Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SQL Injection Wiki

sqlwiki.netspi.com

Post reply on HN
Print view View original

11–20 of 38 posts

Re: SQL Injection Wiki

#11

Post by dspillett »

altharaz wrote: post #3
grantcox wrote: post #2

The only successful SQL injection attack I've encountered in the wild was interesting, because the injection point had no visible output. But by injecting timing calls (eg "SLEEP()") and appropriate conditionals, the attacker was able to extract a few bits of information each request. Their script executed some tens of thousands of requests, and they managed to extract all the table names, and start to extract data f…

You should take a look at https://sqlmap.org : this tool runs SQL attacks with « raw data output » as you say, but also without outputs (Blind SQL injections).

I'm getting SSL errors on that link: it is presenting GitHub's wildcard certificate which obviously doesn't match.

The site is accessible as plain http (or https if you skip the warnings, of course).

Re: SQL Injection Wiki

#12

Post by zetaben »

amatera wrote: post #9
cm2187 wrote: post #7

Universities and managers must do a little bit of torture, spanking and ruler on the knuckles every time they see a student or a new dev not parameterize a query. It must become a reflex like watching for cars before crossing a street.

Some weeks ago an experience developer said to me: "Parameterize a query? Since years i don't care about it, because ORMs like Doctrine or Sequelize take care of that"... So it's not only students or new devs who should watch out, because even ORMs can open up SQL injections.

Rails is well know for this. Here is a nice page listing common ones: https://rails-sqli.org/

Re: SQL Injection Wiki

#13

Post by [deleted] »

altharaz wrote: post #3
grantcox wrote: post #2

The only successful SQL injection attack I've encountered in the wild was interesting, because the injection point had no visible output. But by injecting timing calls (eg "SLEEP()") and appropriate conditionals, the attacker was able to extract a few bits of information each request. Their script executed some tens of thousands of requests, and they managed to extract all the table names, and start to extract data f…

You should take a look at https://sqlmap.org : this tool runs SQL attacks with « raw data output » as you say, but also without outputs (Blind SQL injections).

[deleted]

Re: SQL Injection Wiki

#14

Post by bwann »

When I did firewall/network support for managed hosting customers, the number of customers' custom/vendor apps that were vulnerable (and exploited!) by SQL injection attacks was astounding. Of course the very first thing they said was "but we have a firewall, why can't you ACL it?" Sorry, your Cisco ASA doesn't work that way. It's like people never expected their code to run in a hostile world.

Re: SQL Injection Wiki

#15

Post by babuskov »

amatera wrote: post #9
cm2187 wrote: post #7

Universities and managers must do a little bit of torture, spanking and ruler on the knuckles every time they see a student or a new dev not parameterize a query. It must become a reflex like watching for cars before crossing a street.

Some weeks ago an experience developer said to me: "Parameterize a query? Since years i don't care about it, because ORMs like Doctrine or Sequelize take care of that"... So it's not only students or new devs who should watch out, because even ORMs can open up SQL injections.

Yeah, before using any ORM I always first check how it inserts the parameter values. If it's a string replacement, you need to be very careful.

Re: SQL Injection Wiki

#16

Post by technion »

grantcox wrote: post #2

The only successful SQL injection attack I've encountered in the wild was interesting, because the injection point had no visible output. But by injecting timing calls (eg "SLEEP()") and appropriate conditionals, the attacker was able to extract a few bits of information each request. Their script executed some tens of thousands of requests, and they managed to extract all the table names, and start to extract data f…

I recommend having a read of this CTF writeup[0], and the Albatar framework that was used to solve it (cannot be done with sqlmap, I tried). It's incredible how far people can go with SQLi.

[0] https://github.com/ctfs/write-ups-2016/tree/master/nullcon-h...

Re: SQL Injection Wiki

#17

Post by Edmond »

cm2187 wrote: post #7

Universities and managers must do a little bit of torture, spanking and ruler on the knuckles every time they see a student or a new dev not parameterize a query. It must become a reflex like watching for cars before crossing a street.

What is needed are modern dev tools that can automate away some of these boilerplate issues...something like this: http://www.codesolvent.com/static-assets/gif-studio/datastat...

It forces parameterization on all queries, you'll have to go out of your way to create a statement that doesn't parameterize it's inputs.

Disclosure: I am the developer of Solvent.

Re: SQL Injection Wiki

#18

Post by geekamongus »

Edmond wrote: post #17
cm2187 wrote: post #7

Universities and managers must do a little bit of torture, spanking and ruler on the knuckles every time they see a student or a new dev not parameterize a query. It must become a reflex like watching for cars before crossing a street.

What is needed are modern dev tools that can automate away some of these boilerplate issues...something like this: http://www.codesolvent.com/static-assets/gif-studio/datastat... It forces parameterization on all queries, you'll have to go out of your way to create a statement that doesn't parameterize it's inputs. Disclosure: I am the developer of Solvent.

Tool are good to assist, but a fundamental understanding of SQLi and how to prevent it are imperative for developers to understand.

Re: SQL Injection Wiki

#20

Post by Edmond »

geekamongus wrote: post #18
Edmond wrote: post #17

Earlier quoted context omitted.

What is needed are modern dev tools that can automate away some of these boilerplate issues...something like this: http://www.codesolvent.com/static-assets/gif-studio/datastat... It forces parameterization on all queries, you'll have to go out of your way to create a statement that doesn't parameterize it's inputs. Disclosure: I am the developer of Solvent.

Tool are good to assist, but a fundamental understanding of SQLi and how to prevent it are imperative for developers to understand.

Agreed, knowing the fundamentals is always preferable...but that is unfortunately a high-bar for most "developers" so it is better to have solutions with builtin guardrails.
Post reply on HN