Should I Be Afraid of SQL Injection?

Published in

Mlytics

9 min readMay 14, 2024

Hi there! 🙌

Today, we are diving into the world of web security, specifically looking at something called SQL Injection, or SQLi for short. It sounds a bit technical, but don’t worry — I’ll break it down into simple pieces so it’s super easy to understand. Whether you are running your own website or just curious about how these attacks work, this article has got you covered!

What is SQL Injection?

Think of SQL Injection (SQLi)as a sneaky trick that lets attackers mess with databases through websites. When a website asks you for information — like your name or password — it usually checks this info against its database. SQL Injection exploits this process by sneaking in malicious commands, tricking the website into doing things it shouldn’t, like spilling secrets.

Imagine you have a lock that checks if your key has the right code to open. SQLi is like someone figuring out how to use a fake key to not only open the lock but also change the lock’s code!

Why Should We Care?

SQLi is more than just a technical fault; it’s a doorway through which attackers can undermine the very foundations of our digital safety. Every year, businesses, from small startups to major corporations, lose millions of dollars and valuable data due to these attacks. The danger is not just in the potential financial loss but also in the breach of customer trust—something that is incredibly hard to regain.

Do you know?

SQL injection remains a top threat in cybersecurity, accounting for 42% of hacker attempts on public-facing systems. This highlights the widespread nature and the potential severity of these attacks.
The largest known SQLi attack in history involved the theft of over 1 billion user IDs and passwords, illustrating the massive scale at which these vulnerabilities can be exploited. Moreover, more than two million email addresses and other personal information were stolen from at least 65 websites between November and December 2023, underscoring the ongoing threat.
The SQLi attacks can lead to significant financial and operational disruptions. For instance, in 2009, attackers stole 130 million card details using an SQLi attack, marking it as the biggest case of identity theft in US history.
Despite increased awareness, 21% of organizations remain vulnerable to SQLi attacks, highlighting a persistent gap in security practices that needs to be addressed.

How to Do SQL Injection?

Let’s say a website checks your username and password with this command:

SELECT * FROM users WHERE username = ‘your_name’ AND password = ‘your_password’;

An attacker might use a special username like this: admin' -- and any password. Here’s what happens:

username: admin’ — 
password: anything really!

The -- part tells the database to ignore everything after 'admin', so the website thinks you’re the admin since it only checks the username 'admin' and ignores the password part. Sneaky, right?

Real-Case Example: Exploring SQL Injection

Education Warning ⚠️

Before we jump into the technical deep end, a quick but important note:

The following section is for educational purposes only. The website we are about to explore is intentionally vulnerable and is set up in a test environment. Hacking into websites, even if just poking around, can be illegal and unethical if you don’t have explicit permission. So, please, don’t break the law with trying this on any real-world or live domain wihout proper authorization.

Alright, let’s get to it!

In this technical example, we are using web-dvwa. The web-dvwa is actually a cool tool for those who want to learn about web security. It stands for “Damn Vulnerable Web Application” and, true to its name, it’s packed with security holes on purpose, which makes it perfect for testing and educational scenarios. It’s a PHP/MySQL web application that’s very easy to install and use.

Running it is a breeze, especially if you are familiar with Docker. Docker allows you to set up isolated environments called containers. With a single command, you can have DVWA up and ready:

#pull the the DVWA images
docker pull vulnerables/web-dvwa

#run the images
docker run - rm -it -p 80:80 vulnerables/web-dvwa

The commands above will run the DVWA web service, and you should able to access it from `http://localhost`

To begin your adventure, log in using the standard admin credentials provided:

Username: admin
Password: password

Please check the official DVWA documentation for more details instructions.

Performing an SQL Injection Attack

Now for the main event! In DVWA, navigate to the SQL Injection section, where we test our SQLi chops. Enter the following command:

%' and 1=0 union select null, concat(user,':',password) from users #

This string is like telling the database, “Hey, ignore what you were going to do. Instead, give me a list of all usernames and their passwords.” And guess what? It obliges.

When you run the command, you’ll see a bunch of random-looking strings instead of plain text passwords. That’s because these passwords are ‘hashed’, a way to secure them so they’re not easily readable. But here’s the kicker: Just because it’s hashed doesn’t mean it’s safe from hackers. With enough time and some nifty tools, an attacker can ‘dehash’ or ‘crack’ these passwords back into plain text.

This is why web security is such a big deal. Even if your passwords are hashed, SQL Injection can still leave you vulnerable, turning what should be indecipherable text into something as clear as day.

What can an attacker do with SQL Injection?

Once an attacker uses SQL Injection to sneak into your website, they can do a lot of harm, such as:

Stealing Private Data: They can look at every user’s data, including private information like passwords, credit card numbers, or social security numbers.
Changing Information: They can change or delete information, which could ruin your database or alter membership details, leading to unauthorized access.
Spoof Identity: By logging in as another user, attackers can impersonate them and perform actions on their behalf.
Destroy Data: In worst-case scenarios, attackers can even delete entire tables from databases, causing irreversible loss of data.

