SQL Injection Attack

The most common technique used to attack a website. It is a code injection technique which exploits security  vulnerability in a website's software.

Now lets begin with the login process
Let's say that you are sitting at your computer, surfing the Web, and you open a Website to Login to your account.

1. You type in the Login Username and Password and clicks on Sign in and you get in to your account.
2. Web Server receives the Username and Password and forwards it to the Database server.
3. Database server receives the Username and Password from the Web Server and checks its tables for that Username and Password and sends the result of the authentication to the Web Server.
4. Web Server receives the Authentication result from the Database Server and on the basis of the result, redirects the User to the proper Webpage.
5. If the Authentication is True, User gets signed in to the Account, and if it fails User is asked to Sign In again.

SQL INJECTION

A SQL injection attack exploits vulnerabilities in a web server database that allow the attacker to gain access to the database and read, modify, or delete information.  

An example of a SQL injection attack is making the condition true by giving the identical value to a web page.

These values can be inserted into a login as follows:

Login: 1' or '1'='1 and Password= 1' or '1'='1

Login: 1' or '1'='1';--

When the Username argument is evaluated, ‘1’=’1’ will assess to TRUE, and an authentic username will be returned.

Now you need to search for a website which is SQL Vulnerable 

Got to google and search 

inurl:adminlogin.asp

inurl:login.asp

For example I have a website for you 

http://www.amskrupajal.org/AdminLogin.asp

You can find out more websites and to test that website is vulnerable or not just put a quote (') at the end of the URL and press enter and if you get the page as shown in image then the website is vulnerable and can be hacked with SQL Injection. 

Now you have a website, then try to attack it with SQL Injection by simply typing the following user name and password and hit enter. 

username: a'or'a'='a

password: a'or'a'='a

and you are logged in. 

Input Validation in SQL Injection

There are measures that can be applied to mitigate SQL injection attacks.

• Web developer can check whether some suspicious characters are sent from the Login Page like ‘, “, ;, -- , etc
• Always store the Passwords in the Database server in the Encrypted Form.
• Use of these practices does not guarantee that SQL injection can be completely eliminated, but they will make it more difficult for Hackers to conduct these attacks.

Share if you liked this Post using your favorite sharing service:

• Facebook
• Twitter
• Google+
• Pinterest
• StumbleUpon
• Delicious
• LinkedIn
• Reddit
• Technorati

Subscribe Updates, Its FREE!