Injection Attacks by Example

Injection Attacks by Example SQL Injection and XSS Adam Forsythe Thomas Hollingsworth

Outline • OWASP • Injection: • Define • Attacks • Preventions • Cross-Site Scripting: • Define • Attacks • Preventions

Open Web Application Security Project(OWASP) • The Open Web Application Security Project (OWASP) is an open community dedicated to enabling organizations to develop, purchase, and maintain applications that can be trusted. • OWASP Top 10 Application Security Risk – 2013 • #1 Injection • #3 Cross-Site Scripting (XSS)

SQL Injection • SQL injection attacks are a type of injection attack, in which SQL commands are injected into data-plane input in order to effect the execution of predefined SQL commands. • Consists of insertion or "injection" of a SQL query via the input data from the client to the application • A successful SQL injection exploit can: • Read sensitive data from the database • Modify database data (Insert/Update/Delete) • Execute administration operations on the database (such as shutdown the DBMS) • Recover the content of a given file present on the DBMS file system • In some cases issue commands to the operating system.

Attacks • Injection can result in: • Data loss or corruption • Lack of accountability or denial of access • Can lead to complete host takeover • All data can be stolen, modified, or deleted

Preventions • Preventing injection requires keeping untrusted data separate from commands and queries. • Types of Preventions: • Use a safe API which avoids the use of the interpreter entirely or provides a parameterized interface. • Carefully escape special characters using the specific escape syntax for that interpreter. • Positive or “white list” input validation, but this is not a complete defense as many applications require special characters in their input.

Cross-Site Scripting (XSS) • XSS flaws occur whenever an application takes untrusted data and sends it to a web browser without proper validation or escaping. • XSS allows attackers to: • Execute scripts in the victim’s browser which can hijack user sessions • Deface web sites • Redirect the user to malicious sites

Attacks • Attackers can execute scripts in a victim’s browser: • To hijack user sessions • Deface web sites • Insert hostile content • Redirect users • Hijack the user’s browser using malware

Preventions • Preventing XSS requires keeping untrusted data separate from active browser content. • Types of Preventions: • Encoding – Escaping any character a user enters before displaying it • Whitelisting – Only allow certain characters (e.g. A-Z and 0-9) to be entered • Blacklisting – Not allowing a user to enter sequences such as <script> or <and>

References • https://www.owasp.org/index.php/Top_10 • https://www.owasp.org/index.php/SQL_Injection • https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet • http://www.unixwiz.net/techtips/sql-injection.html • https://www.owasp.org/index.php/Testing_for_Cross_site_scripting • https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet • http://msdn.microsoft.com/en-us/library/a2a4yykt(v=vs.85).aspx

Injection Attacks by Example