Dion: SQL injection. 2 2
In this lesson we are going to talk about SQL injection, 3 3
but before we do that, we have to talk a little bit 4 4
about what SQL is. 5 5
Now, when you deal with a database, 6 6
you have to have a way to talk to that database. 7 7
And the way you get information, or write information, 8 8
or update information from that database 9 9
is by using SQL statements. 10 10
SQL is the structured query language, 11 11
and it's used to select, insert, delete, 12 12
or update data within a database. 13 13
Those are four key terms, 14 14
because those are the four key words 15 15
that are used with SQL, and they're going to tell the system, 16 16
this is what I want to do, I want to select something, 17 17
that means I want to read from the database. 18 18
I want to insert something, 19 19
that means I want to put it into the database. 20 20
I want to delete something, that means I want to delete it 21 21
out of my database and remove it, 22 22
or I want to update something, 23 23
which means I want to give it the latest version 24 24
and replace what's already in the database. 25 25
So these are the four keywords you're going to see a lot. 26 26
Now, how does SQL normally work when you make a request? 27 27
Well, let's say I wanted to log into a website. 28 28
I have a form, it asks for my username and my password, 29 29
and so I'm going to type in Jason as my username 30 30
and pass123 as my password, 31 31
and then I click the login button. 32 32
It sends that information over to the database 33 33
and it makes a query. 34 34
And so what it's going to do is find out is the password I sent 35 35
the same password that's stored in the database? 36 36
Well, it does this using an SQL statement. 37 37
it's going to say select * from users 38 38
where user_id = what I inputted, Jason, 39 39
and password = what I entered, pass123. 40 40
So we take that information and we pull it 41 41
from the database and we see do we have a match? 42 42
And if we do, that means we're going to be allowed in 43 43
and we get access granted, everything's wonderful. 44 44
That's the way basic SQL is going to work. 45 45
Now, what we're going to talk about though is code injection, 46 46
and this is how people can take advantage of SQL 47 47
and insert things that don't belong. 48 48
When we talk about code injection, 49 49
it is a form of an injection attack. 50 50
This is the insertion of additional information or code 51 51
through data input from a client to an application. 52 52
When we talked about things like directory traversals, 53 53
that's a type of injection attack. 54 54
When we talk about cross-site scripting, 55 55
that's a type of injection attack, 56 56
and SQL injections are another form of injection attack. 57 57
When I talk specifically about an SQL injection attack 58 58
this is an attack that consists of the insertion 59 59
or injection of an SQL query via input data 60 60
from a client to a web application. 61 61
And so I'm trying to insert something into that SQL 62 62
so it can apply that code and do its logic on it 63 63
and then give me some kind of a response. 64 64
Now, as an attacker, the attacker has to try 65 65
every single input there is to include elements 66 66
such as URL parameters, form fields, cookies, post data, 67 67
and HTTP headers to identify whether or not 68 68
there's an SQL injection vulnerability. 69 69
That sounds like a lot of work, 70 70
but honestly there's a lot of great tools out there 71 71
that'll automate this process for an attacker, 72 72
so you want to make sure you're protecting your databases 73 73
by understanding SQL injections 74 74
and what you can do to prevent them. 75 75
So how does an SQL injection actually work? 76 76
Well, let's go back to our example 77 77
of logging into a website. 78 78
Let's say I have a form. 79 79
Well, I'm going to go ahead and put in my name there, Jason. 80 80
Then I'm going to insert my password, 81 81
but instead of entering pass123, 82 82
since I don't know the person's password, 83 83
I'm just going to put in an 'OR 1=1;. 84 84
Now, that seems kind of weird, right? 85 85
But when I put that in and I go ahead 86 86
and click the login button, what's going to happen? 87 87
I'm going to send in the command select * from Users 88 88
where user_id 0 'jason' and password equals ''OR 1=1;'. 89 89
Now, notice that when I send that in 90 90
I'm going to get access granted. 91 91
Why is that? 92 92
Well, because I just performed an SQL injection. 93 93
Essentially what ends up happening when you have something 94 94
like an apostrophe, it's an escape character. 95 95
And so what I'm saying is find the password 96 96
that matches Jason, or if 1=1. 97 97
Well, let me ask you, does one equal one? 98 98
Yes, it does. 99 99
Today, yesterday, tomorrow, and every day in the future, 100 100
one is always going to equal one. 101 101
And so every time we run this command and we do Jason 102 102
