What should (or) how an Incident Handler do (or) follow when an SQL injection attack is reported?
- Initial Response
Aiming to make a procedure guide to follow for myself and my team. Brief or detail, anything would help.
1) Initial Response can be taking the particular module/section of page offline or patch it on IPS or WAF. After that you should check the same yourself first with any web-proxy like Burpsuite or ZAP, if the reported vulnerability is false-positive or a real threat. You can also use a tool called SQLMAP to reduce the effort in verification.
2) For analysis part you can see, what sort of data you are able to get using that attack vector. Also you can see what roles are assigned to the web user and what privileges are granted. Depending upon the exposure and impact of vulnerability, you can decide the action.
3) For resolution, You can put server-side validation on the input vector. Also you can change the SQL statement in actual code to Parameterized SQL Query. A detailed procedure for mitigation can be found here. https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet
PS: To prevent this from happening you should consider source code analysis at the time of development and after build is complete a dynamic application testing or Penetration Test. This will reduce the surprises in real-time.