Welcome to the third and last part of injection floor
session.
In this last part, we will discuss injection flood
mitigation. We will start discussing what makes
an application vulnerable. Since I last Juice Shop is
open source. We will spot the vulnerable source code then
we will discuss how to avoid such vulnerabilities. Okay,
first big mistake dress shop asks
for an email address, but no validation was performed Upon
Our payload, a validation such. This one would
have a board to the backend execution before merging submitted
data with SQL query, template.
Sometimes required data doesn't have a well defined pattern as
an email address. And so validation, Don't Come Easy in
such cases. The characters range should be limited
and Dangerous Ones removed from the input or
the input rejected.
Client provided data is directly concatenated. To SQL query template
in invite the backend server, remind
that the backend server is written in a programming language
other than sequel. So it knows nothing about how
to handle SQL queries. The back end is just doing arbitrary strings
concatenation. Some characters have
special, meaning to specific tools or contexts in
our SQL query. The single quote character
is used to wrap strings. Like the email address when
external data is appended to the Sea.
Booker template inside single quotes and
that data contains one or more single quote characters, then
the resulting query will be different from what the
template was written for to avoid this, the
single quote character and external data has to be scaped. So
that it is read as is with no special.
Meaning escaping is not an easy task
to be done. Externally to the Target to lure context to
do it. You will need to know all special characters beforehand
and you'll certainly miss one.
One or a few of them. Let's see. What makes
Juice Shop vulnerable.
This is the last Juice Shop project page,
and we're going to jump from here to the project
rep. Oh.
The project Red Bull has all the source code, but
now we are looking for a specific folder
which should have all application
routes.
Inside this folder, we should find login dot, GS file,
which should have all the login features.
We have a first login function and
then a dinner after login
function, but this one doesn't look.
So have any SQL query template.
In the next one, we can see some select from
the users table and then
the email and password both are
matched against user input data. So this
is a good candidate. Let's copy and paste
it to our text editor and make it readable.
This is how the query template looks like before
interpolation. We're going to replace the
variables with the admin Account Details
and see how the final query looks like.
So this is what gets sent to the database and
executed on a legit. Login request. Let's
do the same with our payload.
Since what's, after the semicolon is ignored, by
the database server. This is the statement that gets executed.
When we're dealing with SQL, prepared statements
are dead safety zone. Instead of concatenating a
sequel template with user input data in the back, end server.
Without the right context. You will. First provide the
sequel, interpreter? The query template, with some placeholders, where
you expect user input data to be replaced on
a second step. You will provide input data
to replace the placeholders, but this operation
will be done by the sequel interpreter, which
knows it's one context better than anything or
Anyone else?
Always validate external data when it does
not meet your expectations or requirements rejected, make
sure that provided data only has allowed characters
white lists tend to be safer
than blacklists, you know better what you want. Then
what you don't as said before, escaping
is not an easy task. If there's no safe
API available, look for well-documented and
maintain scaping libraries specific to
your target interpreter when dealing with
Queries always limit the number of Records to return to
mitigate the huge data leaks in case you get compromised. In
our next session. We will discuss broken authentication, flaws
until then take your time to carefully,
read the injection section of our ask top 10.