Analysis of SQL injection prevention using a proxy server By: David Rowe Supervisor: Barry Irwin

Presentation Outline What SQL injection is Example Project Objectives Design and Implementation Expected Results Current Status Possible Extensions Questions

SQL injection SQL Injection is a method by which the parameters of a Web-based application are modified in order to change the SQL statements that are passed to a database. An attacker is able to insert a series of SQL statements into a 'query' by manipulating data input.

SQL injection

Example Vulnerable web page

In ASP, a critical vulnerability is the way in which the query string is created. example: var SQL = "select * from users where username = ' "+ username +" ' and password = ' "+ password +" '"; Example

Username: ‘;drop table users-- the 'users' table will be deleted, denying access to the application for all users

Example Query executed: select * from users where username = “ drop table users

Example

Project Goals Analyse the structure of SQL query commands Build a parser that will check allowable patterns of SQL statements Create a proxy server that will filter SQL commands. Prevent a SQL injection attack to a database using this proxy server. Prove that SQL injection can be prevented using the filter developed to work on the proxy server.

Development Environment Microsoft Windows XP Microsoft Visual Studio.net - C Sharp Microsoft Visual Source Safe Microsoft SQL Server 2000

Implementation Step

Expected Results Prevention of a SQL injection attack by filtering the queries using the proxy server List of best practices for –Web design –Database administration

Current Status Working proxy server –Extracts the SQL from a TDS packet –Logs that SQL query to a separate log file Work in progress: –Log to the database –Prevent a SQL injection attack White listing Black listing

Possible Extensions Handle other databases examples: Oracle, MySQL and Postgres Other operating systems example: Linux

Questions