SQL INJECTION ATTACKS.pptx

SQL INJECTION ATTACKS.pptx

• 1.
  LOYOLA – ICAM COLLEGEOF ENGINEERING AND TECHNOLOGY (LICET) Loyola College Campus, Nungambakkam , Chennai – 34 AVOIDING VULNERABILITY IN DATAADMITTANCE OF WEB APPLICATIONS BASED ON ENCRYPTION TECHNIQUES Done by Guide L.DIVYA [32810104013] Mr L REMEGIUS PRAVEEN SAHAYARAJ V.PAVITHRA [32810104042] P.SHANTHI PRIYA [32810104054] Area Of Reasearch: Database Security
• 2.
  INTRODUCTION • Area OfResearch: Database Security • A less secure Web application design may allow crafted injection and malicious update on the backend database. This trend can cause lots of damages and thefts of trusted users sensitive data by unauthorized users • Motivation of this Research 1. Encryption & hashing will provide more security in database. 2. SQL query is generated and encrypted by using AES technique which is further hashed by a secure hashing technique. • Web Application is a Three Tier Architecture with Client, Server & DataBase. •
• 3.
  AGENDA • Abstract. • Existingsystem. • Proposed system and its limitations. • System Architecture and its advantages. • Screenshots. • Conclusion. • References.
• 4.
  ABSTRACT Web applications aresteadily increasing in our daily routines activities and continue to integrate them. Online Banking, On-line reservations, on-line shopping expect these web applications to be secure and reliable the terror of SQL– Injection Attacks has become increasingly frequent and serious. SQL Injection Attacks are one of the topmost threats for web application security. Using SQL Injection attackers can leak confidential information: such as credit card numbers, ATM pins, User credentials from web applications and even corrupt the database. In this paper, some predefined methods are discussed and integrated approach of encryption method with secure hashing is applied in the database to avoid attack on each and every phase.
• 5.
  EXISTING SYSTEM • Tame-carddetection and prevention • Functionality of temporary authentication • Vulnerability detection -Static analysis -Dynamic analysis • Predefined method and hybrid encryption methods applied • Hash value approach with SQLIPA prototype • Runtime attack prevention - Client side prevention - Server side prevention
• 6.
  LIMITATIONS • SQL Injectionhas become a common issue with database-driven web sites. The flaw is easily detected, and easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted attack of this kind. • Essentially, the attack is accomplished by placing a meta character into data input to then place SQL commands in the control plane, which did not exist there before. This flaw depends on the fact that SQL makes no real distinction between the control and data planes.
• 7.
  Literature survey Title Workdone Inference Detection of SQL Injection Attack and Various Prevention Strategies. This paper presents a security methods we are able to reduce the total number of alerts from four to zero alert by scanning the website using vulnerability tool. SQL Injection attack occurs due to vulnerabilities present in the website that allows the hacker to by passes the SQL statements and hence enters into the database queries directly. SQL Injection is the first step in entry to exploiting or hacking any website available on internet. Got Clear Idea about Attacks and this algorithm is like mutation based so it takes plenty of time to identify the attacks Protection of Web Application againstSql Injection Attacks In this paper, various types of SQL injection attacks as well as predefined prevention methods are discussed. Then the hybrid encryption method is used which includes AES encryption and Rabin’s cryptosystem. The reason behind the use of two layer of encryption is that it will be more secured. SQL query is generated and encrypted by Rabin’s cryptosystem because even if hackers hack the information and decode the AES encryption part, it will still be more difficult for them to know about the encrypted query Add some more security to databases to avoid SQL injection attack.
• 8.
  Cont.. SQL INJECTION Attacks inWeb Application In this paper, we have presented the rst formal definition of command injection attacks in web applications. Based on this definition, we have developed a sound and complete runtime checking algorithm for preventing command injection attacks and produced a working implementation of the algorithm. SQLCIAs precisely and incurred low runtime overhead. Review of SQL Injection Attack and Proposed Method for Detection and Prevention of SQLIA This paper also contains strengths and weaknesses of various SQL injection attacks. At last we also proposed the scheme to handle the SQLIA and strong enough to prevent them. The use of internet increases day by day. As the number of computer users increases, the number reported cases of cybercrime increases. While, on the other side, the organization increases the use of office automation software & services, that helps them to maintain the confidential information with less efforts. A new approach that is completely based on the hash method of using the SQL queries in the web-based environment, which is much secure and provide the prevention from the attackers SQL.
• 9.
  PROPOSED SYSTEM • AESencryption and combined approach of secure hashing on encryption. • By applying encryption technique, database attacks can be prevented. Encryption of data basically helps to change the data into a form that is not readable. Without the correct key, this format can’t be deciphered even if attacker hacks the information. Application of encryption in login phase makes it difficult for unauthorized users to access the database.
