SAMAR SARWAR S2142281 RPM literature review.docx -...

SUBMITTED BY: SAMAR SARWAR
STUDENT ID: S2142281
MODULE NAME: RESEARCH & PROJECT METHODS
SUBMITTED TO: HADI LARIJANI
SUBMISSION DATE: 19 JAN 2022
Database Security in
Context of SQL Injection
Attacks

TABLE OF CONTENTS
1 Abstract: ........................................................................................................................................................ 3
2 Introduction: .................................................................................................................................................. 3
3 Importance of Cyber Security: ....................................................................................................................... 4
4 SQL Injection Background: ........................................................................................................................... 4
4.1 Types of SQL Injection Attacks: ............................................................................................................. 5
4.1.1 In-band SQLi: ................................................................................................................................. 5
4.1.2 Error-based SQLi: ........................................................................................................................... 5
4.1.3 Union-based SQLi: ......................................................................................................................... 5
4.2 Inferential (Blind) SQLi: ........................................................................................................................ 6
4.2.1 Boolean Based: ............................................................................................................................... 6
4.2.2 Time Based: .................................................................................................................................... 7
4.3 Out-of-band SQLi: .................................................................................................................................. 7
4.4 SQLi Examples using PHP: .................................................................................................................... 8
5 Technique Causes SQL Injection in php
code: ................................................................................................ 12
6 Preventing SQL injection: ............................................................................................................................ 13
7 SQL injection tool: ....................................................................................................................................... 13
7.1 SQLmap ................................................................................................................................................ 13
7.2 Safe3 SQL Injector ............................................................................................................................... 13
7.3 SQLSus ................................................................................................................................................. 13
7.4 Mole ..................................................................................................................................................... 13
7.5 BSQL Hacker ........................................................................................................................................ 13
7.6 Blind SQL Bitshifting ........................................................................................................................... 13
7.7 SQLi Dumper ....................................................................................................................................... 14
7.8 Havij ..................................................................................................................................................... 14
7.9 JSQL Injection ...................................................................................................................................... 14
7.10 BBQSQL .......................................................................................................................................... 14
7.11 NoSQLmap ........................................................................................................................................... 14
7.12 DSSS ................................................................................................................................................ 14
7.13 Blisqy ................................................................................................................................................ 14
7.14 WhiteWidow ..................................................................................................................................... 14
7.15 Explo ................................................................................................................................................ 14
8 Conclusion: .................................................................................................................................................. 15
9 References: .................................................................................................................................................. 15
2

Database Security in Context of SQL Injection Attacks
1 Abstract:
Database security is the major concern while developing web applications. There are different techniques that
are used by attackers to retrieve sensitive unauthorized data from the system or to gain unauthorized access to
some systems. SQL injection techniques are easy to perform and are used by most of the attackers. There are
various techniques and kinds of SQL injection attacks. But by using different techniques and validating the
information, SQL injection attacks can be prevented. Extensive testing should be performed before making
any project live so that there doesn’t remain any vulnerability in the system.
2 Introduction:
Database security means designing a variety of measures, tools and controls to establish and protect database
confidentiality, integrity, and availability to secure it from illegitimate and malicious Cyber attacks and threats.
It not only refers to protecting just database but also the applications and systems accessing it from damage,
intrusion and misuse.
Data is a valuable entity and its security and management are the major concerns because it may have tactical
importance to the respective organization or person so its protection and security must be ensured. The
breaking of security and leakage of data may harm not only the applications and system but also the persons in
some ways by leaking their personal data and information.
Attackers use different techniques to get unauthorized access of the system and to get private information and
data out of the databases of different systems and applications. Some of the major techniques used are as
below:
 Remote Code Execution
 Exploiting Software Vulnerabilities
 Packet Sniffing
 SQL Injection
 Cross Site Scripting (XSS)
A lot of data of different organizations loses their data every year due to different cyber-attacks by many
attackers all over the world which not only affects the organizations because the organization loses its trust to
its employees and clients but it also affects the persons directly whom that data belongs to. Out of all the
techniques used by attackers, one of the major techniques is SQL Injection. According to research done by a
well-known site, about 55% of attacks are done using SQL injection techniques. Below picture shows major
attacking techniques and it depicts how SQL injection stand out of them with a ratio of 55 percent.