Hello.
I will use the VVWA project from GitHub that shows the various vulnerabilities, including SQL injection
and then check how to mitigate them programmatically.
Let's try the first laboratory on sql injection. Lets you understand what the vulnerability consists
of.
I have set up a login page which allows a user to authenticate. Trying with wrong credentials
You will not be able to enter.
Sometimes you can tell if an application is vulnerable to SQL injection by simply injecting a single
quote, which is the character that encloses alphanumeric data
in SQL. The server side query is created by concatenating parts of fixed
sql to sql
tied to user input, then injecting the single quote you can force to generate an incorrect
sql query.
And if the server-side exceptions are not handled
It will allow you to view the details of the error on the browser.
This may indicate the presence of the vulnerability in the server side code.
Now let's try to insert a classic sql injection pattern
that is ' or 1=1;-- for the user name and anything in the password field.
The.
And we managed to enter the reserved section without knowing valid credentials.
So let's see now how you can mitigate the vulnerability programmatically.
Let's go back to the source code of the login page and we comment on the vulnerable SQL query
version, and uncomment the parametric query version.
OK.
And so this will have mitigated the problem.
Now, let's try to put the application back in execution and try again to inject the malicious pattern.
So.
OK.
But this time you see the authentication failed message. So the attack failed.
In applications where data access occours through Object Relational Mapping (ORM) such as in .NET
through Linq to Entities queries
the problem of sql injection is already mitigated natively.
This is because the values possibly deriving from a user input at the Linq query level would be
natively considered as parameters.
The problem we have seen can only exist with .Net, PHP or in Java by creating non parametric queries
that link fixed sql server-side to user input.