Downloaded 77 times
![Important concepts
SQL: is Structured Query Language, which is a computer language for storing, manipulating
and retrieving data stored in relational database.
Reference: [1] SQL TUTORIAL-Simply Easy Learning by tutorialspoint.com](https://image.slidesharecdn.com/sqlandclickjackingattacks-170421212706/85/SQL-Injection-and-Clickjacking-Attack-in-Web-security-5-320.jpg)
![What is SQL injection?
SQL injection vulnerabilities have been described as one of the most serious threats for Web
applications [2, 3]. Web applications that are vulnerable to SQL injection may allow an attacker
to gain complete access to their underlying databases.
Reference:
[2] D. Aucsmith. Creating and Maintaining Software that Resists Malicious Attack. http://www.gtisc.gatech.edu/bio
aucsmith.html, September 2004. Distinguished Lecture Series.
[3] T. O. Foundation. Top Ten Most Critical Web Application Vulnerabilities, 2005. http:
//www.owasp.org/documentation/topten.html](https://image.slidesharecdn.com/sqlandclickjackingattacks-170421212706/85/SQL-Injection-and-Clickjacking-Attack-in-Web-security-6-320.jpg)
![SQL injection architecture
Reference: [4] System Architecture for SQL Injection and Insider Misuse Detection System for DBMS , Aziah Asmawi Faculty of Computer
Science and Information System Universiti Teknologi Malaysia aziah@fsktm.upm.edu.my , © 2008 IEEE](https://image.slidesharecdn.com/sqlandclickjackingattacks-170421212706/85/SQL-Injection-and-Clickjacking-Attack-in-Web-security-7-320.jpg)
![Best practices for preventing SQL injection attacks
Use stored procedures
Use dynamic SQL only when you can't avoid it
Use the principle of least access when granting database access
Use testing and monitoring to guard against SQL injection
[5] http://searchsqlserver.techtarget.com/tip/Best-practices-for-preventing-a-SQL-
injection-attack](https://image.slidesharecdn.com/sqlandclickjackingattacks-170421212706/85/SQL-Injection-and-Clickjacking-Attack-in-Web-security-13-320.jpg)
![Frame busting and Clickjacking attacks
Clickjacking attacks:is a malicious technique of tricking a Web user into
clicking on something different from what the user perceives they are
clicking on
Frame busting: is considered the most common defence to the Web
framing attacks to clickjacking by prevents a site from functioning when
loaded inside a Frame.
References:
[6] Busting Frame Busting: a Study of Clickjacking Vulnerabilities on Popular Sites, June 7, 2010.
2013 11th International Conference on Frontiers of Information Technology, On Detection and Prevention of
Clickjacking Attack for OSNs, © 2013 IEEE.
[7] https://www.microsoft.com/en-us/research/publication/clickjacking-attacks-and-defenses/](https://image.slidesharecdn.com/sqlandclickjackingattacks-170421212706/85/SQL-Injection-and-Clickjacking-Attack-in-Web-security-20-320.jpg)
![An attacker builds a CJ attack in three steps:
The attacker creates a Web page (called a displayed page, or DP) including parts
that look like the usual clickable objects, such as text hyperlinks or buttons.
The attacker then creates a malicious page (called a hidden page, or HP) including
clickable objects whose position on the page fits perfectly with the previous ones.
The attacker then displays the DPs on top of the HPs so that visitors to the page
might decide to click on the DP’s fake hyperlink, thus clicking on a real HP
hyperlink, which could be the starting point of an attack on the system.
Reference: [8] Attack Trends Editors: Marcus Sachs, marcus.sachs@verizon.com David Ahmad,drma@mac.com](https://image.slidesharecdn.com/sqlandclickjackingattacks-170421212706/85/SQL-Injection-and-Clickjacking-Attack-in-Web-security-23-320.jpg)
![Visualization of a clickjacking attack
The victim site is framed in a transparent iframe that is put on top of what
appears to be a normal page.
When users interact with the normal page, they are unwittingly interacting
with the victim site.
Reference: [9] Busting Frame Busting: a Study of Clickjacking Vulnerabilities on Popular Sites, June 7,](https://image.slidesharecdn.com/sqlandclickjackingattacks-170421212706/85/SQL-Injection-and-Clickjacking-Attack-in-Web-security-24-320.jpg)
![Framebuster
A framebuster is a piece of JavaScript code that prevents a web page from being
rendered within a frame. There are many variations of framebusters in use in
different web sites. As recommended by the OWASP community, the most
reliable framebuster is:
o <head>
o <style> body { display : none;} </style>
o </head>
o <body> <
o script> if (self == top)
o { var theBody = document.getElementsByTagName('body')[0]; theBody.style.display = "block";
}
o else { top.location = self.location; }
o </script>](https://image.slidesharecdn.com/sqlandclickjackingattacks-170421212706/85/SQL-Injection-and-Clickjacking-Attack-in-Web-security-25-320.jpg)
![Important concepts
SQL: is Structured Query Language, which is a computer language for storing, manipulating
and retrieving data stored in relational database.
