Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

Security & Networks > web attacks - sql injections > Flashcards

web attacks - sql injections Flashcards

(58 cards)

Start Studying
1
Q

what is sql

A

standard language for interacting with databases, very common with web applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

what is it used for in web applications

A

authentications : DB users and passwords
common password: data storage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

how is it used in desktops and server apps

A

Email clients/servers
Photo applications, media servers
Custom database clients
Application data caches

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

what is network injections

A

usually considered the bigger risk
can be accessed by unknown users
network is a gateway crossing physical boundaries
risk in priviledged servers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

what is local injections

A

local users can only deny access to themselves
desktop apps run as plain users , putting own data at risks
however:
drive by exloits attack locally growing concerns due to insider threats

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Typical Setting for Attacks

A

1) presentation tier
2)logic tier
3) storage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

what happens in the presentation tier

A

get victim

renders the html that is given from the logic tier

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

what happens in the logic tier

A

load compile and execute index.asp
sends html from the storage after the data is return from the storage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

what happens in the storage tier

A

exeutes sql and returns data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

what does this code accomplish?

$username = $HTTP_POST_VARS [ ’username ’ ];
$password = $HTTP_POST_VARS [ ’ passwd ’ ];
$query = “ SELECT * FROM logintable WHERE user = ’”
. $username . “ ’ AND pass = ’” . $password . “ ’ “;
…
$result = mysql_query ( $query ) ;
if (! $results )
die_bad_login () ;

A

this guarantees login!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

write sql code that guarntees login
▶ User name: bob’ OR user<>’bob’
▶ Password: foo OR pass<>’foo’

A

SELECT * FROM logintable WHERE user = ’ bob ’ or user < > ’ bob ’ AND pass = ’ foo ’ OR pass < > ’ foo ’

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

what is an in - band fix

A

filtering

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

what does in-band fix :filtering do?

A

use filtering to escape black listed characters
php and mysql have functions to help do this

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

what is an out-band fix

A

Prepared statements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

what does out-band fix:Prepared statements do?

A

uses a prepared query with parameters
parameters are safe substitued in sql statements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

what is an alterative fix from filtering and prepared statements

A

ORM and LINQ

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

what is ORM used for?

A

Use Object-Relational Mapping (ORM) for structured DB access

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

what does orm stand for

A

Object-Relational Mapping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

what is LINQ used for

A

Use LINQ in .NET to interact with databases safely

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

what is a more general out of band solution besides from prepared statements

A

A more general ”out-of-band” solution is to use embedded programming language support for
databases

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

what should we examine when trying to classify sql injections

A

▶ Route – where injection happens
▶ Motive — what it aims to achieve
▶ SQL code — the form of SQL injected

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

name the different types of injection routes

A

▶ User input e.g., web forms via HTTP GET or POST
▶ Cookies used by web apps to build queries
▶ Server variables logged by web apps (e.g., HTTP headers)
▶ Second-order injections where the injection is separated from attack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

give me examples of a primary motive

A

▶ Extracting data
▶ Adding or modifying data
▶ Mounting a denial-of-service attack
▶ Bypassing authentication
▶ Executing arbitrary commands

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

give me examples of an auxiliary motive

Study These Flashcards
A

finding injectable parameters
finding database schema
database server fingerprinting
escalating priviledge at a database level

