1

I am studying about cyber defense lately for fun and found about a proposed method that as I understand it performs automated SQL injection using brute force by training a model. At some point it says that if it receives input: "SELECT * FRO" it will find that the next letter is "M" and then if it receives HTTP Status 200 is good and if HTTP Status 500 is bad and will train the algorithm accordingly.

Since the query "SELECT * FROM" is not complete how it will receive HTTP Status 200? and also how this attack in general can be mitigated?

You can find the source here: https://cesena.github.io/2018/02/27/weaponizing-machine-learning/#Other-resources

As an approach appears very interesting and would like to read an explanation from specialists.

Improve this question

2 Answers 2

Reset to default
1

This is less a question about SQL Injection itself, and more about this particular ML based implementation.

I had to look at the code to understand better what the author tried to say with this example. To the best of my understanding, this is actually a very poor example, let's remember this is a tool supposed to execute SQLi attacks, not to just run queries. In this example it seems like it is just trying to learn how to interact with a SQL server, what it's not really it's purpose, a much better(and realistic) example would be something along the lines of:

Input: SELECT * FROM example_table WHERE id == {ACTUAL USER INPUT}
Output: 1 // 200
Output: m // 500
…
Output: 1 OR 1==1 // 200

The "Input" field is actually the server-side query, and the Output would be the parameter the tool would give to the website.

Again, this is based on what I got from his article and code, to really understand what is happening I recommend you read the full code in the repository and try to run it yourself.

As I mentioned in my comment, there's nothing special about this attack defense-wise, it is just an attempt at a better way to explore SQL injection vulnerabilities, the vuln itself is still the same, meaning that to mitigate it you would just need to sanitize user input before inserting it in your SQL query.

You said you are studying the subject for fun, so in case you are not too familiar with SQLi attacks this and this page should help you get a better grasp at what causes it, and how to fix it.

Improve this answer
5
  • Thanks for the effort. I agree that understanding the method requires messing with the code itself. I mostly need explanation about the HTTP status 200 & 500 ( I did not get the example you wrote) and also based on what you read how this attack could be mitigated?
    – l_phenom
    Commented Dec 31, 2020 at 12:25
  • @l_phenom Oh, sorry, I forgot about the mitigation aspect of your question, I will edit my response accordingly. Briefly, there's no mitigation specifically for this attack, it is still the good ol' SQLi we all know and love, it's just an implementation that is supposed to be faster, meaning the fix would still be to always sanitize user input before using it anywhere in your code.
    – Iorpim
    Commented Dec 31, 2020 at 12:35
  • @l_phenom I edited my answer, I hope it better fits your question now. About the HTTP status 200/500 I couldn't really think of another way to put in the context of the text, but I can try to clarify it in here in the comments. The HTTP status simply represent a successful or failed query, where the query would be something like SELECT a FROM b WHERE c == {Request["id"]}, with Request["id"], being id the parameter you fed to this particular system via the HTTP request, this parameter would also be the output of your machine learning model.
    – Iorpim
    Commented Dec 31, 2020 at 13:08
  • Thanks for editing, I accepted your answer. One thing about the HTTP thingy: does an incomplete query like " SELECT * FROM" gives HTTP STATUS 200 and a totally wrong query like "SELECT * FROS" gives HTTP STATUS 500?
    – l_phenom
    Commented Dec 31, 2020 at 13:48
  • @l_phenom It really depends on the web app consuming this query, but as you pointed out, they are both invalid queries, one of them is "more wrong" as it contains an invalid keyword("FROS" instead of "FROM"), however regardless of which one has more problems, both should still return 500. The only way it would return 200 in this case would be if the server completed the query.
    – Iorpim
    Commented Dec 31, 2020 at 13:55
0

Here's a code that shouldn't throw an error no matter what the database contains :

SELECT 'foo' AS bar

If it return something like :

bar
foo

it means that the website/app is probably "SQL injectable"

Improve this answer
1
  • well, no, that won't work on Oracle, and I don't think it answers the question either.
    – Jasen
    Commented Jan 2, 2021 at 6:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .