Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SQL injection search

github.com

Post reply on HN
Print view View original

21–30 of 114 posts

Re: SQL injection search

#21

Post by gtani »

hising wrote: post #19

I guess people would pay for a service that could identify 90% of all security issues with an online service by going through source code and available routes. Anything that is available today?

I've seen quite a few things that are germane, google "static analysis for security",pentesting etc

http://pentestlab.wordpress.com/2012/11/27/automated-source-...

https://www.owasp.org/index.php/Static_Code_Analysis

http://code.google.com/p/yara-project/

http://ulsrl.org/

http://www.lightbluetouchpaper.org/ (the 3rd post

(these aren't the services, these are what you shd read to decide if some service's operatives are appropriately expensive, and up on current research

Re: SQL injection search

#22

Post by yahelc »

Navarr wrote: post #7
thiderman wrote: post #2

Heh, cute. This means Github could probably do some automated means of informing these people that their code is insecure and would be a danger to themselves and their users. I'm not sure if they should, but it's interesting that they could.

I'm pretty sure anyone can write a github bot. I remember there used to be several (some of which would submit pull requests!)

The same bot could notify those people via email using the email address found in commits.

Re: SQL injection search

#23

Post by astrodust »

PanMan wrote: post #13

Nice example, but not all are insecure. For example, the second one here is: $result = mysql_query('DELETE FROM saves WHERE id = '.(int)$_GET['delete']);

That's an example of hazardously bad programming practices. You're one mistake away from complete disaster. You should be sure that it takes more than one mistake to expose you to that sort of risk.

Casting to int is not a general purpose escaping system, and further, if you miss even one of these your entire application can be trashed.

Using mysql_query at all is a sign there's something severely wrong with your application.

Re: SQL injection search

#24

Post by orangethirty »

Looking around I found a simple CMS sold to small online stores. Through their links you can find a listing of their customers (people who use their CMS). Problem is the CMS is open to SQL injection everywhere. If a script kiddie found this info they could take down a lot of online stores. Not good.

Re: SQL injection search

#25

Post by astrodust »

martinml wrote: post #15
marizcombinator wrote: post #6

mysql_query is deprecated... use MySQLi or PDO

MySQLi or PDO will not automatically solve almost any of the security issues found in this search.

Using either of them correctly will.

It is very easy to verify that a mysqli or PDO call is correct by looking at it. The same cannot be said for mysql_query.

Re: SQL injection search

#26

Post by astrodust »

soult wrote: post #14
Killswitch wrote: post #8

Using unsanitized $_GET is the least of their problems considering mysql_* is deprecated.

So a gaping security hole that compromises all data is less important than using a deprecated interface?

For an application with no exposure, arguably it is.

When you upgrade to PHP 5.6 and your application grinds to a halt because mysql_query isn't available, you'll be wishing you'd fixed it sooner.

Re: SQL injection search

#27

Post by astrodust »

orangethirty wrote: post #24

Looking around I found a simple CMS sold to small online stores. Through their links you can find a listing of their customers (people who use their CMS). Problem is the CMS is open to SQL injection everywhere. If a script kiddie found this info they could take down a lot of online stores. Not good.

There are tools that will find these and do all kinds of keep-you-up-at-night terrifying things with your application.

You don't even have to be a script kiddie. You just have to be able to click a button.

Re: SQL injection search

#28

Post by jaytaylor »

Navarr wrote: post #7
thiderman wrote: post #2

Heh, cute. This means Github could probably do some automated means of informing these people that their code is insecure and would be a danger to themselves and their users. I'm not sure if they should, but it's interesting that they could.

I'm pretty sure anyone can write a github bot. I remember there used to be several (some of which would submit pull requests!)

GitHub has not been friendly to bots in the past[1].

[1] https://news.ycombinator.com/item?id=4982240 "GitHub Says ‘No Thanks’ to Bots — Even if They’re Nice"

Post reply on HN