25
forma of sql modes injected
tautologies illegal or incorrect queries union query piggybacked queries inference pairs stored procedures or other dbms features the injection may use alternate encodings to try to defeat sanitization routines that don’t interpret them (e.g., char(120) instead of x)
26
what is a tautology
inject code into condition statements so they always evaluate to true
27
give example of tautology query
SELECT accounts FROM users WHERE login = ’ ’ or 1=1 -- AND pin =
28
why is blacklisting tautologies difficult
▶ Many ways of writing them: 1>0, ’x’ LIKE ’x’, etc. ▶ Quasi tautologies: very often true RAND()>0.01
29
what does an illegal/ incorrect query do
causes a run-time error , hopping to learn information from error response
30
give example of incorrect / illegal query
SELECT accounts FROM users WHERE login = ’ ’ AND pin = convert ( int ,( select top 1 name from sysobjects where xtype = ’u ’)
31
explain how illegal/incorrect query works
▶ Assumes MS SQL Server ▶ sysobjects is a server table of metadata ▶ Attempts to find first user table ▶ Converts name into an integer → Runtime error
32
what is a sysobject
server table of metadata
33
what does his error tell the attacker: Microsoft OLE DB Provider for SQL Server (Ox80040E07) Error converting nvarchar value ’CreditCards’ to a column of data type int
▶ MS SQL Server is running ▶ The first user-defined table is called CreditCards
34
what is a union query
injecting a second query using UNION
35
give example of union query
SELECT accounts FROM users WHERE login = ’ ’ UNION SELECT cardNo from CreditCards where acctNo =10032 -- AND pin =
36
what is the effect of this union query? SELECT accounts FROM users WHERE login = ’ ’ UNION SELECT cardNo from CreditCards where acctNo =10032 -- AND pin =
▶ Suppose there are no tuples with login=’’ ▶ May reveal cardNo for account 10032
37
give example of piggyback query
SELECT accounts FROM users WHERE login = ‘ doe ‘; drop table users -- ‘ AND pin
38
explain what this piggyback query does? SELECT accounts FROM users WHERE login = ‘ doe ‘; drop table users -- ‘ AND pin
▶ Database parses second command after ; ▶ Executes second query, deleting users table ▶ Some servers don’t require the ; character!
39
what is an inference pair
even if error reponse is not visible we can gather information by observing the subtle differences between outputs.
40
what are the two techniques for inference pairs
blind injection timing attack With unlimited access, these techniques allow automated differential analysis
41
what is a blind injection
it exploites visible differences in responses
42
what is a timing attack
it exploits differences in response time based on boolean conditions (e.g using WAITFOR)
43
how to use blind injection to discover if login parameter in injectable
Step 1: Always true login = ’ legalUser ’ and 1=1 -- ’ Step 2: Always false login = ’ legalUser ’ and 1=0 -- ’
44
what is a stored procedure
custom sub routines that provide support for additional operations
45
what is a risk of stored procedure
if improperly sanitised , it can allows sql injectios insie the stored procedure
46
why are out of band fixes preferred
they reduce risk of sql injections
47
how to repair an sqli vunerability
Filtering to sanitize inputs ▶ Prepared queries (aka parameterized queries) Both methods are server-side, so it is better to use database driver libraries to abstract away from the underlying DBMS
48
what is dangerous about the xp cmdshell provided by mmicrodoft sql
allows execution of os commands Mitigation: ▶ Since SQL Server 2005, this is disabled by default. ▶ But DB administrators can re-enable it. ▶ Worse, an attacker with SQLi access might be able to enable it Lesson: Access control and passwords are critical inside the database!
49
How Do I Prevent SQLi Vulnerabilities BEFORE DEPLOYMENT
using programming languages, objrct relation mapping manual code review or automatic static analysis
50
How Do I Prevent SQLi Vulnerabilities DURING TESTING OR DEPLOYMENT
pen testing tool instrumented code
51
How Do I Prevent SQLi Vulnerabilities AFTER TESTING OR DEPLOYMENT
wait untill after code, manually investigate use dynamic remediation plus alarms (app firewall or speciaised techniques)
52
what is the idea behind Static Prevention: Automated Analysis
use static code analysis to warn programmers or prohibit or fix vunerable code
53
what are the techniques used for Static Prevention: Automated Analysis
Detect suspicious code patterns, e.g., dynamic query construction Use static taint analysis to detect data-flows from input parameters to queries
54
What is th use of AMNESIA in static analysis
use static analysis pre processing to create a sdynamic detection tool
55
how to use amnesia in static analysis?
1. Find SQL query-generation points in code 2. Build SQL-query model as NDFA which models SQL grammar, transition labels are tokens 3. Instrument application to call runtime monitor 4. If monitor detects violation of state machine, triggers error, preventing SQL query
56
what is an sql injection
attack that detects exploits securoty vulnerbaility in application software
57
Dynamic Prevention: SQLrand
Use instruction set randomization to change language dynamically to use opcodes/keywords that attackers can’t easily guess
58
describe State Machine for SQL Production
Variable β: Matches any string in SQL grammar ▶ Spots violation in injectable parameters ▶ Aborts query if model not in accepting state

Security & Networks (14 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions