Due Date: Dec 1, 2017 23:59 hours
SQL injection is a code injection technique that exploits the vulnerabilities in the interface between web applications and database servers. The vulnerability is present when user’s inputs are not correctly checked within the web applications before sending to the back-end database servers.
Many web applications take inputs from users, and then use these inputs to construct SQL queries, so the web applications can pull the information out of the database. Web applications also use SQL queries to store information in the database. These are common practices in the development of web applications. When the SQL queries are not carefully constructed, SQL-injection vulnerabilities can occur. SQL-injection attacks are one of the most frequent attacks on web applications.
Setup:
- Download and run the virtual server SEEDUbuntu12.04.zip (keep this zip file in case you need to reinstall)
- User account: seed / dees
- Follow setup instructions from section 2.3 in Lab 3 SQL_Injection.pdf (Section 2.2 is already completed, section 2.4 is optional)
- Learn SQL queries: http://www.newthinktank.com/2014/08/mysql-video-tutorial/
The 40 minute video should teach you enough about MySQL to pass simple interview questions. Scrolling down the blog entry will provide you with a ton of sample SQL statements used in the video for creating, modifying, and searching a database. You may find enough information from these written examples to skip the video.
Program Requirements:
- Perform 3.1 (Task 1.1 & 1.2) and 3.2.
- Once you have logged into an account without a password and modified someone else’s password, write a short but detailed lab report to describe what you have done and what you have observed, and optionally what didn't work.
- You do not need to try any of the countermeasures, but research and describe in your own words the pros and cons of each of the 3 countermeasures described in section 3.3 (Task 3.1, 3.2, and 3.3)
- 3.1 Hints: Should be very simple. Go to the logon page of the website and type a username (like admin) plus a short SQL injection code immediately afterward. Password should be blank. Hitting enter should log you on to the account without needing to enter the account password. If nothing works, you may not have disabled the SQL injection protection. Revisit setup step #3.
- Many possible solutions, but if you use something similar, make sure that there is a space and a character following your ‘--
- 3.2 Hints: Don’t forget to start your injection attack with a valid name to set the name field in the form (as this can cause a conflict in the primary keys)
- Knowing the list of users and their ID numbers could also be useful, but is not required for all attacks. The admin account is one place to discover the list of users.
- You may use http://hash.online-convert.com/sha1-generator to generate a SHA1 password.
- Hint: Successful injection attacks will not result in a blank response screen.
- Additional Hint: certain SQL injection instructions may corrupt your database. If you are unable to login as a user to the website, delete & unzip the virtual machine again. Make sure to disable the database protections a 2nd time if you reinstall.
Last Revised: April 29, 2017