This year, over 500,000 web pages were defaced by a malicious SQL Injection…

Protecting Your Web SiteProtecting Your Web SiteFrom SQL Injection & XSSFrom SQL Injection & XSS

Chris Kenworthy</dream.in.code>®

August 27, 2008

SQL Injections

What is SQL?Structured Query LanguageUsed to retrieve and manage data in

relational databasesChances are your organization is using SQLExample:

SELECT firstName, lastNameFROM usersWHERE userID = ‘chris’;

What is a SQL Injection?A common security vulnerabilityOccurs when unfiltered input is executedEasily preventedExample of Vulnerability:

http://www.example.com/login.php?UserID=chris

SELECT firstName, lastNameFROM usersWHERE userID = ‘” + $UserID + “’

Example of an AttackOriginal Query:SELECT firstName, lastNameFROM usersWHERE userID = ‘” + $UserID + “’;

Set $UserID to: nobody’ OR ‘a’ = ‘a

Result:SELECT firstName, lastNameFROM usersWHERE userID = ‘nobody’ OR ‘a’ = ‘a’;

The ImpactQuery always returns trueAttacker authenticates as first user in

database

Possible Impacts:False authenticationPermissions escalationInformation disclosureIdentity theftMore…

Example of an AttackOriginal Query:SELECT firstName, lastNameFROM usersWHERE userID=‘” + $UserID + “’;

Set $UserID to: x’; DROP TABLE users; --

Result:SELECT firstName, lastNameFROM usersWHERE userID=‘x’; DROP TABLE users;--’;

The ImpactAttacker deletes entire users table!

Possible Impacts:Loss of dataData manipulationData insertionVirus/Malware distributionTotal database destructionMore…

Preventing SQL InjectionSanitize the input

Enforce data types (i.e. numeric, string, etc.)Use parameterized statementsUse stored proceduresLimit permissionsInstall an application firewall (my favorite)

Apache: mod_security (w/ Core Rules)IIS: URLScan 3.0 (Beta)

Cross Site Scripting

What is XSS?XSS (Cross Site Scripting)Allows execution of arbitrary codeOften involves tricking the end userOver 70% of web sites may be vulnerableExample:<<SCRIPT>alert("XSS");//<</SCRIPT>

How Does XSS Work?Scenario 1:

You get an email with a URL that looks like this: http://www.domain.com/index.php?userid=%3C%3C%53%43%52%49%50%54%3E%61%6C%65%72%74%28%22%58%53%53%22%29%3B%2F%2F%3C%3C%2F%53%43%52%49%50%54%3E

You click it and the web page outputs the userid variable resulting in this:

How Does XSS Work?Scenario 2:

There is a comment form on a web page. You paste this string in to the form:<<SCRIPT>alert("XSS");//<</SCRIPT>

Now every user that visits that page will see this:

Why Does It Work?Inputs are displayed as HTML instead of

character entities:

Cookies are not securedSessions can be hijacked

The Impact of XSSIdentify TheftMalwareSession Hijacking

User impersonationRedirectionMisinformation

Preventing XSS AttacksConvert all inputs to HTML character

entities before outputting to the screenSecure cookies using the httpOnly attributeAssociate sessions with IP addressesInstall an application firewall (again, my

favorite)Educate users!

Don’t click links in emails you don’t recognizeDon’t fill out forms from links in emails

Resources Scrawlr – Find SQL injection vulnerabilities in your site

Mod_security – Web application firewall (Apache)

URLScan – Web application firewall (IIS)

XSS Examples

Closing ThoughtsIf you have a web site, you will be attacked

Don’t trust developers to secure their code

Use an application firewall if possible

Be proactive

Questions?

Comic from XKCD: http://xkcd.com/327/