Greetings TurkHackTeam Members, in this article I will talk about SQL injections, also known as SQLi.
Databases may contain important information and data. Therefore no one wants to be hacked. However SQL injection is the one of the most used and common hacking ways.
Attackers can use SQL Injection vulnerabilities to bypass application security. They can go around authentication and authorization of a web page or web application and retrieve the content of the entire SQL database. They can also use SQL Injection to add, modify, and delete records in the database.
An SQL Injection vulnerability may affect any website or web application that uses an SQL database such as MySQL, Oracle, SQL Server, or others. Criminals may use it to gain unauthorized access to your sensitive data: customer information, personal data, trade secrets, intellectual property, and more. If you want to protect your SQL servers, you need to be careful. On OWASP Top Ten List, through the years there is always SQL Injection.
How Does It Work?
To make an SQL Injection attack, an attacker must first find vulnerable user inputs within the web page or web application. A web page or web application that has an SQL Injection vulnerability uses such user input directly in an SQL query. There might be some different ways as well. The attacker can create input content. Such content is often called a malicious payload. After the attacker sends this content, malicious SQL commands are executed in the database.
SQL is a query language that was designed to manage data stored in relational databases. You can use it to access, modify, and delete data. Many web applications and websites store all the data in SQL databases. In some cases, hackers can destroy everything you have. So, this means, a successful SQL Injection attack can have very serious consequences.
How To Prevent SQL Injections?
The only sure way to prevent SQL Injection attacks is input validation and parametrized queries including prepared statements. You should filter the system. The application code should never use the input directly. The developer must sanitize all input, not only web form inputs such as login forms. They must remove potential malicious code elements such as single quotes. It is also a good idea to turn off the visibility of database errors on your production sites.
If you discover an SQL Injection vulnerability, you may be unable to fix it immediately. For example, the vulnerability may be in open source code. In such cases, you can use a web application firewall to sanitize your input temporarily. You should hire White Hat Hackers or try to fix it on your own.
Preventing SQL Injection vulnerabilities is not easy. Specific prevention techniques depend on the subtype of SQLi vulnerability, on the SQL database engine, and on the programming language. But, there are certain general strategic principles that you should follow to keep your web application safe. Just try to use these following ways:
Be Aware And Train Your Personnel
To keep your web application safe, everyone involved in building the web application must be aware of the risks associated with SQL Injections. You should provide suitable security training to all your developers, QA staff, DevOps, and SysAdmins. You can teach them the progress or give them sources to learn SQLis.
Filter Your User Inputs
Treat all user input as untrusted. Any user input that is used in an SQL query introduces a risk of an SQL Injection. Treat input from authenticated and internal users the same way that you treat public input.
Use Whitelists Instead Of Blacklists
Dont filter user input based on blacklists. A clever attacker will almost always find a way to circumvent your blacklist. If possible, verify and filter user input using strict whitelists only. Maybe attacker will use proxies or DNS' to hack.
Try To Use The Last Products
Older web development technologies dont have SQLi protection. Use the latest version of the development environment and language and the latest technologies associated with that environment/language. For example, in PHP use PDO instead of MySQLi. It'd be better.
Use Already Built Systems
Dont try to build SQLi protection from scratch. Most modern development technologies can offer you mechanisms to protect against SQLi. Use such mechanisms instead of trying to reinvent the wheel. For example, use parameterized queries or stored procedures.
SQL Injections may be introduced by your developers or through external libraries/modules/software. You should regularly scan your web applications using a web vulnerability scanner. Just like antiviruses on PCs, you should scan your server often.
Well, that was all. I hope you'll get informed. Thanks for reading. Have a good day.