1 1 00:00:00,180 --> 00:00:02,280 SQL injection. 2 2 00:00:02,280 --> 00:00:05,370 In this lesson we are going to talk about SQL injection, 3 3 00:00:05,370 --> 00:00:07,890 but before we do that, we have to talk a little bit 4 4 00:00:07,890 --> 00:00:09,840 about what SQL is. 5 5 00:00:09,840 --> 00:00:11,520 Now, when you deal with a database, 6 6 00:00:11,520 --> 00:00:14,160 you have to have a way to talk to that database. 7 7 00:00:14,160 --> 00:00:16,680 And the way you get information, or write information, 8 8 00:00:16,680 --> 00:00:18,570 or update information from that database 9 9 00:00:18,570 --> 00:00:20,940 is by using SQL statements. 10 10 00:00:20,940 --> 00:00:23,460 SQL is the structured query language, 11 11 00:00:23,460 --> 00:00:25,980 and it's used to select, insert, delete, 12 12 00:00:25,980 --> 00:00:28,230 or update data within a database. 13 13 00:00:28,230 --> 00:00:29,520 Those are four key terms, 14 14 00:00:29,520 --> 00:00:31,170 because those are the four key words 15 15 00:00:31,170 --> 00:00:34,500 that are used with SQL, and they're going to tell the system, 16 16 00:00:34,500 --> 00:00:36,540 this is what I want to do, I want to select something, 17 17 00:00:36,540 --> 00:00:38,130 that means I want to read from the database. 18 18 00:00:38,130 --> 00:00:39,060 I want to insert something, 19 19 00:00:39,060 --> 00:00:40,620 that means I want to put it into the database. 20 20 00:00:40,620 --> 00:00:42,480 I want to delete something, that means I want to delete it 21 21 00:00:42,480 --> 00:00:43,980 out of my database and remove it, 22 22 00:00:43,980 --> 00:00:45,060 or I want to update something, 23 23 00:00:45,060 --> 00:00:46,620 which means I want to give it the latest version 24 24 00:00:46,620 --> 00:00:48,720 and replace what's already in the database. 25 25 00:00:48,720 --> 00:00:51,180 So these are the four keywords you're going to see a lot. 26 26 00:00:51,180 --> 00:00:54,480 Now, how does SQL normally work when you make a request? 27 27 00:00:54,480 --> 00:00:56,790 Well, let's say I wanted to log into a website. 28 28 00:00:56,790 --> 00:00:59,460 I have a form, it asks for my username and my password, 29 29 00:00:59,460 --> 00:01:01,800 and so I'm going to type in Jason as my username 30 30 00:01:01,800 --> 00:01:03,900 and pass123 as my password, 31 31 00:01:03,900 --> 00:01:05,970 and then I click the login button. 32 32 00:01:05,970 --> 00:01:08,760 It sends that information over to the database 33 33 00:01:08,760 --> 00:01:09,900 and it makes a query. 34 34 00:01:09,900 --> 00:01:13,080 And so what it's going to do is find out is the password I sent 35 35 00:01:13,080 --> 00:01:15,360 the same password that's stored in the database? 36 36 00:01:15,360 --> 00:01:17,700 Well, it does this using an SQL statement. 37 37 00:01:17,700 --> 00:01:20,610 it's going to say select * from users 38 38 00:01:20,610 --> 00:01:24,120 where user_id = what I inputted, Jason, 39 39 00:01:24,120 --> 00:01:27,810 and password = what I entered, pass123. 40 40 00:01:27,810 --> 00:01:30,090 So we take that information and we pull it 41 41 00:01:30,090 --> 00:01:32,880 from the database and we see do we have a match? 42 42 00:01:32,880 --> 00:01:35,460 And if we do, that means we're going to be allowed in 43 43 00:01:35,460 --> 00:01:38,340 and we get access granted, everything's wonderful. 44 44 00:01:38,340 --> 00:01:41,190 That's the way basic SQL is going to work. 45 45 00:01:41,190 --> 00:01:44,190 Now, what we're going to talk about though is code injection, 46 46 00:01:44,190 --> 00:01:46,800 and this is how people can take advantage of SQL 47 47 00:01:46,800 --> 00:01:49,260 and insert things that don't belong. 48 48 00:01:49,260 --> 00:01:51,000 When we talk about code injection, 49 49 00:01:51,000 --> 00:01:52,980 it is a form of an injection attack. 50 50 00:01:52,980 --> 00:01:55,590 This is the insertion of additional information or code 51 51 00:01:55,590 --> 00:01:58,710 through data input from a client to an application. 