APPLICATION SECURITY

SQL Injection Attacks:

Working and Countermeasures

Muhammad Nadeem
[email protected]
 SQL INJECTION ATTACK
User ID Administrator

Password abc

Select * from users where userID= ‘ ’ and password = ‘ ’

User ID Administrator

Password xxx ’ OR ‘a’=‘a

Select * from users where userID= ‘ ’ and password = ‘ ’

06/15/2025 Application Security 2

 CONTENTS…

• Introduction
• Types of SQL injection attacks
• How to counter SQLIA
• Tool Demo: FindBugs®
• Best practices
• Q&A

06/15/2025 Application Security 3

 INTRODUCTION

06/15/2025 Application Security 4

 INTRODUCTION

SQL injection attacks are most dangerous

They are threat to privacy

They cause financial loss

Perfect solution does not exist

06/15/2025 Application Security 5

 OWASP TOP 10 VULNERABILITIES
2004 Top 10 2007 Top 10 2010 Top 10 2013 Top 10 2016 Top 10
A1 Unvalidated Input A1 Cross Site Scripting A1: Injection A1 Injection A1 Injection
A2 Injection Flaws A2: Cross-Site Scripting A2 Broken Auth. and A2 Broken Auth. and
A2 Broken Access
A3 Malicious File Exec. A3: Broken Auth. and Session Management Session Management
Control
A4 Insecure Direct Object Session Management A3 Cross-Site Scripting A3 Cross-Site Scripting
A3 Broken Auth. and A4 Insecure Direct Object
Session Management Reference A4: Insecure Direct Object A4 Broken Access Control
References References
A5 Cross Site Request A5 Security
A4 Cross Site Scripting A5 Security
Forgery (CSRF) A5: Cross-Site Request Misconfiguration
A5 Buffer Overflow Misconfiguration
A6 Information Leakage Forgery (CSRF) A6 Sensitive Data
A6 Injection Flaws and Improper Error A6 Sensitive Data Exposure
A6: Security Exposure
A7 Improper Error Handling Misconfiguration A7 Missing Function Level
Access Control A7 Insufficient attack
Handling A7 Broken Auth. and A7: Insecure protection
Session Management A8 Cross-Site Request
A8 Insecure Storage Cryptographic Storage A8 Cross-Site Request
Forgery (CSRF)
A9 Application Denial of A8 - Insecure A8: Failure to Restrict URL Forgery (CSRF)
A9 Using Components with
Cryptographic Storage Access
Service Known Vulnerabilities A9 Using Components
A9 - Insecure A9: Insufficient Transport
A10 Insecure A10 Unvalidated Redirects with Known
Communications Layer Protection
Configuration and Forwards Vulnerabilities
A10 - Failure to Restrict A10: Unvalidated
Management A10 Unprotected APIs
URL Access Redirects and Forwards
Source: https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project

06/15/2025 Application Security 6

 OWASP TOP 10 VULNERABILITIES
2010 Top 10 2013 Top 10 2016 Top 10 2020 Top 10
A1: Injection A1 Injection A1 Injection A1 Injection
A2: Cross-Site Scripting A2 Broken Auth. and A2 Broken Auth. and A2 Broken Authentication
A3: Broken Auth. and Session Management Session Management A3 Sensitive Data
Session Management A3 Cross-Site Scripting A3 Cross-Site Scripting Exposure
A4: Insecure Direct Object A4 Insecure Direct Object A4 XML External Entities
A4 Broken Access Control
References References (XXE)
A5 Security
A5 Security
A5: Cross-Site Request Misconfiguration A5 Broken Access control
Misconfiguration
Forgery (CSRF) A6 Sensitive Data A6 Security
A6 Sensitive Data Exposure
A6: Security Exposure misconfigurations
Misconfiguration A7 Missing Function Level
Access Control A7 Insufficient attack A7 Cross Site Scripting
A7: Insecure protection (XSS)
A8 Cross-Site Request
Cryptographic Storage A8 Cross-Site Request A8 Insecure
Forgery (CSRF)
A8: Failure to Restrict URL A9 Using Components with Forgery (CSRF) Deserialization
Access Known Vulnerabilities A9 Using Components
A9 Using Components
A9: Insufficient Transport A10 Unvalidated Redirects with Known with known
Layer Protection and Forwards Vulnerabilities vulnerabilities
A10: Unvalidated A10 Unprotected APIs A10 Insufficient logging
Redirects and Forwards and monitoring
Source: https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project

06/15/2025 Application Security 7

 INTRODUCTION
• One of the earliest SQL Injection attack: Feb 2002
o On Guess.com customers database
o Permitting attacker to pull down 200,000+ names, credit card numbers and expiration dates
by a properly-crafted URL

• 7% of the total reported incidents caused by SQL Injections (nvd.nist.gov, 2011)

• According to Wikipedia: 71 SQL Injection attacks attempted every hour (2013)

06/15/2025 Application Security 8

 INTRODUCTION: RECENT INCIDENTS

• August 17, 2009, United States Department of Justice charged three suspects with
the theft of 130 million credit card numbers using SQL injection attack (Considered
“the biggest”)

• April 13, 2008, Oklahoma, 10,597 Social Security numbers were downloaded via an
SQL injection attack

• January 13, 2006, computer criminals broke into a Rhode Island government web
site and stole credit card data of individuals who have done business with state
agencies

06/15/2025 Application Security 9

 ~136,000 vulnerable
components

06/15/2025 Application Security 10

 ~9,000 SQL Injection Vuln.