Reference: [1] SQL TUTORIAL-Simply Easy Learning by tutorialspoint.com](https://image.slidesharecdn.com/sqlandclickjackingattacks-170421212706/75/SQL-Injection-and-Clickjacking-Attack-in-Web-security-5-2048.jpg)
![What is SQL injection?
SQL injection vulnerabilities have been described as one of the most serious threats for Web
applications [2, 3]. Web applications that are vulnerable to SQL injection may allow an attacker
to gain complete access to their underlying databases.
Reference:
[2] D. Aucsmith. Creating and Maintaining Software that Resists Malicious Attack. http://www.gtisc.gatech.edu/bio
aucsmith.html, September 2004. Distinguished Lecture Series.
[3] T. O. Foundation. Top Ten Most Critical Web Application Vulnerabilities, 2005. http:
//www.owasp.org/documentation/topten.html](https://image.slidesharecdn.com/sqlandclickjackingattacks-170421212706/75/SQL-Injection-and-Clickjacking-Attack-in-Web-security-6-2048.jpg)
![SQL injection architecture
Reference: [4] System Architecture for SQL Injection and Insider Misuse Detection System for DBMS , Aziah Asmawi Faculty of Computer
Science and Information System Universiti Teknologi Malaysia aziah@fsktm.upm.edu.my , © 2008 IEEE](https://image.slidesharecdn.com/sqlandclickjackingattacks-170421212706/75/SQL-Injection-and-Clickjacking-Attack-in-Web-security-7-2048.jpg)
![Best practices for preventing SQL injection attacks
Use stored procedures
Use dynamic SQL only when you can't avoid it
Use the principle of least access when granting database access
Use testing and monitoring to guard against SQL injection
[5] http://searchsqlserver.techtarget.com/tip/Best-practices-for-preventing-a-SQL-
injection-attack](https://image.slidesharecdn.com/sqlandclickjackingattacks-170421212706/75/SQL-Injection-and-Clickjacking-Attack-in-Web-security-13-2048.jpg)
![Frame busting and Clickjacking attacks
Clickjacking attacks:is a malicious technique of tricking a Web user into
clicking on something different from what the user perceives they are
clicking on
Frame busting: is considered the most common defence to the Web
framing attacks to clickjacking by prevents a site from functioning when
loaded inside a Frame.
References:
[6] Busting Frame Busting: a Study of Clickjacking Vulnerabilities on Popular Sites, June 7, 2010.
2013 11th International Conference on Frontiers of Information Technology, On Detection and Prevention of
Clickjacking Attack for OSNs, © 2013 IEEE.
[7] https://www.microsoft.com/en-us/research/publication/clickjacking-attacks-and-defenses/](https://image.slidesharecdn.com/sqlandclickjackingattacks-170421212706/75/SQL-Injection-and-Clickjacking-Attack-in-Web-security-20-2048.jpg)
![An attacker builds a CJ attack in three steps:
The attacker creates a Web page (called a displayed page, or DP) including parts
that look like the usual clickable objects, such as text hyperlinks or buttons.
The attacker then creates a malicious page (called a hidden page, or HP) including
clickable objects whose position on the page fits perfectly with the previous ones.
The attacker then displays the DPs on top of the HPs so that visitors to the page
might decide to click on the DP’s fake hyperlink, thus clicking on a real HP
hyperlink, which could be the starting point of an attack on the system.
Reference: [8] Attack Trends Editors: Marcus Sachs, marcus.sachs@verizon.com David Ahmad,drma@mac.com](https://image.slidesharecdn.com/sqlandclickjackingattacks-170421212706/75/SQL-Injection-and-Clickjacking-Attack-in-Web-security-23-2048.jpg)
![Visualization of a clickjacking attack
The victim site is framed in a transparent iframe that is put on top of what
appears to be a normal page.
When users interact with the normal page, they are unwittingly interacting
with the victim site.