52 52 00:01:58,710 --> 00:02:00,900 When we talked about things like directory traversals, 53 53 00:02:00,900 --> 00:02:02,430 that's a type of injection attack. 54 54 00:02:02,430 --> 00:02:04,080 When we talk about cross-site scripting, 55 55 00:02:04,080 --> 00:02:05,580 that's a type of injection attack, 56 56 00:02:05,580 --> 00:02:09,000 and SQL injections are another form of injection attack. 57 57 00:02:09,000 --> 00:02:11,910 When I talk specifically about an SQL injection attack 58 58 00:02:11,910 --> 00:02:13,980 this is an attack that consists of the insertion 59 59 00:02:13,980 --> 00:02:17,400 or injection of an SQL query via input data 60 60 00:02:17,400 --> 00:02:19,740 from a client to a web application. 61 61 00:02:19,740 --> 00:02:23,010 And so I'm trying to insert something into that SQL 62 62 00:02:23,010 --> 00:02:25,890 so it can apply that code and do its logic on it 63 63 00:02:25,890 --> 00:02:28,200 and then give me some kind of a response. 64 64 00:02:28,200 --> 00:02:30,450 Now, as an attacker, the attacker has to try 65 65 00:02:30,450 --> 00:02:33,240 every single input there is to include elements 66 66 00:02:33,240 --> 00:02:37,590 such as URL parameters, form fields, cookies, post data, 67 67 00:02:37,590 --> 00:02:40,260 and HTTP headers to identify whether or not 68 68 00:02:40,260 --> 00:02:42,420 there's an SQL injection vulnerability. 69 69 00:02:42,420 --> 00:02:43,710 That sounds like a lot of work, 70 70 00:02:43,710 --> 00:02:45,990 but honestly there's a lot of great tools out there 71 71 00:02:45,990 --> 00:02:47,970 that'll automate this process for an attacker, 72 72 00:02:47,970 --> 00:02:50,580 so you want to make sure you're protecting your databases 73 73 00:02:50,580 --> 00:02:52,290 by understanding SQL injections 74 74 00:02:52,290 --> 00:02:54,150 and what you can do to prevent them. 75 75 00:02:54,150 --> 00:02:57,720 So how does an SQL injection actually work? 76 76 00:02:57,720 --> 00:02:59,130 Well, let's go back to our example 77 77 00:02:59,130 --> 00:03:00,930 of logging into a website. 78 78 00:03:00,930 --> 00:03:02,220 Let's say I have a form. 79 79 00:03:02,220 --> 00:03:04,770 Well, I'm going to go ahead and put in my name there, Jason. 80 80 00:03:04,770 --> 00:03:06,150 Then I'm going to insert my password, 81 81 00:03:06,150 --> 00:03:07,980 but instead of entering pass123, 82 82 00:03:07,980 --> 00:03:10,050 since I don't know the person's password, 83 83 00:03:10,050 --> 00:03:13,497 I'm just going to put in an 'OR 1=1;. 84 84 00:03:14,460 --> 00:03:16,230 Now, that seems kind of weird, right? 85 85 00:03:16,230 --> 00:03:17,850 But when I put that in and I go ahead 86 86 00:03:17,850 --> 00:03:20,670 and click the login button, what's going to happen? 87 87 00:03:20,670 --> 00:03:23,610 I'm going to send in the command select * from Users 88 88 00:03:23,610 --> 00:03:28,610 where user_id 0 'jason' and password equals ''OR 1=1;'. 89 89 00:03:32,550 --> 00:03:34,440 Now, notice that when I send that in 90 90 00:03:34,440 --> 00:03:36,540 I'm going to get access granted. 91 91 00:03:36,540 --> 00:03:37,620 Why is that? 92 92 00:03:37,620 --> 00:03:40,620 Well, because I just performed an SQL injection. 93 93 00:03:40,620 --> 00:03:42,960 Essentially what ends up happening when you have something 94 94 00:03:42,960 --> 00:03:45,180 like an apostrophe, it's an escape character. 95 95 00:03:45,180 --> 00:03:47,520 And so what I'm saying is find the password 96 96 00:03:47,520 --> 00:03:50,880 that matches Jason, or if 1=1. 97 97 00:03:50,880 --> 00:03:53,400 Well, let me ask you, does one equal one? 98 98 00:03:53,400 --> 00:03:54,450 Yes, it does. 99 99 00:03:54,450 --> 00:03:57,180 Today, yesterday, tomorrow, and every day in the future, 100 100 00:03:57,180 --> 00:03:58,980 one is always going to equal one. 101 101 00:03:58,980 --> 00:04:01,710 And so every time we run this command and we do Jason 102 102 00:04:01,710 --> 00:04:04,470 and then we do that quote, or 1=1, 103 103 00:04:04,470 --> 00:04:06,240 that's going to return a positive result 104 104 00:04:06,240 --> 00:04:07,800 because it's Boolean logic. 