06/15/2025 Application Security 11

06/15/2025 Application Security 12
 SQL INJECTION VULNERABILITIES REPORTED
1515

1112

713 684
648
588

273
206 175
159 160 123 144
99
50 56
2 7
2000

2001

2002

2003

2004

2005

2006

2007

2008

2009

2010

2011

2012

2013

2014

2015

2016

2017
Source: Common Vulnerabilities and Exposures (CVE) repository
https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=SQL+injection

06/15/2025 Application Security 13

 TYPES OF SQL INJECTION ATTACKS

06/15/2025 Application Security 14

 TYPES OF SQL INJECTION ATTACKS

Tautologies

Select * from users where userID= ‘’ and password= ‘’ OR 1=1 – –’

06/15/2025 Application Security 15

 TYPES OF SQL INJECTION ATTACKS

Union
Queries

Select * from users where userID= ‘’ and password= ‘’ UNION select

CARDNO from CREDITCARDS – –’

06/15/2025 Application Security 16

 TYPES OF SQL INJECTION ATTACKS

Piggybacked
Queries

Select * from users where userID= ‘’ and password= ‘’; Drop table
users – –’

06/15/2025 Application Security 17

 TYPES OF SQL INJECTION ATTACKS

Stored
Procedures

Create procedure SP_ProductSearch @prodname varchar(400) = NULL

AS Declare @sql nvarchar(4000) SELECT @sql = ' select ProductID, …

06/15/2025 Application Security 18

 TYPES OF SQL INJECTION ATTACKS

Malformed
Queries

Take advantage of overly descriptive error messages

when an erroneous query is sent for execution

06/15/2025 Application Security 19

 TYPES OF SQL INJECTION ATTACKS

Alternate
encoding

Hex: 3b2044726f70207461626c6520757365727320962d92
Equivalent: ; Drop table users – –’

06/15/2025 Application Security 20

 TYPES OF SQL INJECTION ATTACKS

Inference

Attacker runs series of tests which evaluate to true or false

hence giving the insight of the database

06/15/2025 Application Security 21

 HOW TO COUNTER SQL INJECTION ATTACKS?

06/15/2025 Application Security 22

 DESIGN VS. RUNTIME APPROACHES
Design time
approaches
Used before a system is put into the execution mode

Runtime
approaches Used when the system in the execution mode
(real time vs. post attack)

Hybrid
approaches
Have both the design time and runtime components

06/15/2025 Application Security 23

 DISCUSSION ON DIFFERENT APPROACHES
• Keyword randomization approach
• Signature based approach
• Input sanitization-based approach

06/15/2025 Application Security 24

 KEYWORD RANDOMIZATION
• A secret word for every SQL keyword:

Select  secret01
*  secret02
From  secret03
Where  secret04
=  secret05
and  secret06
‘  secret07
…
06/15/2025 Application Security 25
 KEYWORD RANDOMIZATION
User ID Administrator

Password abc

Select * from users where userID =‘ ’ and password = ‘ ’

sec01 sec02 sec03 users sec04 userID sec05 sec07 sec07 sec06 password sec05 sec07 sec07

Select * from users where userID =‘administrator’ and password = ‘abc’

06/15/2025 Application Security 26

 KEYWORD RANDOMIZATION

User ID Administrator

Password none’ OR 1=1 --

sec01 sec02 sec03 users sec04 userID sec05 sec07 sec07 sec06 password sec05 sec07 sec07

Illegal keywords/
characters

06/15/2025 Application Security 27

 LIMITATIONS OF KEYWORD RANDOMIZATION

• List of secret words may be compromised

• The keywords such as OR, AND, SELECT, and FROM etc. may appear in
user input

06/15/2025 Application Security 28

 STORING QUERY SIGNATURE

Create signatures for all legitimate queries at design time.

Validate all queries at runtime.

Queries Queries Signature

Signature Query
extracted from (at runtime) calculator
calculator Signature
program source

Query
Accept Compare
Signature

DESIGN TIME RUN TIME Reject

06/15/2025 Application Security 29

 LIMITATIONS OF SIGNATURE BASED APPROACH

• Overhead to compare every query at runtime

• May restrict the flexibility

06/15/2025 Application Security 30

 INPUT SANITIZATION

06/15/2025 Application Security 31

 INPUT SANITIZATION

• Sanitize the following

Select * from products where prID=23; Drdeleteop tadropble products

Select * from products where prID=23; Drop table products

Input sanitization might not always work!

06/15/2025 Application Security 32

 How to detect SQL injection vulnerability in your source
code?
DEMO…

06/15/2025 Application Security 33

 DEMO: FINDBUGS

• Version 3.0.1
• Open source static code analysis tool
• Scans Java code
• Finds different type of vulnerabilities including SQL injection
vulnerability
• http://findbugs.sourceforge.net/downloads.html

06/15/2025
Application Security 34
 FALSE POSITIVES / FALSE NEGATIVES
Code repository
V1 V4 V1

V2
V1
V3 V3
V3 Vx Example of False Positive

V4 V2 Example of False Negative

……

…
Static analysis
Vn

Vx

V4 Vn

Application Security 35
 FALSE POSITIVES / FALSE NEGATIVES

• Almost all the tools generate false positive and false negative results

• False Positive
– A false alarm for a vulnerability when it is actually not there

• False negative
– No alarm for a vulnerability when it actually exists in the code

06/15/2025 Application Security 36

 LIST OF VULNERABILITY SCANNING TOOLS…

06/15/2025 Application Security 37

06/15/2025 Application Security 38
 HUNTING FOR VULNERABILITIES

06/15/2025 Application Security 39

 HUNTING VULNERABILITIES
• Reconnaissance
• Build Vulnerability Hypothesis
– (e.g., I got this form, I think I can inject code)
• Test Hypothesis
• Develop Exploit
• Profit (bounty)/ Protect the World

06/15/2025 Application Security 40

APPLICATION SECURITY

[email protected]
06/15/2025 Application Security 41