Discussion I
Solomon Kane
Disscussion4.docxCareer Relevancy
The Network analyst will have to be familiar with the different hacking techniques and be aware of the legal implications of hacking. The analyst will have experience in analyzing cryptography algorithms and encryption techniques that help design the implementation strategies for security information.
Background
Structured Query Language (SQL) is a textual language used by a database server. SQL commands used to perform operations on the database include INSERT, SELECT, UPDATE, and DELETE. Programmers use these commands to manipulate data in the database server. Programmers use sequential SQL commands with client-supplied parameters, making it easier for attackers to inject commands. SQL injection is a technique used to take advantage of unsanitized input vulnerabilities to pass SQL commands through a web application for execution by a backend database. In this technique, the attacker injects malicious SQL queries into the user input form either to gain unauthorized access to a database or to retrieve information directly from the database. It is a flaw in web applications and is not an issue with the database or the web server. SQL injection attacks use a series of malicious SQL queries or SQL statements to directly manipulate the database. Applications often use SQL statements to authenticate users to the application, validate roles and access levels, store, obtain information for the application and user, and link to other data sources. The reason why SQL injection attacks work is that the application does not properly validate input before passing it to a SQL statement.
SQL injection is an alarming issue for all database-driven websites. An attack can be attempted on any normal website or software package on the basis of how it is used and how it processes user-supplied data.
SQL injection can be used to implement the attacks mentioned below:
· Authentication Bypass: Using this attack, an attacker logs onto an application without providing a valid username and password and gains administrative privileges.
· Information Disclosure: Using this attack, an attacker obtains sensitive information that is stored in the database.
· Compromised Data Integrity: An attacker uses this attack to deface a web page, insert malicious content into web pages, or alter the contents of a database.
· Compromised Availability of Data: Attackers use this attack to delete the database information, delete log, or audit information that is stored in a database.
· Remote Code Execution: It assists an attacker to compromise the host OS.
Powerful server-side technologies such as ASP.NET and database servers allow developers to create dynamic, data-driven websites and web applications with incredible ease. These technologies implement business logic on the server side, which then serve incoming requests from clients. Server-side technology smoothly accesses, delivers, stores, and restores information. Various server-side technologies include ASP, ASP.Net, Cold Fusion, JSP, PHP, Python, Ruby on Rails, and so on. Some of these technologies are prone to SQL injection vulnerabilities, and applications developed using these technologies are vulnerable to SQL injection attacks. Web applications use various database technologies as a part of their functionality.
Some relational databases used in developing web applications include Microsoft SQL Server, Oracle, IBM DB2, and the open-source MySQL. Developers sometimes unknowingly neglect secure coding practices when using these technologies, which makes the applications and relational databases vulnerable to SQL injection attacks. These attacks do not exploit a specific software’s vulnerability, instead, they target websites and web applications that do not follow secure coding practices for accessing and manipulating data stored in a relational database.
Earlier sections have described different types of SQL injection techniques. Attackers follow a certain methodology to perform SQL injection attacks in order to ensure that these attacks are successful by analyzing all the possible methods to perform the attack. This section provides insight into the SQL injection methodology, which includes a series of steps for successful SQL injection attacks.
Following are the SQL injection methodology steps:
· Information gathering
· Vulnerability detection
· Launching SQL injection attack
· Compromising the entire target network (Advance SQL injection)
In the information gathering stage, attackers try to gather information about the target database such as database name, version, users, output mechanism, DB type, user privilege level, and OS interaction level.
Understanding the underlying SQL query will allow the attacker to craft correct SQL injection statements. Error messages are essential in extracting information from the database. Depending on the type of errors found, an attacker may try different SQL injection attack techniques. The attacker uses information gathering, also known as the survey and assess method, to determine complete information about the potential target. Attackers learn the kind of database, database version, user privilege levels, and various other things in use.
The attacker usually gathers information at various levels starting with the identification of the database type and the database search engine. Different databases require different SQL syntax. The attacker seeks to identify the database engine used by the server. Identification of the privilege levels is one more step, as there is a chance of gaining the highest privilege as an authentic user. The attacker then attempts to obtain the password and compromise the system. Interacting with the OS through command shell execution allows the attacker to compromise the entire network.
Following steps show how to gather information:
1. Check if the web application connects to a Database Server in order to access some data
2. List all input fields, hidden fields, and post requests whose values could be used in crafting a SQL query
3. Attempt to inject codes into the input fields to generate an error
4. Try to insert a string value where a number is expected in the input field
5. Use UNION operator to combine the result-set of two or more SELECT statements
6. Check the detailed error messages for a wealth of information in order to execute SQL injection Identifying
An attacker will search for all the possible input gates of the application through which to try different SQL injection techniques. The attacker may use automated tools such as Tamper Data, Burp Suite, and so on. Input gates may include input fields on the web form, hidden fields, or cookies used in the application to maintain the sessions. The attacker analyzes the web GET and POST requests sent to the target application with the help of tools mentioned above in order to find input gates for SQL injection.
Prompt
SQL Injection is the most common Website vulnerability on the Internet. Think about the various consequences of SQL injection attacks on modern database systems and provide a counter argument for why these consequences can be ignored. Be sure to think about end user, company, and employee consequences as well as to the extent each is affected. For your secondary responses discuss why the counter arguments are falsely misleading and provide alternative reasons for ignoring consequences.
For your citation, you might use articles that show examples of SQL injection concepts and methodology.
Your initial and reply posts should work to develop a group understanding of this topic. Challenge each other. Build on each other. Always be respectful but discuss this and figure it out together.
Reply Requirements
You must submit:
