In 2008, Heartland Payment Systems experienced a significant data breach. The incident involved the exploitation of an SQL injection vulnerability by attackers, who were able to gain unauthorized access to the company's payment processing system. As a result, the attackers were able to steal millions of credit card numbers, which had a severe impact on the company's reputation and financial stability. The breach not only resulted in significant financial losses for Heartland and its customers but also served as a wake-up call for other organizations to take data security more seriously.

This blog covers the following topics related to SQL Injection:

• Understanding SQL Injection

• Types of SQL Injection attacks

• Techniques used by attackers to perform SQL Injection

• Demonstration of SQL Injection attack

• SQL Prevention

What is SQL Injection?

SQL Injection is a type of attack where an attacker injects malicious SQL code into a vulnerable application's database query. This can result in unauthorized access to sensitive data, modification of data, or even complete loss of data. SQL Injection attacks are one of the most common types of attacks against web applications and can have serious consequences for organizations that fall victim to them.

"Key takeaway: In SQL Injection attacks, a communication channel means the way an attacker talks to a weak application's database to insert harmful SQL code. It could use the same way the application talks to the database normally, or the attacker might choose a different way like email or an external website to get the results of the injected code."

Types of SQL Injection

• In-band SQL Injection: In-band SQL injection is a common way attackers inject malicious SQL code into a vulnerable application's database query. The attacker uses the same channel to perform the attack and gather results. There are two sub-types: error-based and union-based SQL injection.

  • Error-based SQL Injection

  • Union-based SQL Injection

• Out-of-band SQL Injection: In this type of attack, the attacker uses a different communication channel to perform the attack and gather the results. This can be further divided into two sub-types:

  • Time-Based SQL Injection

• Boolean-based SQL injection: Boolean-based SQL injection, also known as inferential SQL injection, is an attack that relies on sending SQL queries to the database that force the application to return a different result depending on whether the query returns a true or false result. This can be further divided into two sub-types:

  • Simple or Direct

  • Indirect or Complex

• Time-based SQL Injection: This type of attack involves delaying the server's response to infer information about the database. For instance, an attacker might send a query like "SELECT SLEEP(5);" to delay the response for five seconds and confirm that the database is vulnerable.

SQL Injection examples:

If you are interested in a live practical demonstration, check out this YouTube video!

Attackers can use various techniques to perform SQL Injection attacks. Some of the most common examples include:

Manual SQL Injection:

This is the most basic technique and involves manually injecting SQL code into an input field or URL parameter. Attackers will often use tools such as SQLMap or Havij to automate this process. Example:

Suppose a website has a search bar that allows users to search for products by name. The search query might look something like this:

SELECT * FROM products WHERE name LIKE '%search_term%';

An attacker might enter the following into the search bar:

‘ OR 1=1;--

This would result in the following query:

SELECT * FROM products WHERE name LIKE '%' OR 1=1;--%';

The double dash -- at the end of the query is a comment in SQL and will cause the rest of the query to be ignored. The resulting query will return all products in the database since 1=1 is always true.

Error-based SQL Injection:

This technique involves injecting SQL code that causes the database to generate errors. The attacker can then use these errors to gather information about the database schema or even extract data.

Here is an example query for searching for products from a search bar.

SELECT * FROM products WHERE name LIKE '%search_term%';

An attacker might enter the following into the search bar:

' OR 1=1;SELECT * FROM nonexistent_table;--

This would result in the following query:

SELECT * FROM products WHERE name LIKE '%' OR 1=1;SELECT * FROM nonexistent_table;--%';

The query now includes a second SELECT statement that will cause an error since nonexistent_table does not exist. However, the attacker can still use this error to infer information about the database schema, such as the names of tables or columns.

Union-based SQL Injection:

This technique involves injecting SQL code that uses the UNION operator to combine the results of two or more SELECT statements. The attacker can then use this technique to extract data from the database.

An example of a union-based SQL Injection query might look something like this:

SELECT name, email, password FROM users WHERE id = 1 UNION SELECT cc_number, NULL, NULL FROM credit_cards LIMIT 1;

In this example, the attacker is attempting to extract credit card information from the database by using the UNION operator to combine the results of two SELECT statements. The first SELECT statement selects the user's name, email, and password, while the second SELECT statement selects the credit card number from the credit_cards table. The LIMIT 1 clause at the end of the query ensures that only one row is returned, since the attacker may not know how many rows are returned by the first SELECT statement.

The attacker can potentially extract sensitive information from the database by injecting this query into a vulnerable application's database query.

Blind SQL Injection:

This technique involves injecting SQL code that does not generate any visible output. The attacker can then use techniques such as time delays or boolean logic to infer information about the database.

SELECT * FROM users WHERE username = 'admin' AND SUBSTRING(password, 1, 1) = 'a';

In this example, the attacker is attempting to determine if the first character of the admin user's password is "a". If the database returns a result, the attacker knows that the first character of the password is "a". The attacker can continue this process, guessing one character at a time, until they have determined the entire password.

Second-order SQL Injection:

This technique involves injecting SQL code that is not executed immediately, but is stored in the database for later use. When the code is executed at a later time, it can be used to perform a SQL Injection attack.

An example of a second-order SQL Injection query might look something like this:

Suppose a vulnerable web application allows users to submit feedback, and the feedback is stored in a database table called "feedback". The application also has a feature that allows users to view their own feedback by entering their email addresse. The query for retrieving the feedback might look something like this:

SELECT * FROM feedback WHERE email = 'user@example.com';

An attacker might submit feedback containing malicious SQL code that is not executed immediately but is stored in the "feedback" table for later use. For example:

' OR 1=1; INSERT INTO users (username, password) VALUES ('attacker', 'p@ssw0rd');--

This SQL code will create a new user with the username "attacker" and the password "p@ssw0rd" when a user with the email address "user@example.com" views their feedback. The attacker can then use this account to perform further attacks.

Check out this SQL Injection cheat sheet and SQL payloads.