• 10.
  ADVANTAGES • Confidentiality: SinceSQL databases generally hold sensitive data, loss of confidentiality is a frequent problem with SQL Injection vulnerabilities. • Authentication: If poor SQL commands are used to check user names and passwords, it may be possible to connect to a system as another user with no previous knowledge of the password. • Authorization: If authorization information is held in a SQL database, it may be possible to change this information through the successful exploitation of a SQL Injection vulnerability. • Integrity: Just as it may be possible to read sensitive information, it is also possible to make changes or even delete this information with a SQL Injection attack.
• 11.
  OVERALL SYSTEM ARCHITECTURE Username Password EncryptedAES Code AES SHA1 SHA(AES) Username & Password Registration Encrypted string of Username & Password Data Base Access Permitted Value check in DB No Access SQL Injection Attack Authentication Schemes Login Interface
• 12.
  OVERALL SYSTEM ARCHITECTURE •SQL injection attacks are nothing but injecting malicious queries by the hackers into the application projected queries to get the desired outputs from the database. SQL Injection allows an attacker to create, read, update, modify, or delete data stored in the back-end database. • While Typing SQL keywords and control signs an intruder is able to modify the structure of SQL query developed by a Web designer. • SQL Injection attacks can take place when a web application utilizes user-supplied data without proper validation or encoding as part of a command or query
• 13.
  RESULTS Registering the usernameand password in the login page Username and Password stored in the login table
• 14.
  Unprotected login pageProtected Login
• 15.
  Exit page
• 16.
  CONCLUSION • SQL queryis generated and encrypted by using AES technique which is further hashed by a secure hashing technique and as we know hashed codes is a one way encryption technique thus it is not possible to decode it. This proposed integrated approach is an effort to add some more security measures to databases to avoid SQL injection attack. • The web-application code perfectly contains a policy that allows distinguishing lawful and malicious queries. • This area is in need of more research, mainly because of various reasons: SQL injection attacks are most probable to change and new vulnerabilities will be found, collectively with new countermeasures to deal with them. As many hacking sites are existing on the web, and since attack methods are well described and circulated between hackers, we believe that information about new attack methods must be constantly surveyed and new counter measures should be developed. • So, in future, a new technique can be developed so that it is capable for other varieties of SQL Injection Attacks also. Due to which, this technique will be able to prevent SQL Injection Attack totally.
• 17.
  REFERENCES [1] Priyanka, VijayKumar Bohat, (April 2013) ’Detection of SQL Injection Attack and Various Prevention Strategies’, International Journaand Advanced Technology (IJEAT) ISSN: 2249 – 8958, Volume-2, Issue-4. [2] Sonam Panda, 1 Ramani S2,(Jan-Feb.2013),’Protection of Web Application against Sql Injection Attacks ‘, International Journal of Modern Engineering Research (IJMER) Vol.3, Issue.1, pp-166-168 ISSN: 2249-6645. [3] Mihir Gandhi, JwalantBaria,( January 2013)’SQL INJECTION Attacks in Web Application’International Journal of Soft Computing and Engineering (IJSCE) ISSN: 2231-2307, Volume-2, Issue-6. [4] By Mayank Namdev*, Fehreen Hasan, Gaurav Shrivastav(July 2012) ‘Review of SQL Injection Attack and Proposed Method for Detection and Prevention of SQLIA”Volume 2, Issue 7. [5] Shubham Srivastava1, Rajeev Ranjan Kumar Tripathi, ‘Attacks Dueto SQL Injection & Their Prevention Method for Web-Application (IJCSIT) International Journal of Computer Science and InformationTechnologies, Vol. 3 (2) , 2012,3615-3618. [6] Indrani Balasundaram, E.Ramaraj,’An Authentication Scheme forPreventing SQL injection Attack using Hybrid Encryption’ (ISSN 1450-216,2011, Vol.53,pp.359-368. [7] AtefehTajpour et al. ‘Evaluation of SQL Injection Detetion andPrevention Techniques’ Second International Conference onComputational Intelligence, 2010. [8] Shaukat Ali, Azhar Rauf, Huma Javed,’SQLIPA: An Authentication Mechanism Against SQL Injection’, European Journal of Scientific Research ISSN 1450-216X Vol.38 No.4 (2009), pp 604-611. [9] Sayyed Mohammad Sadegh Sajjadi and Bahare Tajalli Pour,( September 2013) ‘Study of SQL Injection Attacks and Countermeasures’, International Journal of Computer and Communication Engineering, Vol. 2, No. 5. [10] W. G. Halfond, J. Viegas, and A. Orso , ‘A Classification of SQLInjection Attacks and Countermeasures,’ in Proc. the International Symposium on Secure Software Engineering 2006.
• 18.
  THANK YOU