The SQL injection is one of the more common attacks that
is used today because it's one of the ones
that some software developers never think
to harden their code against.
So what we're going to do in this particular skills, first
of all, we're going to introduce application architecture.
What is SQL in the first place?
What does a SQL database do, and then we'll
introduce how this exploit-- how this exploit could
be used in a website to access or change
our data in a database.
And it's going to be really fun, because at the end
of this Nugget, we're actually going to demonstrate
a way that you can practice SQL injection WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
a way that you can practice SQL injection
and learn how hackers actually work
through the process of performing this attack.
Let's get going.
In order to really understand a lot of attacks,
you really need to understand how applications work
on the most basic level, and what
we're going to do before we jump into the SQL injection is
talk about, what does an application really
do under the hood?
What does SQL do?
What does the SQL database do?
Where does all of this tie-in together, and then
we can understand how attackers are going WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
we can understand how attackers are going
to try to exploit this attack.
So what I want you to do here is I want
you to imagine this is you.
You're smiling and you're happy, and you're
shopping online on your favorite online retailer, who
might offer two-day free shipping and video streaming
services and books and all sorts of other good things like that.
From what you see, you just log in to the website,
you start adding things to your cart,
and then you click Purchase.
Under the hood, a lot of things happen.
So let's explore for a moment theoretically
about how this application may be working. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
about how this application may be working.
You see, you've added something to your cart.
I'm just going to create a little bean here,
and I'll draw some pink things to represent
what you're buying, and these things
are now sitting in your car.
You've got them locked and loaded and ready to go,
and now you're ready to purchase it.
What's important for this application to do
is to create a record of your purchase.
It needs to know things like, where is it shipping to?
What credit card did it charge?
Was the charge successful?
What was the shipping that it promised?
So the first thing the application does WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So the first thing the application does
is it sends all of this information to a server,
and this is one of the first and most important aspects
to focus on.
All of this stuff that you've been doing up to this point
took place in your web browser, like Firefox, for instance.
Your browsing the website, you're
adding things to your cart.
You're clicking on things and making
little dialog boxes pop up, and all of that
is happening in your web browser.
Because your web browser has downloaded some files
like an HTML file or a JavaScript file
or a CSS file, that's really all that a web browser does WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
or a CSS file, that's really all that a web browser does
is it downloads these little documents
and turns them into a pretty page
that you can interact with.
But once it's time to do something actionable,
like creating a purchase so that it charges your credit card
and it goes to the shipping, that information
leaves the web browser, and it first goes into a server.
This is oftentimes called the application server
or the back end server.
So all of your purchase order information
arrives at the server, and the server WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
arrives at the server, and the server
has a little application that's running
on it that looks at this information and validates it.
It validates that information was entered correctly
and formatted correctly, and it understands
who is trying to work with, and then
it sends information all over the place.
Once it's validated that your order is successful,
it may send information down to the shipping team.
It may send information to an analytics team,
or maybe even a customer support team.
That way, someone can follow up with you on your purchase. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
That way, someone can follow up with you on your purchase.
But then ultimately, what has to happen
is this record of your purchase has to be stored in a database.
So one of the very next things that our server is going to do
is it's going to send this data into a database.
You can think of a database as nothing
more than a gigantic collection of Excel files.
If you've worked with an Excel sheet before,
you're in good company.
You probably understand or you could look at a database
and understand what's happening here.
And these databases are often run
with the SQL structured query language programming language. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
with the SQL structured query language programming language.
So for kind of recapping the journey,
your little web browser has downloaded a website
and you've interacted with it and triggered an action.
So your web browser and the website
send information to the server.
If you're curious, the server's probably running a programming
language like C# or JavaScript.
And then from here, the server will validate that information
and send it all over to all the different resources,
including to the SQL server database,
and it communicates to this using the SQL programming WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and it communicates to this using the SQL programming
language.
And this is the architecture of the three tier application.
You have the web tier, you have the app tier,
and then you have the database tier.
So this now begs the question, what
is the SQL injection attack?
What is a hacker trying to do.
Let me clear the screen and tell you a little bit more
about the SQL injection.
Now, we imagine that we're on that same website.
And at the very top of that website, there is a search bar.
If the web application itself has not
been programmed correctly to parse WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
been programmed correctly to parse
the information in a search bar and validate that it's good
first, we could actually write actual computer code
in the search bar and try and send that computer code
straight into the server or straight into the database.
This is called an injection.
