{"id":392,"date":"2022-08-29T19:27:49","date_gmt":"2022-08-29T19:27:49","guid":{"rendered":"https:\/\/codecrypt76.com\/?p=392"},"modified":"2022-11-25T16:52:45","modified_gmt":"2022-11-25T16:52:45","slug":"sql-injection-attack-hacker-challenge","status":"publish","type":"post","link":"https:\/\/codecrypt76.com\/index.php\/2022\/08\/29\/sql-injection-attack-hacker-challenge\/","title":{"rendered":"SQL Injection Attack – Hacker Challenge"},"content":{"rendered":"\n
\"SQL<\/figure><\/div>\n\n\n\n

Overview<\/h2>\n\n\n\n

A SQL injection<\/a> (SQLi<\/code>) is a type of cybersecurity attack that targets data-driven applications by inserting or “injecting<\/em>” malicious SQL<\/code> statements in the input field of a web page. Structured Query Language<\/strong> (SQL) is is a standardized programming language<\/em> that is used to communicate with databases. A successful SQLi<\/code> can allow an attacker to read <\/code>sensitive data from the database, modify <\/code>database data (Insert\/Update\/Delete), execute <\/code>administration operations on the database, or even gain root access to the system itself. The SQLi Hacker Challenge<\/strong> is an chance for you to conduct a SQLi attack <\/strong>on a mock database that was designed for this challenge. If successful, you’ll have an opportunity to answer some fun Bonus Questions<\/a>. <\/p>\n\n\n\n

Before we begin, let’s go over an example of SQLi<\/code> attack.<\/p>\n\n\n\n

SQL Injection example <\/h2>\n\n\n\n

Look at the following example which creates a SELECT<\/code> statement by adding a variable (user_id<\/code>) to the end of it. The variable is fetched from the input()<\/code> function. <\/p>\n\n\n\n

user_id = input("User ID: ")\nSQL_statement = f"SELECT * FROM Users WHERE user_id = {user_id};"<\/code><\/pre><\/div>\n\n\n\n
The purpose of the code is to create a SQL <\/code>statement to select a user, with a given user_id<\/code>. If there are no security measures in place then a user can enter erroneous data into the input field such as:<\/p>\n\n\n\n
User Id: 76 OR 1=1<\/code><\/pre><\/div>\n\n\n\n
This would create the following SQL statement:<\/p>\n\n\n\n
SELECT * FROM Users WHERE user_id = 76 OR 1=1;<\/code><\/pre><\/div>\n\n\n\n
The above SQL statement is valid and will return ALL <\/code>rows from the “Users” table, since OR 1=1<\/strong> is always TRUE.  If the “Users” table contains usernames <\/code>and passwords<\/code> then a hacker would get access to all the usernames and passwords in a database, by simply inserting OR 1=1<\/strong> into the input field.<\/p>\n\n\n\n
Now that you have a basic understanding of how a SQLi <\/code>works, lets try the SQLi Hacker Challenge.<\/strong><\/p>\n\n\n\n
SQL Injection Lab<\/h2>\n\n\n\n
Task<\/h3>\n\n\n\n
Your task is to execute a successful SQLi <\/code>attack on a mock database that was designed for this challenge, and to view all contents in.  <\/p>\n\n\n\n
Database design<\/h3>\n\n\n\n
The database consists of one table<\/code>, and the following three columns<\/code>:<\/p>\n\n\n\n