Exploiting and Mitigating SQL Injections

Exploitation

One of the aims of every cybercriminal is to get access to databases to steal users’ credentials, alter the data, or even sabotage an organization’s ability to function by deleting everything. This is where finding SQL injections becomes important. The data gained from an injection or even the injection vector could be used to perform other attacks or go straight for privilege escalation if possible.

Let’s look at some ways in which SQL injections can be exploited.

The GET method

We first check that the data sent in the request is referenced in the URL. If yes, this means that the data that’s sent is visible in the URL. For example, let’s take a web application that has a login page. We enter the username and password, and when we click the “Login” button, the URL updates as such:

example.com/login.php?username=admin&password=admin

In order to bypass the login and gain unauthorized access, an attacker could perform a simple SQL injection like so:

example.com/login.php?username='OR1=1--&password=admin

Entering the URL above will simply input an empty string for the username field and dismiss the password field altogether, and the OR1=1 part will ask the database server to return true no matter what.

The POST method

This is the case where ...