DEMO: Structured Query Language (SQL) Injection

Just a reminder that this is for educational and ethical hacking purposes only. This is to protect systems, not to compromise them.

Finding It in the CWE

I'm on the Common Weakness Enumeration site. What I'm going to do is expand all, and we're going to search amongst all of those weaknesses for a SQL injection. And so here we have the SQL injection, and we see that it's part of all of these injection types of attacks. So it's a very common one that's out there. I'm going to right-click on this and open it up. We see it's CWE-89, and it gives a little description of the SQL injection attack and what it looks like.

A SQL injection attack is when a user is going to inject certain code or certain instructions that are going to access certain resources on a database that they normally wouldn't or shouldn't have access to.

The Front End and the Back End

This is a really common setup out there, where you have some sort of application on the front end — maybe it's some sort of web application or other type of application — and then on the back end you have a database server. Now, sometimes these are part of the same server. Many times they are separate services, so you have a physical server running the databases and you have physical servers that are running the application. Either way, what happens is that this app makes calls to the database and requests certain information, or adds information to the database. It's constantly deleting data or changing data, adding data, or just retrieving data.

So in this scenario right here, we're going to say that this is a web application on the front end. We have a database on the back end, and within this database we have many tables. One of the tables is the user table. Inside the user table we have many records. Here we have records specifying people's username and password.

The front-end server here, this web application, is going to be utilizing services on this database server. One of the things is maybe that somebody is logging in. Well, they need to verify the username and password, so it needs to retrieve information from this database. What it does is it does that through some sort of language, some sort of commands that it's submitting. One of the really common ones is the structured query language, or SQL. SQL is a language, and it's a way of forming commands so that one device can request information from the database server.

Reading the SQL Command

So in this example right here, we have this web application that's creating a SQL command that's going to be submitted to the database server, to get information from one of these users and get their password information, or however they're verifying this information.

These SQL commands consist of different commands within them. We see this select, and from, and where. These are all different types of commands that join this data together to request certain information. We see that there's a star here, which means select all, so it's looking at all of the users. So this is the table right here, and we are selecting all the users from the users table. And then we specify where the username is, and we're getting somebody specific here, some username and password. So what this might look like is selecting from the user table here the username John Connor, or John L. Connor, and the password Skynet sucks.

What the user ends up doing is submitting their username and password into the application, and then the application forms this SQL call that gets sent to the server here. What's happening is that this username gets entered into this username field right here, and the password gets entered into the password field right here.

Nesting a Command Inside the Input

And so what we can see is that this has an opportunity where we could nestle other commands right inside of this. So if we put other types of commands in here, what we see is we've got a single quote, then or, and then quote one quote equals quote one quote. Now, what that's doing is putting that in there for the username part. And we see the same thing for the password right here.

So by entering in these commands, what essentially has happened is now we have this command line where it's looking for a specific username and password. In this case, they're just null usernames and passwords, or the keyword here is or 1 equals 1, which is a true statement, and it's got that for both the username and password. So what essentially this is telling the application is that, oh yes, this is true, I have logged in with accurate usernames and passwords, something that is acceptable. And so now, with this or 1 equals 1 for both username and password, we now gain access into this system. We now have our ability to log into this system without any knowledge of a username and password that gives us access into the system.

The Web Form

Here's a simple web form. What's happening here is it's going to make a call to the SQL database. Now, this page right here, this employees.htm, is running on the same server that the database is running on.

What I'm going to do is search for somebody's name — that's the purpose of this, is searching for somebody's name. So I can search for Arthur Dent and hit search, and it comes up. Their ID is 101. So the other thing I could do is search for somebody's ID. I could say, well, who is 102 then? And do a search. And now I'm finding information here about this database.

But we want to actually enter in some code in here and leverage the system to be able to look up data that we might not necessarily, or shouldn't necessarily, have access to. So what we're going to start out with is just a single X. If I were to hit search, then it doesn't come up with anything. But what I'm going to do then is say, well, I'm searching for X, and then I'm going to put a single quote in here. And remember, that single quote on the back end is like it's now moving on to the next command.

So we can now start putting in the next command, which is going to be union. Union is joining data together, and it's one of the SQL commands. And we're going to select data — we want to select all data — and we're going to select it from the employees database. And then the hash symbol then ignores everything after that. And I need to make sure I spell things correctly. So the hash then essentially comments out the rest of the line.

So we're going to hit search, and then we get the full database. So now we see all of the data in the database, and we have access to the rest of this data.

So here's the code on the back end. Here's what is trying to be executed on this line right here that I have. And down below is what, by putting those extra pieces of information in, we end up putting in. What we end up putting in is this X here — we've got this single quote, X, single quote — and then it executes the rest of this command, which is union select star from employees pound, and then that kind of ignores the rest of this. Then the rest of it is quoted out. So that's what's being executed now on this server.

So it really allows us to do a lot of different things. We can bypass logins. We can view unauthorized information. We can change data, delete data, add data. So there's a lot of different things we can do with these SQL commands.

The Attack Card

Here's that attack card on a SQL injection attack. What we're doing is we're utilizing inputs into a system that get entered into the application, and eventually the database, to be able to do things like add, modify, delete, or extract data. It's mapped to CWE-89; it's correlated with that. And this of course is only effective if it's a SQL database on the back end. There are other types of databases, but there needs to be a database that accepts SQL commands. And there's quite a few different ones that are out there. It's one of the more common languages that we use to communicate with these databases.