Injection
What character is commonly used to start an SQL injection payload?
'
What is the point of a command like ' union select 1,@@version --
To get the type of database
What type of SQL injection relies on seeing errors
Error-based injection
True or false, SQL injection attempts can be seen in logs
True
How do web application firewalls (WAFs) help prevent SQLi?
Detect/block malicious SQL patterns
What characters are used to write a comment in SQL
--
How can attackers determine the number of columns needed in their injection
union select 1,2,3 etc
union select null,null,null etc.
The command SLEEP(5) would be used by which type of injection
Time-based injection
If logs show
'
''
What is potentially happening
Someone is testing for SQL injection vulnerabilities
What is input validation
Checking that the data is what we expect eg. numbers in phone number parameter
Which of the following will trigger an SQL error:
'
' --
''
'
What is this injection trying to do:
' UNION SELECT name FROM sqlite_master WHERE type='table' --
get table names
Which type of injection is best to use when sql output data is displayed on the screen
union-based
WAFs can generate logs. What is a WAF
Web Application Firewall
What is input sanitisation?
removing characters that could cause SQL injection e.g. '
You try to force a true statement with ' OR 1=1 -- but it fails. What could you try?
' OR 2=2 --
You inject the following into a vulnerable id parameter that needs 3 parameters and it doesnt work. Why?
id=5 UNION SELECT null, username, password FROM users --
There is no '
When would you use time based injection
When you dont get errors or any data displayed on the screen
The logs show someone searching for 'union select null,sqlite_version() --
What information will they likely ask for next
table names
How could we defend against an automated attack using sqlmap?
block users sending lots of requests
You use the payload ' OR 1=1 -- in a search bar for user names. What would you expect the results to show
ALL the users
You inject the following into a 2 column query and it errors. Why?
' union select a,b --
lack of quotes. it needs to be
' union select 'a','b' --
What type of injection uses a command like ' order by 10 --
error-based
Logs show a search for ' union select null,null --
What is the attacker doing?
Testing the number of columns or testing their injection works
How does a parameterised query prevent SQL injection
User input is understood ONLY as data (not an SQL command)