10:33 AM
Paul B
The other night at school we got on the discussion of SQL injection website attacks. I happen to know someone who has a website that has been the victim of multiple SQL injection attacks. This person was getting really fed up with it, and they were finding them selves restoring backups about three times a day due to some script kiddie trying to make name for themselves, and trying to be a 1337 H4x0r.
SQL injection has been around for a while, and isn't anything new. If you are just climbing out from under your rock, and have never heard of SQL injection here is a good definition of what SQL injection is from Wikipedia:
SQL injection is a technique that exploits a security vulnerability occurring in the database layer of an application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed. It is in fact an instance of a more general class of vulnerabilities that can occur whenever one programming or scripting language is embedded inside another.
Well my instructor pointed out a pretty cool free application one can use to test their web page for basic, simple SQL injection attacks to see if they are vulnerable. If they are vulnerable, this application will give them a nice little report telling them how many vulnerabilities a website might have, which pages vulnerabilities have been found on, and what database information is found on the back end.This application is from HP, and is called Scrawlr. Since it is free, the scans it does, and the attack methods it uses is fairly basic. For a more robust scan, HP has another enterprise product you can pay for. However if you use Scrawlr, and you do find vulnerabilities, that means your site is open to even the most novice of script kiddies, and you will be able to patch up your site to protect against basic attacks.
Do you know of any other SQL injection scanning/evaluating programs? If you do, I would love to play with some so please let me know in the comments.
Posted in: 
