Could some one please explain - Remote Post SQL Injection

Question

Would anyone be able to post a link to an article which explains how to do a Remote Post SQL Injection and how to prevent anything bad happening. Or even just explain on here.

Any help would be great.

Answer 1

Remote SQL injection is usually a product of poor programming and bad database configuration.

1. Unescaped characters.
2. No input validations.
3. Setting a vague limit in the number of character field.

You check for the metasploit framework and you can learn lots of things from there:

http://www.offensive-security.com/metasploit-unleashed/SQL_Pwnage

Try to read also this post. It should give you a good overview.

http://shiflett.org/articles/sql-injection

Answer 2

I'd also recommend checking out DVWA (Damn Vulnerable Web App), I find practicing things helps you understand better. There's loads with the Security Stack Exchange forums on how to learn about security vulnerabilities and exploits so I won't repeat myself here, simply do a search "DVWA site:security.stackexchange.com".

Here's some links to videos on SQLi in DVWA - http://www.hackyeah.com/2010/05/hack-yeah-sql-injection-walkthrough-dvwa/ and http://securitytube-tools.net/index.php?title=DVWA.

There's a couple of cheatsheets that you should read -

1. Rsnake's - sadly he no longer blogs but his stuff is excellent
2. OWASP - they also have their Webgoat app, which you should look into.

I'd strongly encourage you to practice (in a safe, legal environment...e.g. your own lab) what the above links talk about as it'll help you understand quicker.

Answer 3

Do you mean POST as HTTP Method?

You may use sqlmap as testing tool to validate whether your application has SQL injection vulnerabilities or not.

First, find the dynamic part of your application. Enter the dynamic URL as part of sqlmap option.

Second, find the form part of your application which takes user input. Add --forms to your sqlmap option.