SQL Injections

Mods close/bin this if I cannot make this.

The Attackers and The Innocent

Here, you will learn the basics of using SQL Injections to attack a site. Though, this is not the only reason, here you will also learn how/if your site is vulnerable to a Blind Injection, and how to stop it. This is very basic, there may be a possiblity I will make another thread like this to teach the advanced part of SQL Injections. So on with the tutorial (bitchez!)

The Attackers

Ok, first off, I'd like to share to you what an SQL Injection looks like, then I will show you what you can do.

Example of a Statement using SQL:

Code:

select id, surname f/ authors, forename

Now, this statement should get back the id, surname, and forename of the creators.

Code:

sel/ id, forename, surname f/ authors where forename = 'bob' and surname = 'the builder'

Something you should know is that the names are delimited w/ the single quotes seeing as though the frname and srname parts coming from a dude-supplied input, someone (The Attacker) could inject some SQL into that query.

He would put in the value and make something as:
F-Name: Bo'b
S-Name: The Builder

Then, the string should become something like this:

Code:

select id, forename, surname from authors where forename = b'ob' and
surname = 'The Builder'

When it tries to run that string, an error should pop up:

Code:

Server: Msg 170, Level 15, State 1, Line 1
Line 1: Incorrect syntax near 'ob'.

Ok, so that is seriously the basics of the basics of SQL Injections. Lets see how you can protect yourself, and how you can find out you're getting attacked.

The Innocent

*TBC* Working on right now.