preview

Lab10 SQL Injection Attack Lab Essay

Satisfactory Essays
Open Document

Lab10 SQL Injection Attack Lab
Yukui Ye
SUID: 439644268

Task1: SQL Injection Attack on SELECT Statements

Setup: Turn off build-in SQL injection protection
Set magic_quotes_gpc value to ‘off’ in file /etc/php5/apache2/php.ini in order to turn it off.

Then restart it:

Task1.1: Log into another person’s account without knowing the password
Check the login part code to see how it login works.

Following is the PHP codes run at server side.

From the above code, we can tell how server send query to Database. But we can still guess to login without knowing the user’s passward by typing “bob’);-- “( space after the comment’--’ )

By doing above thing, we successfully log into user’s account.

Task1.2: Find a way to modify the database. …show more content…

Step2: Now, we are trying to modify the password of bob. Login as alice and modify the profile. Change name to bob. ATTENTION: The password we are going to write in the company field should be hashed. By searching for the internet, I found that string” 123456” is “7c4a8d09ca3762af61e59520943dc26494f8941b”

In the company field, type like this :
SU’,pass=’7c4a8d09ca3762af61e59520943dc26494f8941b’ where ID=3 --

Now login bob with our password 123456

We can successfully login and changed the bob’s profile.

Task3: Countermeasures
I add debug output information in login function at PHP file in order to what will happen with following countermeasures.

Task3.1: Escaping Special Characters using magic_quotes_gpc
Set magic_quotes_gpc to on, and restart server.

when you press “comment a” on the keyboard, it immediately show code on the top of the window.
We could see there is blackslash before single quote that we input in user name field. This setting escape the quote automatically, therefore even if we use’--’to comment the statement, we cannot match the quote. Thus, we cannot login.

Task3.2: Escaping Special Characters using mysql real escape string
Set magic_quotes_gpc to Off.

Uncomment mysql_real_escape_string in PHP file for login section.

Do the same task in Task1, but we cannot login successfully, The code shows on the top of the window is the same as the previous task, there is blackslash before

Get Access
Related
Get Access