Injection

Quick overview of Injection attacks

Transcript

1. Injection
2. Exploits the ability to send untrusted data to an interpreter — SQL, LDAP, Xpath, or NoSQL — OS commands — XML parsers — SMTP Headers — Program arguments
3. Vulnerable Targets Any system that takes potentially untrusted input
4. Exploit Difficulty: Easy! — Attacks are usually plain text based — Mike can craft them in a couple hours for a presentation
5. Exploit Impact: Can be devastating — Any stored data can potentially be leaked — Privilege escalation can lead to host takeover
6. Examples — 2008: Heartland Payment Systems had 134 million credit cards exposed — 2009: 2 NASA sites demonstrated to be vulnerable. Hacker able to get credentials of 25 admin accounts — 2013: 71 Chinese government databases compromised in an attack on Chinese Chamber of International Commerce
7. SQL Injection — One of the top methods of stealing information and attacking systems — Gets around firewalls and intrusion detection systems — Can gain enough privileges to act as system admin — Can exploit other clients that access the database
8. Classic Attacks
9. WHERE clause manipulation — User provided input often ends up in WHERE clause — Used for login bypass or fast testing — Direct Injection or Quoted Injection
10. Direct Injection — Vulnerable numeric parameters — No string escaping needed Provided user input: 9999 OR 1=1 SELECT id, name, description FROM products WHERE productid=9999 OR 1=1 Returns all products
11. Quoted Injection — Vulnerability surrounded by quotes — Must craft the query more carefully Input: zzzz' OR 'a'='a SELECT id, name, description FROM products WHERE category='zzzz' OR 'a'='a' Returns all products
12. Injection Using Union — Used in conjunction with WHERE clause manipulation — End the previous query, execute a new valid query with a Union — Make the previous WHERE clause return false, so only the new query data is retrieved — Both queries must have the same structure
13. Input: zzz' AND 'a'='b' UNION SELECT 'a', 'b'', credit_card FROM payment_details WHERE 1=1 SELECT id, name, description FROM products WHERE category='zzzz' AND 'a'='b' UNION SELECT 'a', 'b', credit_card FROM payment_details WHERE 1=1
14. Practice Time! http://www.sqlinjection.net/
15. Prevention — TLDR: keep untrusted data separate from commands and queries — APIs should avoid interpreter entirely — Escape special characters — White list input validation
16. FIN