What is SQL Injection Attacks | How to hack website|Solution for SQL Injection|SQL Injection example
Step by Step learning video for SQl Injection, How to to check SQL Injection vulnerability .
When Sql Injection attack is possible
===============================
appending a condition that will always be true.
Advantage of Poor design
execute malicious SQL code.
What happen after SQl Injection attack on website link
==============================================
The attack works on dynamic SQL statements
SQL Injection is an attack type that exploits bad SQL statements
SQL injection can be used to bypass login algorithms, retrieve, insert, and update and delete data.
How to Prevent against SQL Injection Attacks
=============================================
An organization can adopt the following policy to protect itself against SQL Injection attacks.
User input should never be trusted - It must always be sanitized before it is used in dynamic SQL statements.
Stored procedures – these can encapsulate the SQL statements and treat all input as parameters.
Prepared statements –prepared statements to work by creating the SQL statement first then treating all submitted user data as parameters. This has no effect on the syntax of the SQL statement.
When we use JPA kind of ORM tools like Hibernate, EclipseLink, TopLink that time also may be sqlinjection is possible.
To prevent the SQL injection we need to use NamedQuery instead of normal Query. Because NamedQuery internally used PreparedStement but normal query used norma Stement in java.##
Regular expressions –these can be used to detect potential harmful code and remove it before executing the SQL statements.
Database connection user access rights –only necessary access rights should be given to accounts used to connect to the database. This can help reduce what the SQL statements can perform on the server.
Error messages –these should not reveal sensitive information and where exactly an error occurred. Simple custom error messages such as “Sorry, we are experiencing technical errors. The technical team has been contacted. Please try again later” can be used instead of display the SQL statements that caused the error.
Tool : sqlmap(Test the security of database) , wireshark
How to avoid
------------
keep limits for textbox
Strong client side validation.
assign limited feature to end user
use drop down if data is fixed
use regular expression (aadhar card, ATM Card , Bank Account ,PAN Card ,age, zip code. ...etc)
Two step security validation.
can use capch or OTP for security.
use hashing mechanish to store login passward.
download book : SQL injection attack and defence ...https://www.google.com/url?sa=t&sourc...
#TeamLead
#sqlinjection
#websitehacking