Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've recently taken an interest in SQL injections - it (for some reason, correct me if I'm wrong) seemed like a good place to start (I am pretty much a beginner). Anyways, I want to make a site that I can practice on. In other words, basically maybe one content page, a login page, and a database with say admin, users, passes, so on and so forth.

I will have to learn SQL, but that will take me half an hour, I've already skimmed over a few sites. I will probably need HTML, and some basic PHP...?

My question: am I missing anything? And what exactly defines vulnerable SQL code? Sorry, I being a bit broad here. The closest I found is this: http://forum.codecall.net/topic/39264-make-a-script-vulnerable-to-sql-injection/

On a side note, is SQLi a good place to start with web vulnerabilities?

Thanks in advance!

EDIT: thanks for all the wonderful answers!

share|improve this question
3  
Also, you can follow the tutorial at w3schools on how to make (vulnerable) web pages with mysql and php: w3schools.com/php/php_mysql_insert.asp –  Carlos Campderrós May 22 '13 at 7:37
    
@Carlos: thanks! That's kind of what I needed! –  Jacob Kudria May 23 '13 at 0:29

5 Answers 5

up vote 11 down vote accepted

Don't bother writing your own site for a practice like that. Instead, make use of the plentiful resources on the web.

A good practice target is the Damn Vulnerable Web Application(DVWA) project. The OWASP WebGoat project is another nice one.

share|improve this answer
    
I see. Thanks! I might still make that site, just for fun. I don't know, we'll see. And learning PHP, HTML, JS etc would be useful anyways. –  Jacob Kudria May 21 '13 at 15:35
2  
If you want to make a site for fun, I highly recommend using pre-existing vulnerable sites for attacks, then code up a site that you can't use SQL injection on so you practice good methods in what you learn. –  fire.eagle May 21 '13 at 20:12
    
Google also has a site for this: google-gruyere.appspot.com –  user1615903 May 22 '13 at 5:21

A few notes

An SQL injection attack is when something unexpected is inserted into a database. The types of injections depend on the vulnerabilities of the system.

SQL Query Injection

If the database doesn't have proper permissions, meaning that the web user has full control over the database, then they can potentially do things like replace all records, drop tables, and add their own tables.

An example might be an injection on an edit where site is expecting the user to edit their own record, but instead they update all in the server.

\' or where 1=1;

If they have read-only access to the database they might escalate their privileges and pull out more info than they're supposed to. This example would be on a server that is returning two records, the user then adds the user's table as their result.

\' UNION ALL SELECT username,password from USERS;

PHP injection

Many of the features of the latest versions of PHP have been hardened to fix issues with code execution however some developers use things like exec() to perform actions on code pulled from a database. Some older versions of PHP are still vulnerable to attack.

Developers are the front line for defense when it comes to writing a website. Let's say you have a corporate CMS and the developers created a user-editable table in the CMS for modifying something like display ads.

The attacker could enter phpinfo(); and see all of the database about the server, or execute command line codes (depending on the access of the website user account on the web server), or add their own backdoor to the site (write or rewrite files). This could allow the user to redirect all traffic off of the site entirely.

Script injection

While the site's PHP may be less vulnerable to an attack, a user may still inject things such as iframes containing malicious code, javascripts containing malicious code, or JAVA applets that allow them to steal user cookies. Since javascript can execute AJAX and send requests to a different webserver unannounced this would likely not be seen in the interface even though it could happen.

<script type='text/javascript'> 
  window.location('http://someotherwebsite.com');
</script>

Testing

The legal ramifications for testing on someone else's box are different depending on the country you're in and the country the server is being hosted in. With that being said, there are a lot of free versions of operating systems like FreeBSD and various types of Linux (some more secure than others) where you can install an OS, a web server, and a MySQL server on a Virtual Machine under something like Virtual Box and go to town without hosing your production machine.

Some of the other answers given by other posters are excellent in this thread as well.

share|improve this answer
    
Great explanation, thanks a lot! –  Jacob Kudria May 21 '13 at 20:05

To add to Terry Chia's resources, there's an SQL injection tutorial from PentesterLab which does pretty much what you're after, called From SQLi to Shell. I did it yesterday, it's very good. They offer a couple more advanced walk-throughs too.

share|improve this answer

Any form that takes input and uses it directly in a SQL query without checking to make sure the input is safe would be vulnerable to SQL injection. Being vulnerable to SQL injection is more or less the standard state of being unless you specifically take measures to protect against it in your code.

share|improve this answer
    
I see. What do you mean by checking to make sure that the input is safe? What exactly defines safe input? –  Jacob Kudria May 21 '13 at 16:00
    
@JacobKudria - In order to prevent SQL Injection, you have to sanitize input to make sure that it isn't an unexpected value. This varies based on the data. If it's a number, you make sure it's only numbers. Regardless you want to make sure that it can't contain any SQL keywords in a way they could be used and preferably want to use parametrized SQL so that even if SQL keywords were present, they wouldn't be executed. There are many ways that you can validate form input and no one solution is perfect in all cases. –  AJ Henderson May 21 '13 at 16:24
1  
@JacobKudria language agnostic example: querystring = "Select * FROM SomeTable WHERE SomeField = " + rawuserinput; Then just use Bobby Table's full name as the userinput. xkcd.com/327 –  Dan Neely May 21 '13 at 19:48

If you like to get into webvulnerabilities, i recommend you to learn some basics about PHP, HMTL, Javascript and SQL.

If you have done this: Getting started with OWASP

share|improve this answer
    
Hmmm, why JS? I'll look into those... –  Jacob Kudria May 21 '13 at 15:34
1  
@JacobKudria For XSS –  g3k May 21 '13 at 19:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.