SQL injection search • Hacker News Board

Re: SQL injection search

#61

Post by jt2190 » Sat, Jun 01, 2013, 9:34 PM UTC

ams6110 wrote: post #39

Some of these look like deliberate examples of vulnerable code (e.g. the one named "Injection.SQL.php") Alarmingly (and sadly) most do not.

No need to be alarmed (or sad.)

Without some real-world context for each project, we just can't say whether the code we're looking at represents a real security problem. I'm certain that github hosts just as many one-off, let-me-scratch-some-code-together-that-I'll-never-use-again type projects as it does hard core, production quality ones.

That said it's a neat technique for quickly auditing code. Someone should now write an automated tool for submitting security patches to all of these projects.

Re: SQL injection search

#62

Post by postfuturist » Sat, Jun 01, 2013, 9:49 PM UTC

This isn't a search for SQL injection, its a search for a couple things that you often find in older PHP code that is generally hacked together and likely to have SQL injection vulnerabilities for historical and cultural reasons. However it's perfectly easy to avoid SQL injection even using these things.

    $id = mysql_real_escape_string($_GET['id']);
    $res = mysql_query("SELECT foo FROM bar WHERE id='$id'");

That may be ugly, but it's bulletproof regarding injection.

Re: SQL injection search

#63

Post by egsec » Sat, Jun 01, 2013, 9:59 PM UTC

sage_joch wrote: post #58

This is a potentially great idea. You could make your build process include submitting your code to a search engine like this (perhaps in some obfuscated manner) and making illegal patterns fail if not manually "approved". Just because the halting problem exists doesn't mean there's not a low hanging fruit in approaching it.

Not sure if this search would be good, but your responses triggers the id of a distributed code review like reCAPTHA. Possibly a pattern search brings up suspicious code and then there is distributed review and once enough people flag it as SQL injection, it could be flagged on Github and someone could submit a patch, etc. Clearly not bulletproof, but this would provide a way of doing code review on projects you might have no other interest in helping.

Re: SQL injection search

#64

Post by wisty » Sat, Jun 01, 2013, 10:18 PM UTC

pjscott wrote: post #57

tptacek wrote: post #37

There's a joke to be made here about "broken crypto search".

I'll make that joke, but it won't be very funny. https://github.com/search?p=2&q=MD5+password+extension%3... https://github.com/search?q=CURLOPT_SSL_VERIFYHOST+NOT+depre... There's more low-hanging fruit, if you're willing to use more specialized searches. For example, guess what mode of operation the PyCrypto library uses by default for all its block ciphers if you don't explicitly pick a sane one: https://github.co…

Also, look for "cookie secret" or anything which looks like a cert file.

Re: SQL injection search

#65

Post by jesstaa » Sat, Jun 01, 2013, 10:28 PM UTC

sage_joch wrote: post #58

This is a potentially great idea. You could make your build process include submitting your code to a search engine like this (perhaps in some obfuscated manner) and making illegal patterns fail if not manually "approved". Just because the halting problem exists doesn't mean there's not a low hanging fruit in approaching it.

Yep, It's called 'static analysis'. http://en.wikipedia.org/wiki/Static_program_analysis

Re: SQL injection search

#66

Post by [deleted] » Sat, Jun 01, 2013, 10:36 PM UTC

jesstaa wrote: post #65

sage_joch wrote: post #58

This is a potentially great idea. You could make your build process include submitting your code to a search engine like this (perhaps in some obfuscated manner) and making illegal patterns fail if not manually "approved". Just because the halting problem exists doesn't mean there's not a low hanging fruit in approaching it.

Yep, It's called 'static analysis'. http://en.wikipedia.org/wiki/Static_program_analysis

[deleted]

Re: SQL injection search

#67

Post by shakesbeard » Sat, Jun 01, 2013, 10:54 PM UTC

martinml wrote: post #15

marizcombinator wrote: post #6

mysql_query is deprecated... use MySQLi or PDO

MySQLi or PDO will not automatically solve almost any of the security issues found in this search.

90% of example code for PDO uses prepared statements. 90% of example code for the mysql_* functions is ancient and full of security holes.

Re: SQL injection search

#68

Post by siddboots » Sat, Jun 01, 2013, 10:55 PM UTC

postfuturist wrote: post #62

This isn't a search for SQL injection, its a search for a couple things that you often find in older PHP code that is generally hacked together and likely to have SQL injection vulnerabilities for historical and cultural reasons. However it's perfectly easy to avoid SQL injection even using these things. $id = mysql_real_escape_string($_GET['id']); $res = mysql_query("SELECT foo FROM bar WHERE id='$id'"); That may be…

Most of the search results show exploitable code. Regardless, this is a search for SQL injection vulnerability, even if not every search result falls under that category.

Re: SQL injection search

#69

Post by sage_joch » Sat, Jun 01, 2013, 11:00 PM UTC

jesstaa wrote: post #65

sage_joch wrote: post #58

This is a potentially great idea. You could make your build process include submitting your code to a search engine like this (perhaps in some obfuscated manner) and making illegal patterns fail if not manually "approved". Just because the halting problem exists doesn't mean there's not a low hanging fruit in approaching it.

Yep, It's called 'static analysis'. http://en.wikipedia.org/wiki/Static_program_analysis

Heh. I sure romanticized a semi-mundane thing that already exists. ;-)

Re: SQL injection search

#70

Post by twistedpair » Sat, Jun 01, 2013, 11:21 PM UTC

sage_joch wrote: post #58

This is a potentially great idea. You could make your build process include submitting your code to a search engine like this (perhaps in some obfuscated manner) and making illegal patterns fail if not manually "approved". Just because the halting problem exists doesn't mean there's not a low hanging fruit in approaching it.

Tons of code review tools already exist out there, runnable on your CI machine. Sonar and Fortify are a few off the top of my head, but there are many, many more.

Nothing new here. Google code search a while back was similar. Also search for index.php~, a great way to see the source for an index page with a unix temp file that Apache will forward as plain text. Oops.