And in the SQL injection attack, what
a hacker is trying to do is they're trying to manipulate
the search bar to actually write SQL code that may look
something like select star from database, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
something like select star from database,
so that when they click the Search button,
it sends this SQL code straight into the database to retrieve
information out of the database but what comes back
is the actual search query from the database.
So with that in mind, let's take a little moment, just
like a 30-second overview of what SQL really does.
When we see a Select statement written in SQL,
what it's trying to say is retrieved data
from the database.
Select data from the database.
And when you see something like select star from, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And when you see something like select star from,
this is saying select all data from a specific table,
or a fancy way of saying an Excel sheet,
out of the database.
So if I were to type this into my search bar and click Go,
the website would end up going to the database
and retrieving all data out of this table
and returning that back to me.
But beyond that, outside of just retrieving data
from a database, we can use an Insert statement
to write data to a database.
We can use a Delete statement to delete data from a database. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We can use a Delete statement to delete data from a database.
We can use a drop statement to delete an entire table
or entire database from a database,
and depending on what the hacker's objective is
will determine which type of statement he'll they'll use.
They could use a select statement
to retrieve say credit card information or usernames
and passwords.
They could use an Insert statement
to write new records to the database that
are totally bogus and spoofed.
They could use a drop or a Delete statement
to try and damage the database by taking it down and deleting WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to try and damage the database by taking it down and deleting
information out of it.
So the mitigation technique here is
to look at the code to tell your application
server to first look at what they searched for
and try and determine if it's a programming language
like a Select statement.
In fact, if you looked at the very name of this video,
it looked like a SQL injection.
But now, it's time to see it in action.
This is the part where I want to show you a resource where
you can actually practice this attack
and walk through the steps that our hacker will actually WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and walk through the steps that our hacker will actually
go through.
This is so cool.
Let me clear the screen, and we're
going to bring up a web browser, and I
encourage you to follow along.
The website that we're going to, as you can see on the screen,
is hacksplaining.co m/exercises/sqlinjection.
If I give that a click, this is it.
They've now simulated a little banking website,
where we can try and inject SQL code into the login
and password.
So this little pop up box here is a guide
that's going to walk you through the steps of how to perform
this attack and what the hacker would actually WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
this attack and what the hacker would actually
look for in the real world.
You can click on these to move forward,
and this is what it's doing.
It's showing you the actual log of your website.
If you press F12 in your web browser,
this is where you could actually view the logs of your website.
It's right here in this little console section.
This is what they're trying to tell you.
This is what you would be looking for if you were
trying to attack this website.
So let me close this to bring up some screen here,
and it says here are the application logs.
Watch what happens when you interact
with a vulnerable application.
So it tells you, try and type in this password and email address WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So it tells you, try and type in this password and email address
and click Log In.
Well, it says this is an unknown password,
but now, what they're encouraging us to do
is to add in a single quote in the password field.
You see, in SQL, quotes denote text.
So our assumption is that somewhere in their SQL code,
they've created an open quote and we're now
injecting a close quote in that text field.
So if I click Log In now, it says
there's an unexpected error, but look at this.
Look right here. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Look right here.
The log has now spit out the secret code that's failing,
and now we know that we have direct access to the SQL
database.
So we'll step through it one more time, and it points out,
hey, look, here's the SQL syntax error that it's throwing.
And from that, we can now actually see the SQL code
that it's trying to run, and we see
where we've injected the additional single quote.
So if I type password and single quote, we've now seen,
each time I type the quote and then delete the quote and then
type the quote again, we see how the syntax updates. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
type the quote again, we see how the syntax updates.
And it tells us what type of injection
we're doing right here.
And now we know that it's vulnerable.
So now it's encouraging us to write our code like this, where
we could type a close quote--
where in the password field, we could type a close quote or 1
equals 1 minus minus.
The minus minus comments any following subsequent quote out.
So you can see what we've done here.
We're saying, where the password is blank
or where 1 equals 1, which means 1 always equals 1,
and it's going to return to me all the data. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and it's going to return to me all the data.
So if I click Log In now, look at that.
We found a way into someone's bank account
by leveraging a SQL injection.
So the mitigation technique here was
that we should have parsed this information out.
We shouldn't allow single quotes in the first place or double
quotes in the first place or we should escape those characters
if we're expecting them in our code.
So that's been introducing how the SQL injection really
works in a way that you can practice it right now.
I hope this has been informative for you,
and I'd like to thank you for viewing.