Due Date: Dec 1, 2017  23:59 hours
SQL injection is a code injection technique that exploits the vulnerabilities in the interface between web applications and database servers. The vulnerability is present when user’s inputs are not correctly checked within the web applications before sending to the back-end database servers.
Many web applications take inputs from users, and then use these inputs to construct SQL queries, so the web applications can pull the information out of the database. Web applications also use SQL queries to store information in the database. These are common practices in the development of web applications. When the SQL queries are not carefully constructed, SQL-injection vulnerabilities can occur. SQL-injection attacks are one of the most frequent attacks on web applications.
Setup:
  1. Download and run the virtual server SEEDUbuntu12.04.zip (keep this zip file in case you need to reinstall)
  2. User account: seed / dees
  3. Follow setup instructions from section 2.3 in Lab 3 SQL_Injection.pdf  (Section 2.2 is already completed, section 2.4 is optional)
  4. Learn SQL queries: http://www.newthinktank.com/2014/08/mysql-video-tutorial/
The 40 minute video should teach you enough about MySQL to pass simple interview questions. Scrolling down the blog entry will provide you with a ton of sample SQL statements used in the video for creating, modifying, and searching a database. You may find enough information from these written examples to skip the video.
Program Requirements:
  1. Perform 3.1 (Task 1.1 & 1.2) and 3.2.
  2. Once you have logged into an account without a password and modified someone else’s password, write a short but detailed lab report to describe what you have done and what you have observed, and optionally what didn't work.
  3. You do not need to try any of the countermeasures, but research and describe in your own words the pros and cons of each of the 3 countermeasures described in section 3.3 (Task 3.1, 3.2, and 3.3)
                                                                                 Last Revised: April 29, 2017