Reference: [9] Busting Frame Busting: a Study of Clickjacking Vulnerabilities on Popular Sites, June 7,](https://image.slidesharecdn.com/sqlandclickjackingattacks-170421212706/75/SQL-Injection-and-Clickjacking-Attack-in-Web-security-24-2048.jpg)
![Framebuster
A framebuster is a piece of JavaScript code that prevents a web page from being
rendered within a frame. There are many variations of framebusters in use in
different web sites. As recommended by the OWASP community, the most
reliable framebuster is:
o <head>
o <style> body { display : none;} </style>
o </head>
o <body> <
o script> if (self == top)
o { var theBody = document.getElementsByTagName('body')[0]; theBody.style.display = "block";
}
o else { top.location = self.location; }
o </script>](https://image.slidesharecdn.com/sqlandclickjackingattacks-170421212706/75/SQL-Injection-and-Clickjacking-Attack-in-Web-security-25-2048.jpg)
Uploaded byMoutasm Tamimi
SQL Injection and Clickjacking Attack in Web security
The document discusses information security threats focusing on SQL injection and clickjacking attacks. SQL injection vulnerabilities are highlighted as critical risks for web applications, detailing how they allow attackers to access databases and suggesting best practices for prevention, such as using stored procedures and dynamic SQL with caution. Additionally, clickjacking attacks are explained, outlining their mechanics and defenses like frame busting to protect users from malicious interactions.
More Related Content
![Fundamental JavaScript [UTC, March 2014]](https://cdn.slidesharecdn.com/ss_thumbnails/fundamentaljavascriptutcmarch2014-140305104047-phpapp01-thumbnail.jpg?width=600ounds&width=560&fit=bounds)
Similar to SQL Injection and Clickjacking Attack in Web security
![UiPath Automation Suite Installation (Hands-On) [2/3]](https://cdn.slidesharecdn.com/ss_thumbnails/automationsuitecommunitysession2-251015095633-a6d862f1-thumbnail.jpg?width=600ounds&width=560&fit=bounds)
SQL Injection and Clickjacking Attack in Web security
- 1. Information Security Web Security Presentedby: Moutasm Tamimi Information Security 2017 -SQL injection -Clickjacking attacks
- 2. Outline of SQLinjection Related definitions What is SQL injection? The history of SQL injection SQL injection architecture How does SQL injection work? Best practices for preventing SQL injection attacks
- 3. Outline of ClickjackingAttack Frame busting and Clickjacking attacks An attacker builds a CJ attack in three steps Visualization of a clickjacking attack Framebuster Breaking the Integrity of display
- 4.
- 5. Important concepts SQL:is Structured Query Language, which is a computer language for storing, manipulating and retrieving data stored in relational database. Reference: [1] SQL TUTORIAL-Simply Easy Learning by tutorialspoint.com
- 6. What is SQLinjection? SQL injection vulnerabilities have been described as one of the most serious threats for Web applications [2, 3]. Web applications that are vulnerable to SQL injection may allow an attacker to gain complete access to their underlying databases. Reference: [2] D. Aucsmith. Creating and Maintaining Software that Resists Malicious Attack. http://www.gtisc.gatech.edu/bio aucsmith.html, September 2004. Distinguished Lecture Series. [3] T. O. Foundation. Top Ten Most Critical Web Application Vulnerabilities, 2005. http: //www.owasp.org/documentation/topten.html
- 7. SQL injection architecture Reference:[4] System Architecture for SQL Injection and Insider Misuse Detection System for DBMS , Aziah Asmawi Faculty of Computer Science and Information System Universiti Teknologi Malaysia aziah@fsktm.upm.edu.my , © 2008 IEEE
- 8. How does SQLinjection work? 1. Application presents a form to the attacker. 2. Attacker sends an attack in the form data. 3. Application forwards attack to the database in a SQL query 4. Database runs query containing attack and sends encrypted results back to application. 5. Application decrypts data as normal and sends results to the user.
- 9. SQL injection practicesin web forms Account: SKU: Account Summary Acct:5424-6066-2134-4334 Acct:4128-7574-3921-0192 Acct:5424-9383-2039-4029 Acct:4128-0004-1234-0293 "SELECT * FROM accounts WHERE acct=‘’ OR 1=1--’"
- 10. Logical code injectionanalysis
- 11. Example Server Code txtUserId = getRequestString("UserId"); txtSQL = "SELECT * FROM Users WHERE UserId = " + txtUserId; Let UserId= 105; DROP TABLE Suppliers Result SELECT * FROM Users WHERE UserId = 105; DROP TABLE Suppliers The SQL above will return all rows in the Users table, and then delete the table called Suppliers
- 12. The primary wayto protect a database , SQL Server and application developers For both SQL Server and application developers, the primary goal is isolating the SQL command language from user input as much as possible.