and then we do that quote, or 1=1, 103 103
that's going to return a positive result 104 104
because it's Boolean logic. 105 105
Even if my password, which in this case is blank 106 106
'cause I just have the quote mark, 107 107
doesn't match my password in the database, 108 108
well guess what? 109 109
The OR 1=1 will equal it, and therefore, 110 110
I'm going to be able to get access granted. 111 111
This is why SQL injections work 112 112
when people are trying to break into databases. 113 113
So SQL injection can be prevented though, 114 114
and we have to think about how to do that 115 115
as cybersecurity analysts. 116 116
The way we're going to do this is by preventing them 117 117
through input validation and using least privilege 118 118
whenever we're accessing a database. 119 119
There's a couple of other advanced techniques 120 120
that we're going to talk about as well 121 121
as we go through this section, 122 122
but for right now, remember, if you have SQL injection, 123 123
you can prevent it doing input validation. 124 124
Now, anytime on the exam you see ' OR 1=1 on the exam, 125 125
what are you going to say that is? 126 126
That's right, that's an SQL injection. 127 127
We know that every single time. 128 128
Now, another big vulnerable area when we start talking 129 129
about databases is the idea of insecure object reference. 130 130
Now, this is something that we have to think about, 131 131
because when we talk about insecure object reference, 132 132
this is the coding vulnerability 133 133
where unvalidated input is used to select a resource object 134 134
like a file or a database. 135 135
Now, let me give you an example of this. 136 136
Let's say I decided to start my own bank. 137 137
It's now called the Bank of Dion. 138 138
So we all go and sign up for my bank, 139 139
and we all get an account number, 140 140
and if you want to access your account, 141 141
you go to BankOfDion.com/account.php?acct=1234. 142 142
That's my account. 143 143
Now, this is an insecure object reference. 144 144
Why? Because I have this 1234 shown right there, 145 145
which is my account number. 146 146
So if I just change that and decide to go to 4321, 147 147
maybe that goes into your bank account, 148 148
and now I'm able to access your records. 149 149
That's what we're talking about when we talk 150 150
about an insecure object reference 151 151
or a direct object reference. 152 152
Both of these are a term for this type of situation. 153 153
So how do we prevent this? 154 154
Well, we're going to implement access control techniques 155 155
inside our applications to verify a user 156 156
is actually authorized to access that specific object. 157 157
So if I was logged in as Jason 158 158
and I tried to access Tamara's account, 159 159
and she's 4321, it should give me an error. 160 160
But if I don't have those type of protections in place 161 161
and I'm just saying, show me what's in the database 162 162
at this location, 4321, it would show me that location. 163 163
And so that's why insecure object reference 164 164
is a bad thing to have. 165 165
Now, for the exam, if you see something 166 166
with an apostrophe or a double apostrophe, guess what? 167 167
It's an SQL injection almost every single time. 168 168
This is a great thing to remember for the exam, 169 169
it'll help you answer some questions. 170 170
Now, I want you to remember, it doesn't have to be just 1=1, 171 171
anything that's a true statement would work. 172 172
It could be 7=7, 15=15, 8=8, I don't care, 173 173
as long as it's something equals something 174 174
and both those somethings are true, 175 175
this is going to be a sign of somebody 176 176
trying to do an SQL injection on you. 177 177
I guarantee on the exam you are going to see SQL injections. 178 178
You'll probably have at least three to five questions 179 179
that are going to be answered with the words SQL injection, 180 180
either in the multiple choice or in the PBQs. 181 181
It's just that much of an important topic. 182 182
You're going to see it, I promise you. 183 183
On the exam you're going to get log questions 184 184
showing you SQL injections, 185 185
and you're going to to identify them as SQL injections 186 186
based on what you see in the URL. 187 187
Again, look for those apostrophes, 188 188
look for the 1=1, the 7=7, things like that. 189 189
If you're asked how you can prevent an SQL injection, 190 190
what is the answer? 191 191
Input validation. 192 192
If we validate the input, we can make sure that we say, 193 193
"Ah, we see somebody putting in an apostrophe. 194 194
We're not going to accept that. 195 195
We're going to throw that input away. 196 196
We're not going to send it to the database." 197 197
These are the things you have to remember for the exam. 198 198
I promise you, SQL injections are coming, 199 199
so keep your eyes out for 'em, 200 200
and you'll find 'em in the logs.