SQL Injection Overview and Types

Study Notes

SQL injection (SQLi) is a critical web security vulnerability enabling attackers to manipulate database queries.
Attackers can gain unauthorized access to sensitive data such as passwords, credit card details, and personal user information.
Successful SQLi can lead to significant reputational damage and regulatory fines due to data breaches.

In-band SQLi (Classic): Attacks happen through the same channel used to retrieve results. It's common due to its simplicity.
- Error-based SQLi: Relies on error messages from the database to gather information about its structure.
- Union-based SQLi: Utilizes the UNION SQL operator to combine results from multiple SELECT statements.
Inferential (Blind) SQLi: Does not return data directly, relies on observing application responses.
Out-of-band SQLi: Involves interactions outside the usual communication channel, often used when in-band methods are not possible.

SQL injections may occur in various parts of a SQL query including WHERE clauses, UPDATE statements, INSERT statements, and ORDER BY clauses.
Vulnerabilities can arise from any input that is processed as SQL by the application (e.g., JSON, XML).

Second-order SQL Injection: Involves storing malicious input that doesn't immediately lead to vulnerability but is used in a later request.
Union Attacks: Allow attackers to retrieve data from additional tables by using the UNION keyword, requiring matching column counts and compatible data types.

Database type and version can be discovered via specific SQL queries (e.g., SELECT @@version for MySQL).
Information schema views help list database tables and contents, except in Oracle databases.

Phase 2: Server authenticated to client, public key knowledge established.
Phase 3: Client authentication completed, both parties share a pre-master secret.
Phase 4: Client and server ready for data exchange.

Differences between SSL and TLS lie in security features and protocols, focusing on data integrity and encryption.

HTTPS aims to verify the identity of a page's origin and prevent data modification during transmission.
Successful HTTPS implementation requires a valid certificate from a trusted CA, matching domain names, and certificate validation.

Authentication ensures users are who they claim to be, utilizing three factors:
- Something you know: passwords.
- Something you have: devices or keys.
- Something you are: biometric identifiers.

Authentication: Confirms user identity (e.g., login forms, HTTP cookies).
Authorization: Determines user permissions to access resources (e.g., using access control lists).