- 13. Best practices forpreventing SQL injection attacks Use stored procedures Use dynamic SQL only when you can't avoid it Use the principle of least access when granting database access Use testing and monitoring to guard against SQL injection [5] http://searchsqlserver.techtarget.com/tip/Best-practices-for-preventing-a-SQL- injection-attack
- 14. Use stored procedures When possible, permit applications to interact with the database only through stored procedures. Even if the application code is susceptible to SQL injection attacks, those attacks will fail because the application lacks the permissions necessary to access or manipulate those tables. Plus, stored procedures type-check input parameters, which can help mitigate an attack if a hacker tries to inject a value that violates the type.
- 15. Use dynamic SQLonly when you can't avoid it Dynamic SQL can greatly increase your risk of SQL injection attacks when the command language is concatenated with user input. One way you can help mitigate the risks associated with dynamic SQL is by properly escaping all user input. Escaping user-supplied values helps to render special characters harmless that can be passed in with that input, such as brackets or single quotes. These characters, when used with other language elements, can pose a threat to the database when concatenated with the static part of the SQL statement. To escape these characters, use the QUOTENAME function as appropriate to handle identifiers and string values Example: delimiting string using double quote. SELECT QUOTENAME('Syntax-Example','"')
- 16. Complement …. Usethe sp_executesql system-stored procedure to execute your dynamic SQL, rather than a simple EXCECUTE statement. By using the sp_executesql stored procedure, you have a way to parameterize the dynamic SQL so the data remains separate from the command language.
- 17. Use the principleof least access when granting database access Every database account should be assigned the least privileges necessary to access the database. That is why restricting access to stored procedures can be so effective. Ideally, you grant execute access to the procedures and permit no access to anything else.
- 18. Use testing andmonitoring to guard against SQL injection No matter how careful you've been in protecting against SQL injection attacks, you should still run your database code through the necessary checks to make sure it's safe. Finally, once the database has gone live, log files and other tracking devices should be used to monitor the database for any indication of SQL injections.
- 19.
- 20. Frame busting andClickjacking attacks Clickjacking attacks:is a malicious technique of tricking a Web user into clicking on something different from what the user perceives they are clicking on Frame busting: is considered the most common defence to the Web framing attacks to clickjacking by prevents a site from functioning when loaded inside a Frame. References: [6] Busting Frame Busting: a Study of Clickjacking Vulnerabilities on Popular Sites, June 7, 2010. 2013 11th International Conference on Frontiers of Information Technology, On Detection and Prevention of Clickjacking Attack for OSNs, © 2013 IEEE. [7] https://www.microsoft.com/en-us/research/publication/clickjacking-attacks-and-defenses/
- 21. Clickjacking Jeremiah Grossman andRobert Hansen, 2008
- 23. An attacker buildsa CJ attack in three steps: The attacker creates a Web page (called a displayed page, or DP) including parts that look like the usual clickable objects, such as text hyperlinks or buttons. The attacker then creates a malicious page (called a hidden page, or HP) including clickable objects whose position on the page fits perfectly with the previous ones. The attacker then displays the DPs on top of the HPs so that visitors to the page might decide to click on the DP’s fake hyperlink, thus clicking on a real HP hyperlink, which could be the starting point of an attack on the system. Reference: [8] Attack Trends Editors: Marcus Sachs, marcus.sachs@verizon.com David Ahmad,drma@mac.com
- 24. Visualization of aclickjacking attack The victim site is framed in a transparent iframe that is put on top of what appears to be a normal page. When users interact with the normal page, they are unwittingly interacting with the victim site. Reference: [9] Busting Frame Busting: a Study of Clickjacking Vulnerabilities on Popular Sites, June 7,
- 25. Framebuster A framebusteris a piece of JavaScript code that prevents a web page from being rendered within a frame. There are many variations of framebusters in use in different web sites. As recommended by the OWASP community, the most reliable framebuster is: o <head> o <style> body { display : none;} </style> o </head> o <body> < o script> if (self == top) o { var theBody = document.getElementsByTagName('body')[0]; theBody.style.display = "block"; } o else { top.location = self.location; } o </script>
- 26. Breaking the Integrityof display Forgery the elements Displaying the target element using CSS properties like opacity, z-index layer over layer to overlapping the elements and hiding the real elements. Using CSS pointer-events: none property to cover other element over the target element
- 27. Click Event z-index: - 1 opacity: 0.1pointer-event: none Real element Target Breaking the Integrity of display
- 28. Speaker Information Moutasmtamimi Independent Consultant , IT Researcher , CEO at ITG7 Instructor of: Project Management. DBMS Specialist. .NET Applications. Digital Marketing. – Email: tamimi@itg7.com Click Here Click HereITG7 Click Here
- 30. Information Security Web Security Presentedby: Moutasm Tamimi Information Security 2017 -SQL injection -Clickjacking attacks