

SQL Injection

SQL injection is a code injection technique that allows attackers to manipulate database queries through poorly sanitized input fields. It works by fooling a website into delivering malicious SQL code to its database as a legitimate query. Common SQL injection tools and techniques include SQLMap for automated database takeover, UNION-based attacks to extract data directly, and time-based blind SQL injection that forces delayed responses to reveal data. Major real-world breaches from SQL injection include the 2008 Heartland Payment Systems breach of 130 million card numbers and the 2012 Yahoo! breach of 450 million user credentials. Developers can prevent SQL injection by using prepared statements and input validation, while organizations should implement defenses like web application firewalls.

Uploaded by

zero516y
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
62 views9 pages

SQL Injection

SQL injection is a code injection technique that allows attackers to manipulate database queries through poorly sanitized input fields. It works by fooling a website into delivering malicious SQL code to its database as a legitimate query. Common SQL injection tools and techniques include SQLMap for automated database takeover, UNION-based attacks to extract data directly, and time-based blind SQL injection that forces delayed responses to reveal data. Major real-world breaches from SQL injection include the 2008 Heartland Payment Systems breach of 130 million card numbers and the 2012 Yahoo! breach of 450 million user credentials. Developers can prevent SQL injection by using prepared statements and input validation, while organizations should implement defenses like web application firewalls.

Uploaded by

zero516y
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
You are on page 1/ 9

SQL INJECTION

TOPICS

INTRODUCTION

HOW SQL INJECTION WORK

SQL INJECTION TOOL

TYPE OF ATTACTS

REAL WORLD EXAMPLE

CONCLUSION
INTRODUCTION

SQL injection is a code injection technique


that might destroy your database. SQL
injection is one of the most common web
hacking techniques. SQL injection is the
placement of malicious code in SQL
statements, via web page input.
How SQL
Injection Work
When the hacker inputs, or injects,
malicious SQL code — a form of malware
known as the payload — on the website
and fools it into delivering that code to its
database as a legitimate query. For
example, the most common example is
SQL injection, where an attacker sends
“101 OR 1=1” instead of just “101”.
SQL Injection Tools

SQLMap - Automatic jSQL Injection - Java BBQSQL - A Blind NoSQLMap -


Whitewidow - SQL
SQL Injection And Tool For Automatic SQL SQL Injection Automated NoSQL
Vulnerability Scanner
Database Takeover Tool Database Injection Exploitation Tool Database Pwnage

Blisqy - Exploit Time-


explo - Human And
Blind-Sql-Bitshifting - Leviathan - Wide based blind-SQL
DSSS - Damn Small Machine-Readable Web
Blind SQL Injection via Range Mass Audit injection in HTTP-
SQLi Scanner Vulnerability Testing
Bit shifting Toolkit Headers
Format
(MySQL/MariaDB
Types of Attacks

Boolean-based Blind SQLi: An attacker sends Union-based SQLi: This attack uses the UNION Time-based Blind SQLi: The attacker’s query
SQL queries that return different results SQL operator to combine a malicious query with a forces the database to delay its response, revealing
depending on a true or false condition. The legitimate one, extracting data directly through data based on the time taken to respond, useful
attacker infers data structure by observing changes application responses. when actual data isn't returned.
in application responses.
Real world Example

2008 2012
Heartland Payment Systems (2008): An SQL Injection attack Yahoo! (2012): An SQL Injection attack resulted in a breach of
compromised 130 million credit and debit card numbers, 450,000 Yahoo! user credentials.
making it one of the largest breaches in history.

Sony Pictures (2011): An SQL Injection vulnerability was used


in an attack that led to the leak of thousands of confidential
documents, emails, and unreleased films.

2011
conclusion
SQL injection is a critical security vulnerability that can allow
attackers to manipulate database queries through poorly sanitized
input fields in applications. The real-world implications of such
attacks can be severe, ranging from unauthorized data access and
theft to complete system compromise. To safeguard against SQL
injection, it is essential for developers to employ secure coding
practices, such as using parameterized queries, prepared statements,
and input validation. Organizations should also conduct regular
security audits and implement layers of defense, like web
application firewalls, to detect and mitigate potential SQL injection
attempts. By understanding the methods and tools attackers use and
proactively securing applications, the risk of SQL injection can be
significantly reduced, protecting both the organization and its users
from the far-reaching consequences of a successful attack.
Any
Question
?

You might also like