Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have logged into SQL Server 2008 Database and executed following query:

select * from USER_Main_INFO_Name where userid ='' or 'x'='x'

After executing the query Database has given total user list.

Using Burp Tool I have done SQL Injection at front end my application has given proper error result.

Is my application strong? How to avoid SQL Injecting at Backend?

share|improve this question
    
This is not an issue. If you want to prevent people from querying your database, then you should be restricting access. Removing SELECT statements will break almost all applications. –  David Houde Dec 26 '13 at 10:20
    
Can you expand on what you mean by the following: Using Burp Tool I have done SQL Injection at front end my application has given proper error result. –  Abe Miessler Dec 26 '13 at 16:41
    
Dear Abe Miessler,I have set proxy setting in browser then ON Intercept option in Burp tool ,then given valid user name and password then click login button.After clicking login button i have changed user name like "asd123'or '1'='1" then forward request to server from Burp Tool.Now server given result as "Application has generated an error Please contact to administrator" –  user35819 Dec 27 '13 at 8:59
add comment

2 Answers

This implies that at some point you are constructing SQL statements by string concatenation involving untrusted strings. Don't do that! Use prepared statements instead (or some other form of query parameterization), as they are pretty much intrinsically immune to SQLi.

I'm assuming you mean your frontend successfully blocks all the SQLi you tried. This doesn't mean it will block all SQLi, of course; that depends on how thorough your testing is.

However, once the query reaches your backend (assuming that's your DBMS), there really isn't any way to tell what SQL comes from SQLi and what SQL is legitimate. You really have to trust that what's coming in on the database connection is trustworthy.

Of course, it is wise to limit the impact of such attacks as much as possible. Most simply, and commonly, you can limit the permissions of the application's service account on the database to only those actions it actually performs. This doesn't prevent SQLi per se, but it will lessen the impact if any exists.

Another possible approach is to abstract some of the SQL away in a data access layer the frontend talks to, and avoid passing any strings to the DBMS that didn't come from the application itself (and certain trusted columns in certain tables). It's much easier to just use prepared statements.

share|improve this answer
    
IMO using the terminology "prepared statements" adds unnecessary confusion - as that typically refers to a specific feature - but : to get safety, it isn't so much "prepared" that is important - it is "parameterized". Ad-hoc, not formally "prepared", but parameterized sql is perfectly safe. –  Marc Gravell Dec 26 '13 at 17:54
    
Yeah, parametrized statements in general work well. Of course, if you use an API layer to do it, you have to be sure it is actually parametrizing them when it sends them. –  Falcon Momot Dec 26 '13 at 19:27
add comment

The best way to prevention SQL injections at frontend is to use prepared statements. If you want to restrict users from accessing the data base itself you can use the account management tools like CREATE USER, GRANT INSERT ..., REVOKE ... which are shipped along the DBMS itself. If this doesn't satisfy your desired level of security, you can start using database firewals. A further approch to deny users from accessing your database is to introduce a data access baseline. A baseline means that you create an access protocol which contains all access points that are allowd to get access to the target db. A simple example would be:

DB-USER | IP-Address   | Source Program
----------------------------------------
admin   | 5.200.200.20 | OraDriver.exe
herby   | 192.186.2.10 | DbUtil.exe

In case that an incomming request deviates from the base line, a specific action gets executed like, notify an administrator (behavior like an intrusion detection system), blocking the request, etc.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.