Gemini on Question 18, Oct 1

SQL injection (SQLi) occurs when an application takes untrusted user input and includes it directly in a database query without proper sanitization or parameterization. This allows an attacker to alter the logic of the query, potentially leading to unauthorized data access, modification, or deletion.

When briefing developers, it is helpful to categorize SQL injection into three main classes based on how the attacker extracts data from the database.

1. In-Band (Classic) SQLi

In-band SQLi is the most common and straightforward type of SQL injection. It occurs when the attacker uses the same communication channel to both launch the attack and gather the results.

There are two primary sub-types of in-band SQLi:

• •Error-Based SQLi: The attacker intentionally inputs SQL syntax that causes the database to generate an error. If the application displays these verbose database error messages directly to the user, the attacker can use the information within the error (such as table names, column names, or database version) to map the database structure and craft further attacks.
• •Union-Based SQLi: This technique leverages the UNION SQL operator. The attacker injects a UNION SELECT statement into the original query. This forces the database to combine the legitimate results intended by the application with the results of the attacker's injected query, returning both sets of data within the application's standard HTTP response.

2. Inferential (Blind) SQLi

Inferential SQLi occurs when the application is vulnerable to injection, but its HTTP responses do not contain the results of the relevant SQL query or any database errors. Because the attacker cannot see the data directly, they must reconstruct it by asking the database a series of TRUE or FALSE questions and observing how the application behaves.

There are two primary sub-types of inferential SQLi:

• •Boolean-Based (Content-Based) Blind SQLi: The attacker injects an SQL query containing a condition (e.g., "Is the first letter of the administrator's password an 'A'?"). The attacker then observes the application's response. If the application returns slightly different content based on whether the injected condition was TRUE or FALSE, the attacker can systematically determine the data, character by character.
• •Time-Based Blind SQLi: If the application's response content does not change based on a TRUE/FALSE condition, the attacker can use time-delay commands (like SLEEP() or WAITFOR DELAY). The attacker injects a condition along with a time delay (e.g., "If the first letter of the administrator's password is 'A', pause for 5 seconds"). By measuring how long the application takes to respond, the attacker can infer whether the condition was TRUE or FALSE.

3. Out-of-Band (OOB) SQLi

Out-of-band SQLi is less common and relies on the database server itself having the ability to make external network requests (such as DNS or HTTP).

This technique is typically used when an application is vulnerable to SQL injection but neither in-band nor inferential techniques are viable (for example, if the query is executed asynchronously and does not affect the HTTP response). The attacker crafts a payload that forces the database server to transmit the targeted data to an external server controlled by the attacker.

Mitigation Strategies for Developers

When briefing the development team, emphasize that SQL injection is entirely preventable. The discussion should focus on these primary defenses:

• 1.Prepared Statements (Parameterized Queries): This is the most effective defense. Prepared statements ensure that the database treats user input strictly as data (parameters) rather than executable code, regardless of the characters the input contains.
• 2.Object-Relational Mapping (ORM): Many modern ORMs automatically use parameterized queries, reducing the risk of SQLi. However, developers must still be careful when using custom or raw queries within the ORM.
• 3.Input Validation: Implement strict allow-listing for user input, validating that the data matches the expected type, length, and format before it is processed.
• 4.Principle of Least Privilege: Ensure the database user account used by the application only has the minimum permissions necessary to function. For example, if the application only needs to read data from a specific table, it should not have permission to drop tables or access other databases.