105 105 00:04:07,800 --> 00:04:10,260 Even if my password, which in this case is blank 106 106 00:04:10,260 --> 00:04:11,850 'cause I just have the quote mark, 107 107 00:04:11,850 --> 00:04:13,560 doesn't match my password in the database, 108 108 00:04:13,560 --> 00:04:14,393 well guess what? 109 109 00:04:14,393 --> 00:04:17,340 The OR 1=1 will equal it, and therefore, 110 110 00:04:17,340 --> 00:04:19,230 I'm going to be able to get access granted. 111 111 00:04:19,230 --> 00:04:21,150 This is why SQL injections work 112 112 00:04:21,150 --> 00:04:23,280 when people are trying to break into databases. 113 113 00:04:23,280 --> 00:04:25,770 So SQL injection can be prevented though, 114 114 00:04:25,770 --> 00:04:27,120 and we have to think about how to do that 115 115 00:04:27,120 --> 00:04:28,590 as cybersecurity analysts. 116 116 00:04:28,590 --> 00:04:30,660 The way we're going to do this is by preventing them 117 117 00:04:30,660 --> 00:04:33,090 through input validation and using least privilege 118 118 00:04:33,090 --> 00:04:35,040 whenever we're accessing a database. 119 119 00:04:35,040 --> 00:04:36,690 There's a couple of other advanced techniques 120 120 00:04:36,690 --> 00:04:37,740 that we're going to talk about as well 121 121 00:04:37,740 --> 00:04:39,000 as we go through this section, 122 122 00:04:39,000 --> 00:04:42,030 but for right now, remember, if you have SQL injection, 123 123 00:04:42,030 --> 00:04:44,550 you can prevent it doing input validation. 124 124 00:04:44,550 --> 00:04:49,550 Now, anytime on the exam you see ' OR 1=1 on the exam, 125 125 00:04:50,100 --> 00:04:51,810 what are you going to say that is? 126 126 00:04:51,810 --> 00:04:54,060 That's right, that's an SQL injection. 127 127 00:04:54,060 --> 00:04:56,460 We know that every single time. 128 128 00:04:56,460 --> 00:04:58,470 Now, another big vulnerable area when we start talking 129 129 00:04:58,470 --> 00:05:02,310 about databases is the idea of insecure object reference. 130 130 00:05:02,310 --> 00:05:04,110 Now, this is something that we have to think about, 131 131 00:05:04,110 --> 00:05:06,690 because when we talk about insecure object reference, 132 132 00:05:06,690 --> 00:05:08,370 this is the coding vulnerability 133 133 00:05:08,370 --> 00:05:11,490 where unvalidated input is used to select a resource object 134 134 00:05:11,490 --> 00:05:13,650 like a file or a database. 135 135 00:05:13,650 --> 00:05:15,630 Now, let me give you an example of this. 136 136 00:05:15,630 --> 00:05:17,760 Let's say I decided to start my own bank. 137 137 00:05:17,760 --> 00:05:19,830 It's now called the Bank of Dion. 138 138 00:05:19,830 --> 00:05:21,660 So we all go and sign up for my bank, 139 139 00:05:21,660 --> 00:05:23,040 and we all get an account number, 140 140 00:05:23,040 --> 00:05:24,510 and if you want to access your account, 141 141 00:05:24,510 --> 00:05:29,510 you go to BankOfDion.com/account.php?acct=1234. 142 142 00:05:31,230 --> 00:05:32,520 That's my account. 143 143 00:05:32,520 --> 00:05:34,740 Now, this is an insecure object reference. 144 144 00:05:34,740 --> 00:05:37,920 Why? Because I have this 1234 shown right there, 145 145 00:05:37,920 --> 00:05:39,450 which is my account number. 146 146 00:05:39,450 --> 00:05:42,660 So if I just change that and decide to go to 4321, 147 147 00:05:42,660 --> 00:05:44,370 maybe that goes into your bank account, 148 148 00:05:44,370 --> 00:05:46,440 and now I'm able to access your records. 149 149 00:05:46,440 --> 00:05:47,400 That's what we're talking about when we talk 150 150 00:05:47,400 --> 00:05:49,050 about an insecure object reference 151 151 00:05:49,050 --> 00:05:50,640 or a direct object reference. 