SQL Injection through HTTP Headers
resources.infosecinstitute.com
SQL Injection through HTTP Headers
1–10 of 38 posts
Re: SQL Injection through HTTP Headers
#2This seems like a total non-issue. Just CORRECTLY sanitize everything going into the database!
By the way, just to let everyone know also. You should also sanitize form submissions.
Re: SQL Injection through HTTP Headers
#3This seems like a total non-issue. Just CORRECTLY sanitize everything going into the database! By the way, just to let everyone know also. You should also sanitize form submissions.
Or, more succinctly, don't trust anything that comes from outside your application stack.
Re: SQL Injection through HTTP Headers
#4This seems like a total non-issue. Just CORRECTLY sanitize everything going into the database! By the way, just to let everyone know also. You should also sanitize form submissions.
Ha. It turns out the majority of engineers who are not security-conscious don't do this, because it's easy to forget. And there's always another way to get around it, unfortunately.
Re: SQL Injection through HTTP Headers
#5This seems like a total non-issue. Just CORRECTLY sanitize everything going into the database! By the way, just to let everyone know also. You should also sanitize form submissions.
Heh, that's not how most people think. It's more like:
Security! It's a total non-issue! Why would anyone want to break my app?
Most people seem to feel this way until their apps are dumped, rooted, hacked, or they just end up thinking security is cool and say "Man, I didn't realize how much of a mess I had before."
Basic scans need to be part of the CI workflow of startups these days. The same QA tier you use for Selenium and what not you should just throw Nessus/SQLMap at and have injections/vulnerabilities of the web stack fail builds as well.
Re: SQL Injection through HTTP Headers
#6Reddit.com's response headers:
Cache-Control: no-cache
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 18170
Content-Type: text/html; charset=UTF-8
Date: Wed, 04 Apr 2012 04:50:39 GMT
Pragma: no-cache
Server: '; DROP TABLE servertypes; --
Vary: Accept-EncodingRe: SQL Injection through HTTP Headers
#7This seems like a total non-issue. Just CORRECTLY sanitize everything going into the database! By the way, just to let everyone know also. You should also sanitize form submissions.
Or, more succinctly, don't trust anything that comes from outside your application stack.
Or use prepared statements regardless of the source so that knowing the source, and tracking changes of the source of variables, becomes a non-issue.
Re: SQL Injection through HTTP Headers
#8Incredible
Re: SQL Injection through HTTP Headers
#9If using PHP, use PDO and always use parameters.
Use HTMLPurifier to avoid xss.
You still need to be careful if building queries dynamically, such as dynamic WHERE or ORDER by clauses.
Re: SQL Injection through HTTP Headers
#10I once found this in live code which was -- irony alert -- checking Authorization headers. Something of the flavor:
"select user.* from users where TO_BASE64(email + ':'+ password) = '" + headers["Authorization"] + "' limit 1";
(Can't quite remember -- that base 64 bit might have been pre-calculated in a column. It has been a few years.)
One would hope that in addition to fixing the SQL injection they fixed the use of HTTP basic auth over a non-encrypted connection but, well, some stories are probably better left untold.