Skip to main content

Featured

Sizzling Delight

  Sizzling Delight: The Irresistible Sausage Pepper Burger Introduction: Burgers have evolved from simple sandwiches to culinary masterpieces, and the Sausage Pepper Burger stands as a testament to this gastronomic transformation. This delightful creation combines the savory goodness of sausage with the vibrant flavors of peppers, resulting in a symphony of tastes and feels that captivate the taste buds. In this exploration, we delve into the origins, the art of crafting, and the sheer delight that the Sausage Pepper Burger brings to culinary indulgence. Origins of the Sausage Pepper Burger: The roots of the Sausage Pepper Burger can be traced back to the classic Italian-American dish, sausage and peppers. For decades, this beloved combination of sautéed sausages and colorful bell peppers has been a staple at Italian festivals and gatherings. The natural progression from this flavorful duo to a burger was a stroke of genius that took the traditional to the extraordinary. ...
Post a Comment
Read more

Web page vulnerabilities

 This article is the latest in a succession on web page vulnerabilities. In previous articles, we looked at the recognition vulnerabilities of Command Injection, LFI (local file inclusion) and RFI (remote file inclusion), XSS (cross-site scripting), and WEB. In one XSS vulnerability, we saw how attackers can inject malicious code using JavaScript, which is a client-side language; so the code runs in the user's browser. The vulnerability we are going to see today is also a code injection, but in this case on the server side, specifically in the database service that stores the information of the web page. If an attacker gains access to this database, he can take really dangerous actions.

What is SQL Injection?

Given the need for dynamic content in modern web applications, many of them depend on a database to store data that will be requested and processed by the web application. Web applications query these databases to access the data stored in them, using Structured Query Language or SQL (Structured Query Language) to execute these queries.

To understand this better, we'll look at an example. They made us a web page for our company, in which we have a personal area where you need to enter a username and password to access, this web page stores the login details to a database called "Company".

The web application will request to retrieve data from the database for display. The SELECT statement will be used to execute this query. With it, once the database and the table of interest are found, the data can be filtered to display some records, for example, records in the Users table, in which the id column is 1. It uses the WHERE clause.

How does SQL injection work?

An SQL injection attack occurs when a value in a client request is used in an SQL query without first being cleaned up. If, as web developers, we have not sanitized the code and trust the data provided by users, attackers can extract hidden information from databases or take control of a server.

For example, if the previous query, in which we accessed a record with ID 1, is executed on a web page to display user data, we indicate that we want him to order the data output by column number 10.

As we can see, this means that column 10 is unknown. Column 10 clearly does not exist, since we have only 4 of them, but attackers are interested in knowing the number of columns in the table. If ordered by 4, the data is already displayed:

Once the attacker knows the number of columns in the requested table, he will execute a 4-column query connecting it to the current query using the UNION clause:

SQL injection example

We can view this type of SQL injection as error based. We are going to take advantage of the error that you are about to show us on the website to list privileged information from the database.

We have a web page text box where we write our username and password, and when we run it, our account details appear on the page. To do this, we have previously created an account in this web application.


Popular Posts