SQL Injection is a web attack mechanism used by hackers to
gain access to the unauthorized databases and other content. It can be
commonly described as the application layer attack.
Reason Behind the attack
The main reason behind SQL injection is improper coding
techniques employed in development. This sort of improper coding gives a way
for hackers to inject the malicious SQL command that in turn fetches the required
unauthorized content to the hackers.
What skills required for a hacker?
Mostly hackers perform few simple attacks by just having
basic knowledge with web browsers, SQL, creative guesswork to find table and
field names
Where it starts?
Most hackers start injecting the malicious SQL commands in Login Pages or in Support and Product request forms easily
Why Login pages act as the best place to start hacking?
Basically, SQL injection starts from login pages. During the login process, the user types the credentials (i.e. username and password)
which is matched against the content that exists in the database. Hackers use this
communication gap. They bypass access by interrupting this communication.
They inject their content into DB and use this as a channel to steal the data.
By worst case, the content becomes readable and get exposed to the hackers.
What technologies are used by hackers?
Hackers mostly use dynamic scripting languages like ASP.Net,
PHP and Javascript.
SQL injection affects relational databases like
MySQL,Oracle,Microsoft Access,MS SQL Server ,etc..
SQL injections fall into categories like First Order Attack and Second-Order Attack
First Order Attack:
In this method, the hacker attack some strings to the input
field and gains the response immediately
Second-Order Attack:
In this method, the hacker enters the malicious code into
the database table and later access it with a third party ie another activity
Tips to prevent SQL injection attacks
1.
Strong server-side validation is recommended
2. The stored procedure may prevent some sort of
attacks
3.
Patches can be used
4.
Never allow the special characters in the user
inputs
5.
Minimize the usage of executable SQL commands in
SQL server
Step 2 :
