Web Application Breaches And Attacks (SQL Injection)

Essay, Pages 7 (1550 words)

Views

INTRODUCTION TO WEB APPLICATION AND BREACHES

Websites and web applications are under a constant barrage of attacks whether if it’s a large or small one. In 2008, Crist said that attack upon information security infrastructures have continued to evolve steadily overtime; legacy network-based attacks have entirely been replaced by the more sophisticated web application-based attacks. (Crist, 2008). Web attack is the biggest threat to your network where the growing in number with 100 % of organisations in a huge survey concludes that they had currently suffered a web attack, similar study have found that Web attacks are the most detrimental type of attack which causes organisations over 100 times more than malware and 50 times more than viruses, worms and trojans annually (Imperva, 2014).

Don't use plagiarized sources. Get your custom essay on

“ Web Application Breaches And Attacks (SQL Injection) ”

Get custom paper

NEW! smart matching with writer

Later being edged out in 2008 as the most-used path of intrusion, web applications now reign supreme in both the number of breaches and the amount of data compromised through this vector. Both Verizon and USSS cases show the same trend. This falls perfectly in step with the Findings pertaining to types of attacks discussed above.

Web applications have the rather unfortunate calling to be public-facing, dynamic, user-friendly, and secure all at the same time. Apart from that, figure below shows result obtained from a yearly breach report, which shows that 53,000 incidents and 2,216 confirmed data breaches in 2018. This outcome informs us on the threats we face and to provide support, instruction and encouragement on how best to protect against them (V, 2018)

INTRODUCTION TO PENETRATION TESTING TOOL

A penetration testing is run to uncover the security weaknesses of a system and to identify the ways in which the system can be compromised by a potential attack.

The purpose of penetration test is completely to identify the subject’s capability to withstand an attack by a hostile intruder and organisations must test on their security measure whether if its functioning effectively. (Fried, 2000). Probably the easiest prevention is an SQL injection attack, while also being on of the least protected against forms of attack. Method of exploiting the database of web application is SQL injection, this is done by injecting the SQL statements as an input string to obtain an unauthorized access to a database. This injection has a serious vulnerability that leads to a high level of compromise which usually enables to run any database query. SQL injection is a web-based application attack that connects to database back-ends and allows the bypass of firewall (Ahmad, 2010). Also highlighting on the objective of SQL injection attack is to shaft the database system into running harmful code that can reveal confidential information therefore we can say that SQL injection is an unauthorised access of database. (Ahmad, 2010.

TYPES OF SQL INJECTION AND SCENARIO

Error based SQL injection

An attacker can easily extract details such as table names and content from visible database errors and this could be also easily detected by the hackers on the production servers, to avoid this scenario, displaying database error message which in turn prevents hackers from fetching that information (Admin, 2018). How does this works is that when the user asked a question to the database, it responds with an error message including the data that were asked, besides, with error based SQL injection possibilities are there to exfiltrate adequate data at a reasonable rate to cause immense damage if the data is complex, this is an absolute easy thing because a person can only retrieve the data one or more at a time.

Union SQL injection

Union SQL injection is the famous type of SQL injection, in this attack, it uses the UNION statement which is the integration of two select statements to obtain data from the database (Fieldhouse, 2017). This injection is performed by appending forged query to the original query and the Union Select statements returns the union of the legitimate datasets with target datasets so in this case, the hackers uses statements, which is the integration of two select statements, to gain data from the database.

Blind SQL injection

A blind SQL also known as inferential SQL is used when the web application is vulnerable to an SQL injection, but the result of the injection is hidden to the attacker. The display page might be different from the original page, this based on the result obtained from the logical statement injected into the legitimate SQL statement called for that page or site. The blind SQLIA permits the threat agent to infer the construct of the database through evaluating expressions that are coupled with statements that will always evaluate to true and segments that evaluate to false (Ahmad, 2010).

Furthermore, the blind SQL injection is separated into two types; such as Boolean based and Time based, these methods can be used to extract data in the database by either asking question or inducing a time delay.

Out-of-band SQL injection

Apparently, an Out-of-band SQL injection is not commonly used because mostly it depends on the features being enabled on the database server being used by the web application. When the hacker is unable to use the similar channel to launch the attack and collect information is where an out-of-bond SQL injection occurs (Acunetix, 2018).

IMPACT SQL INJECTION ON SECURITY

Despite many existing techniques such as filtering, information-flow analysis, penetration testing a defensive code can be detect and prevent a subset of the vulnerabilities that lead to SQLIAs. Still, filtering the input validation seems very efficient and simplest technique. It is found that SQLIA detection techniques that employ input validation are disposed to large number of false positives and yet there is no 100% guarantee that there ae no false negatives (Thiyab, 2017)Past few years, SQL injection has become theme most wanted method to attack systems and extract information. An attacker signifies an operative way to compromise data layers even if firewalls and intrusion detection systems are in place. The data is easily accessible once the control has been taken over the database and hackers have a smart position to outbreak other systems, clients and users related to the database (SQLinjection, 2016).

Numerous studies have been made till date on the security breaches and SQL injection attacks come among the most famous yearly. Referring to the 2011 data breach investigations report produced by Verizon Business, SQL injection attacks were responsible of nearly 25% of all compromised records. Clearly this is a major security issue and it must not be messed with, but rather its consequences are frequently ignored since those attacked are misjudged (SQLinjection, 2016). A business’s data leakage can cause a huge lost to the organisation and the user will require to evaluate the value of the data that can be compromised. As for an example, publicly disclosed attacks habitually involve huge amount of stolen customer’s credit card numbers or personal data’s which will affect the image of the bank or organisation and will result a drastic drop in the profit and lost statement of their annual report. Apart from that, the hackers can also target to steal the customers, supplier, marketing strategies, new products specifications and employees’ personal details that could be used against them or against the organisation or bank as gain more strength over them. This could be a worst scenario for a business organisation to face because multiple individuals are involved, and this could bring such a bad impact on the business.

GENERAL FUNCTIONALITY

A SQL injection attack involves the alteration of SQL statements that are used within a web application using hacker-supplied data. Lack of input validation and improper construction of SQL statements in web applications can expose them to SQL injection attacks. SQL injection is a prevalent and potentially destructive attack that the Open Web Application Security Project (OWASP) lists it as the number one threat to web application (cisco, 2018). SQL injection can be generally used to perform the following types of attacks as below;

• Authentication Bypass - This attack allows a hacker to log on to an application, potentially with the authorisation as administrative which gives them privileges as an administration, without even providing a valid username and password. By which, the hacker can easily avoid the real checks or, in some cases the whole security subsystem.
• Information disclosure – a hacker is allowed to gain, either directly or indirectly, sensitive information in a database. This occurs when an application fails to appropriately protect highly confidential information from the parties that are not theoretically to have access to such information in normal circumstances.
• Compromised data integrity – this attack involves the modification of the contents of the database. A hacker could use this method to deface a web page or perhaps insert inappropriate or wrong content into otherwise innocuous web pages, this technique has been demonstrated in Mass exploits with SQL injection at the SANS Internet Storm Center (cisco, 2018).
• Compromised Availability of Data – This attack permits the hacker to delete information with the intention to cause harm or delete log or audit information from the database, these are very vital information of an organisation.
• Remote Command Execution – Performing command execution through a database which permits the hacker to negotiation the host operating system. These hackers regularly leverage an existing, predefined stored technique for host operating system command execution. The most recognised variation of this attack uses the xp_cmdshell stored technique that is common to Microsoft SQL Server installations or leverages the ability to generate an external process call on Oracle databases (cisco, 2018).