3

I have custom authentication system on my ASP.NET website that can help me to register users from my Windows (Desktop) and mobile (Android) Applications.It means that I don't use ASP.NET Configuration.


I have this code when the user press the login button.

    SqlConnection con = new SqlConnection();
    con.ConnectionString = ConfigurationManager.ConnectionStrings["ConnectionString"].ConnectionString;
    SqlCommand com = new SqlCommand();
    con.Open();
    com.Connection = con;
    com.CommandText = "SELECT * FROM [Users-Users] WHERE (Password=@Password) AND (Username=@Username) ";
    com.Parameters.AddWithValue("Password", System.Web.HttpUtility.HtmlEncode(PasswordTextBox.Text));
    com.Parameters.AddWithValue("Username", System.Web.HttpUtility.HtmlEncode(UsernameTextBox.Text));
    SqlDataReader data = com.ExecuteReader();
    if (data.Read())
    {
        //Logged in successfully here I have redirect options
    }

You can see that I have HTML encoding here that can do these:

    &  → & (ampersand, U+0026)
    &lt;   → < (less-than sign, U+003C)
    &gt;   → > (greater-than sign, U+003E)
    &quot; → " (quotation mark, U+0022)
    &apos; → ' (apostrophe, U+0027)

So can we login without password using Sql Injection? e.g→

username textbox :admin
password textbox :pass" OR 1=1
2
  • 4
    Why not try it? Aug 6, 2013 at 10:47
  • I cant login with admin as username and pass" OR 1=1 as password. But isn't any way to use Sql Injection here. I had some hack problems in last week that I know that its because of Sql Injection.
    – user29154
    Aug 6, 2013 at 15:40

2 Answers 2

4

You are using parameterised queries consistently for all variable values, so there is no SQL injection attack.

However, storing database values in HTML-encoded format is an antipattern. You'll make it difficult to process the data at an SQL level (since 1 db character no longer equals one on-page character), you'll produce inappropriately-encoded output for non-HTML formats (eg sending mail), and you'll fail to properly HTML-encode any data that comes into the database by other means (or which doesn't touch the database at all, eg a Parameter output straight onto the page).

The time to HTML-encode is when you are dropping some text into an HTML page. In ASP.NET templates you get the <%: ... %> tag to do this automatically, as well as attributes of WebForms doing the right thing (caution: not always). HTML-encoding should not be done as an input-processing or database-query-creation step because those places aren't anything to do with HTML.

Also you should of course be storing passwords using a salted hash (ideally a strong one like bcrypt) and not in the clear as implied by the Password=@Password comparison.

2

When accessing a content provider, use parameterized query methods such as query(), update(), and delete() to avoid potential SQL injection from untrusted sources. Note that using parameterized methods is not sufficient if the selection argument is built by concatenating user data prior to submitting it to the method. (Android Security Tips)

To prevent SQL injection:

All queries should be parametrized.
All dynamic data should be explicitly bound to parametrized queries.
String concatenation should never be used to create dynamic SQL. 

by using parametrized statements the database is able to distinguish between what is meant to be data and what is meant to be a command, so even if an attacker inserts a malicious input this input will be treated as data and not interpreted as a command.

1
  • My problem is from my website not from my Android or Windows applications. I Told that to let you know that I didn't use ASP.NET default authentication system (ASP.NET Configuration). I know that my website hacked because of its Sql Injection problems. Here I have another question: Which Sql Injections works on this login system?
    – user29154
    Aug 6, 2013 at 15:47

You must log in to answer this question.