152 152 00:05:50,640 --> 00:05:53,310 Both of these are a term for this type of situation. 153 153 00:05:53,310 --> 00:05:54,690 So how do we prevent this? 154 154 00:05:54,690 --> 00:05:57,150 Well, we're going to implement access control techniques 155 155 00:05:57,150 --> 00:05:59,430 inside our applications to verify a user 156 156 00:05:59,430 --> 00:06:02,340 is actually authorized to access that specific object. 157 157 00:06:02,340 --> 00:06:03,960 So if I was logged in as Jason 158 158 00:06:03,960 --> 00:06:05,940 and I tried to access Tamara's account, 159 159 00:06:05,940 --> 00:06:09,000 and she's 4321, it should give me an error. 160 160 00:06:09,000 --> 00:06:11,550 But if I don't have those type of protections in place 161 161 00:06:11,550 --> 00:06:13,290 and I'm just saying, show me what's in the database 162 162 00:06:13,290 --> 00:06:16,770 at this location, 4321, it would show me that location. 163 163 00:06:16,770 --> 00:06:18,810 And so that's why insecure object reference 164 164 00:06:18,810 --> 00:06:20,370 is a bad thing to have. 165 165 00:06:20,370 --> 00:06:22,860 Now, for the exam, if you see something 166 166 00:06:22,860 --> 00:06:26,130 with an apostrophe or a double apostrophe, guess what? 167 167 00:06:26,130 --> 00:06:28,560 It's an SQL injection almost every single time. 168 168 00:06:28,560 --> 00:06:30,060 This is a great thing to remember for the exam, 169 169 00:06:30,060 --> 00:06:31,740 it'll help you answer some questions. 170 170 00:06:31,740 --> 00:06:34,950 Now, I want you to remember, it doesn't have to be just 1=1, 171 171 00:06:34,950 --> 00:06:36,810 anything that's a true statement would work. 172 172 00:06:36,810 --> 00:06:41,520 It could be 7=7, 15=15, 8=8, I don't care, 173 173 00:06:41,520 --> 00:06:43,080 as long as it's something equals something 174 174 00:06:43,080 --> 00:06:44,790 and both those somethings are true, 175 175 00:06:44,790 --> 00:06:46,290 this is going to be a sign of somebody 176 176 00:06:46,290 --> 00:06:48,210 trying to do an SQL injection on you. 177 177 00:06:48,210 --> 00:06:51,720 I guarantee on the exam you are going to see SQL injections. 178 178 00:06:51,720 --> 00:06:54,090 You'll probably have at least three to five questions 179 179 00:06:54,090 --> 00:06:56,400 that are going to be answered with the words SQL injection, 180 180 00:06:56,400 --> 00:06:58,770 either in the multiple choice or in the PBQs. 181 181 00:06:58,770 --> 00:07:00,990 It's just that much of an important topic. 182 182 00:07:00,990 --> 00:07:03,150 You're going to see it, I promise you. 183 183 00:07:03,150 --> 00:07:04,980 On the exam you're going to get log questions 184 184 00:07:04,980 --> 00:07:06,390 showing you SQL injections, 185 185 00:07:06,390 --> 00:07:09,030 and you're going to to identify them as SQL injections 186 186 00:07:09,030 --> 00:07:11,490 based on what you see in the URL. 187 187 00:07:11,490 --> 00:07:13,590 Again, look for those apostrophes, 188 188 00:07:13,590 --> 00:07:17,250 look for the 1=1, the 7=7, things like that. 189 189 00:07:17,250 --> 00:07:19,890 If you're asked how you can prevent an SQL injection, 190 190 00:07:19,890 --> 00:07:21,210 what is the answer? 191 191 00:07:21,210 --> 00:07:22,320 Input validation. 192 192 00:07:22,320 --> 00:07:25,057 If we validate the input, we can make sure that we say, 193 193 00:07:25,057 --> 00:07:27,570 "Ah, we see somebody putting in an apostrophe. 194 194 00:07:27,570 --> 00:07:28,560 We're not going to accept that. 195 195 00:07:28,560 --> 00:07:29,970 We're going to throw that input away. 196 196 00:07:29,970 --> 00:07:31,890 We're not going to send it to the database." 197 197 00:07:31,890 --> 00:07:34,050 These are the things you have to remember for the exam. 198 198 00:07:34,050 --> 00:07:36,300 I promise you, SQL injections are coming, 199 199 00:07:36,300 --> 00:07:37,470 so keep your eyes out for 'em, 200 200 00:07:37,470 --> 00:07:39,070 and you'll find 'em in the logs.