-8

Is there a way to perform an SQL injection using only Scala syntax (not importing any Java)? From what I've seen online all the examples (like this) were based on importing Java things and then using it for the injection.

  • 2
    SQLi requires no Java. It doesn't require any importing anything. I'm not sure what examples you mean - can you provide some links. – Rory Alsop Apr 28 '16 at 13:37
  • I wanted to find an example for SQLi in Scala. just like this one in Java- javacodegeeks.com/2012/11/… – boaz May 1 '16 at 6:07
  • 2
    This seems to be more of a programming question than a security question. When you perform an SQL injection, you use SQL queries, not some programming language. In the example you linked, ' or '1'='1 is the injection, the Java code is just the vulnerable code. Writing vulnerable code in Scala should be easy. Just put user input directly in a query, and it's vulnerable. – tim May 4 '16 at 13:11
  • SQL injection requires injecting SQL, not Scala. I'm not sure how one would use Scala (or Java) syntax in this case, unless you mean something different then what you asked. They way you have asked it currently, it's like asking, "How do I speak French when I'm speaking German?" The answer is: you speak French. – schroeder May 4 '16 at 14:45
0
+50

Slick

Scala code is vulnerable to SQLi when you use Slick with #$ to directly insert your literal into the SQL:

NOT SAFE

 def slickInterpolationInsert(firstName: String, lastName: String, email: String, password: String) = db.withSession {
  implicit session: Session =>
    sqlu"insert into users (first_name, last_name, email, password) values (#$firstName, #$lastName, #$email, #$password)".execute
  }

The safe way would be:

SAFE

 def slickInterpolationInsert(firstName: String, lastName: String, email: String, password: String) = db.withSession {
  implicit session: Session =>
    sqlu"insert into users (first_name, last_name, email, password) values ($firstName, $lastName, $email, $password)".execute
  }

StaticQuery

Another unsafe way would be by using the StaticQuery class:

NOT SAFE

def slickStaticQuery(email: String) = db.withSession { implicit session: Session =>
    (StaticQuery.u + "update users set first_name = 'buddy' where email = '" + email + "'").execute
  }

The safe way would be:

SAFE

def slickStaticQueryBindVariables(email: String) = db.withSession { implicit session: Session =>
    val query = StaticQuery[String, String] + "select email from users where email = ? "
    query(email)
  }

Answers taken from: https://nvisium.com/blog/2015/01/28/scala-flavored-assortment-of-play_28/

2

I think you are confusing two things:

  1. The code vulnerable to an SQL injection attack.
  2. The thing executing an SQL injection attack.

The example page you link to has Java code of type #1, and uses the program SQLMap (written in Python) for type #2. You seem to be asking aboug type #2, but lets go through them one by one.

#1 - The code vulnerable to the SQL injection attack

The code in #1 could be written in any language - for a broad range of examples (but not Scala) see this site. If you for some reason want to write vulnerable code in Scala, this could be done (even though I fail to se a reason to why you would want to).

First you need to connect to a database. I am no Scala programmer, but my understanding is that this is usually done with JDBC and importing some Java libraries, so this will break you "not importing any Java" rule. This page gives you a good walk through.

Then you need to introduce a vulnerability. This is done (usually unintentionally) by concatenating untrusted data (that is data from the user, such as the values entered into a HTML form) into an SQL expression. Lets look at a case of a login script where the untrusted data is username and password:

//Warning! This is code deliberately made vulnerable to SQL injection.
val sql = "SELECT * FROM users WHERE username = '" + username + 
  "' AND password = '" + password + "'"
val resultSet = statement.executeQuery(sql)

This is where the actual injection can take place - consider what would happend if the variable password had the value ' OR '1' = '1.

#2 - The thing executing the SQL injection attack

Number #2 is (usually) something sending crafted HTTP requests with the attack vector (such as ' OR '1' = '1) in them. You could write a program doing that in any language, but you could just as well use an existing program that sends HTTP requests. The most common such program is - surprise - a web browser. The simplest way to test for obvious SQLi vulnerabilities is to simply enter the attack vector into a form (that is type ' OR '1' = '1 into the password field), hit enter, and see what happends.

If you want to automate this, you could write a program in Scala. I will not provide you with any code for this, but this question on Stack Overflow should help you get up and running with sending HTTP requests with Scala.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.