Full Disclosure mailing list archives
Antitoxin for "SQL Injection" (?)
From: "Sen, Adem" <asen-public () sage de>
Date: Mon, 2 Jan 2006 13:45:12 +0100
Hi @all! I have invested some time to think about detecting & preventing SQL Injection attacks to web-applications. Like many of us know, there are several methods to filter dangerous input in web-applications, e.g. searching for specific RegEx Pattern and so on. I have built following (primitive) RegEx Pattern to filter input to my private used web-apps: RegEx Start /SELECT|INSERT|UPDATE|ALTER|CREATE|DELETE|DROP|FROM|WHERE|OR|AND|LIKE|EX EC|SP_|XP_|SQL|ROWSET|OPEN|BEGIN|END|DECLARE|;|--|-|'|\(|\)|=|>|<|@/i"; /RegEx End But it sucks, that I have to validate all incoming input on every request. This is time consuming and makes it not easier to write well-apps, even with general routines to proof all incoming Data from GET / POST and so on. But what would happen, if a web-app injects some code / chars in a specific scheme into an incoming input, to DESTROY a possible SQL Injection attack - Like an antitoxin, that neutralizes a virus? I know, this is very abstract, let's try an example to show what I mean: Example, incoming SQL Injection Code before "injecting antitoxin": Code start Select * from Customer where customeriID = ''; DROP DATABASE CustomerDB -- /Code End NOTE: SQL Injection Code starts with '; DROP .... Now, if I inject my so called antitoxin in form of a CHAR (e.g. ASCII 255) that is placed between every second CHAR in the input String, my SQL-Server doesn't execute any arbitrary SQL Code - so now "SQL Injection" will NOT be possible: Example, incoming SQL Injection Code after "injecting antitoxin", using ASCII 255 (Looks like Space but isn't one) - I will use "#" for indicating ASCII 255 inthis example, to differ from SPACE ASCII 20: Code start Select * from Customer where customeriID = '#'#;#D#R#O#P D#A#T#A#B#A#S#E C#u#s#t#o#m#e#rD#B# -#- /Code End With this method; I was not able to inject any arbitrary SQL-Code, that was actually executed, the worst case ends in getting some SQL-Errors, which will be caught by my Exception handlers! :-) So, if you have to output the "antitoxed string", you just have to automatically remove ASCII 255 from all you output, to get well formed text, and voila! This helped me a lot and I want to know, what you think about this? Thanks! Regards, Adem Sen IT-Security Specialist Sage Software GmbH & Co. KG ________________________________________________________ Sage Software GmbH & Co. KG, Berner Str. 23, 60437 Frankfurt - Germany E-Mail: asen-public@REM#OVETHIS.de Internet: www.sage.de ________________________________________________________ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Antitoxin for "SQL Injection" (?) Sen, Adem (Jan 02)
- Re: Antitoxin for "SQL Injection" (?) Devdas Bhagat (Jan 02)
- Re: Antitoxin for "SQL Injection" (?) Vulnerability Management (Jan 02)
- <Possible follow-ups>
- RE: Antitoxin for "SQL Injection" (?) Sen, Adem (Jan 02)
- Re: Antitoxin for "SQL Injection" (?) James Tucker (Jan 02)
- Re: Antitoxin for "SQL Injection" (?) Jan Muenther (Jan 03)
- Re: Antitoxin for "SQL Injection" (?) Marco Ermini (Jan 03)