How do you prevent SQL Injection as a web admin or owner?

Now, how do we stop these tricks? Here are some easy tips:

Use Prepared Statements: Think of these as fixed gates that only let through the right kind of information. They keep the SQL commands safe and sound, not letting attackers mix in harmful stuff.
Validate Inputs: Always double-check what users input into your site. If you expect a username, make sure it really looks like a username and not sneaky code.
Web Application Firewall (WAFs): This is like a counter for your website. It stops harmful data before it even reaches your site. For instance, Mlytics offers WAF services called Origin Shield that automatically protect your site from these SQLi tricks by blocking bad data.

Protection Made Easy with WAF: Mlytics Origin Shield to the Rescue

As we’ve delved into the murky waters of SQL Injection, it might seem a bit daunting to think about all the potential security measures you’ll need to implement. But fear not! The solution to bolster your defenses might just be a few clicks away, thanks to Web Application Firewalls (WAF) like Mlytics Origin Shield. Let’s explore how it can be a game-changer for your website’s security.

Mlytics Origin Shield isn’t just your average WAF. It’s like having a virtual security guard that’s been trained by the best to recognize the sneakiest of SQL injections — those notorious for making the OWASP top 10 most dangerous web vulnerabilities list. This shield comes pre-equipped with rules designed to block these attacks, making your life a whole lot easier.

Setting Up Protection Is a Breeze

Here’s the truly great part: activating Mlytics Origin Shield is as easy as flicking a switch. By enabling the rule in the Origin Shield settings, you’re essentially putting up an invisible barrier that says “Not today!” to any SQL injection attempts. It’s protection that doesn’t require you to dive into your website’s code or consult a cybersecurity expert.

Once you toggle on that rule, any malicious SQLi commands aimed at your site will meet an unyielding door instead of wreaking havoc. It’s proactive security, working silently, effectively, and immediately to ensure your peace of mind.

But talk is cheap without proof, right? Let’s put Mlytics Origin Shield to the test on our trusty (but intentionally insecure) DVWA. After activating the shield, we throw the same SQL injection attack at it that previously revealed all our users and passwords.

The Access Denied Page is shown after enabling the Origin Shield

And what’s the result? A blocked page. Access denied. The attackers’ efforts are futile, and your data remains safely out of reach. It’s that simple. With Mlytics Origin Shield, what was once a vulnerable doorway is now an impenetrable wall.

This saying couldn’t be more accurate when it comes to web security. With Mlytics Origin Shield, we’re not just patching a hole, we’re reinforcing the whole dam. SQL Injection, one of the oldest and most dangerous tricks in a hacker’s playbook, becomes a non-issue. And the best part? You don’t have to scramble to change a single line of your website’s code.

So there you have it — a powerful, straightforward solution to a complex problem. It’s time to let WAF do the heavy lifting, and Mlytics Origin Shield does it with grace and efficiency. Let’s keep our websites safe and our data even safer! 🛡️✨

How Can Users Identify If a Website Has SQL Injection Vulnerabilities?

For everyday folks, here are a couple of signs that a website might be easy to hack with SQL Injection:

Weird Errors: if you see an error message that mentions ‘SQL’ or ‘database’ when you enter your info, that’s a red flag!
Strange Behavior: If typing normal things into forms causes weird errors or unexpected behaviors, the website might not be handling data safely.
Loof for Certs: Website that are secure often brag about it! Loog for security badges mentions data protection on the site.

Conclusion

SQL Injection can be a real headache for website owners, but with some basic steps, it’s totally manageable. In this article, we’ve just seen how SQL Injection works and why it’s something to be understood and guarded against. We also have discussed how to handle this web vulnerability.

Just remember to keep your website’s data checking strict, use tools to help block attacks, and always stay alert!

What’s Next?

Secure Your Browsing and Keep Learning!

Don’t let this info just sit here — use it! Ensure the site you are visiting is safe, and always stay cautious as you surf the internet. Keep learning and stay secure.

If you are a website owner and looking for a better way to secure your web application, consider booking a demo with Mlytis. Consult with our experts to explore tailored security solutions that meet your needs.

And hey, always feel free to ask more questions if you are unsure about something!

References

[1] Citakovic, S. (2023). 10 SQL Injection Attacks Statistics To Know in 2023. Security Escape. Retrieved from https://securityescape.com/sql-injection-attacks-statistics/

[2] Arghire, I. (2024). Millions of User Records Stolen From 65 Websites via SQL Injection Attacks. SecurityWeek. Retrieved from https://www.securityweek.com/millions-of-user-records-stolen-from-65-websites-via-sql-injection-attacks/

[3] mlytics. (n.d.). CRS and OWASP Top 10 Vulnerabilities. Retrieved from https://help.mlytics.com/en/knowledge/crs-and-owasp-top-10-vulnerabilities