Book Image

SQL Injection Strategies

By : Ettore Galluccio, Edoardo Caselli, Gabriele Lombari
Book Image

SQL Injection Strategies

By: Ettore Galluccio, Edoardo Caselli, Gabriele Lombari

Overview of this book

SQL injection (SQLi) is probably the most infamous attack that can be unleashed against applications on the internet. SQL Injection Strategies is an end-to-end guide for beginners looking to learn how to perform SQL injection and test the security of web applications, websites, or databases, using both manual and automated techniques. The book serves as both a theoretical and practical guide to take you through the important aspects of SQL injection, both from an attack and a defense perspective. You’ll start with a thorough introduction to SQL injection and its impact on websites and systems. Later, the book features steps to configure a virtual environment, so you can try SQL injection techniques safely on your own computer. These tests can be performed not only on web applications but also on web services and mobile applications that can be used for managing IoT environments. Tools such as sqlmap and others are then covered, helping you understand how to use them effectively to perform SQL injection attacks. By the end of this book, you will be well-versed with SQL injection, from both the attack and defense perspective.
Table of Contents (11 chapters)
1
Section 1: (No)SQL Injection in Theory
4
Section 2: SQL Injection in Practice

Chapter 3

  1. Virtualization software is a special kind of software that fully emulates systems. We use it so that our tests do not involve other external parties. This means we do everything in a controlled setting.
  2. Kali Linux is a special Linux distribution that includes a suite of software for security professionals. We need it to show automated SQL injection attacks against web applications.
  3. The OWASP BWA project is a collection, in the form of a virtual machine, of purposely vulnerable web apps. We typically use it as a target for our web application attacks.
  4. We emulate web services, which represent a different interface with respect to traditional web applications, and mobile devices, which show the vulnerability in a mobile setting.
  5. Absolutely not. Only test against systems that belong to you. Never test on systems that belong to third parties without prior explicit and formally expressed consent (that is, a contract).