case study on sql injection

The problem here is that the SQL statement uses concatenation to combine data. The attacker can provide a string like this instead of the pass variable:

password' OR 5=5

The resulting SQL query will be run against the database:

SELECT id FROM users WHERE username='user' AND password='pass' OR 5=5'

Because 5=5 is a condition that always evaluates to true, the entire WHERE statement will be true, regardless of the username or password provided. 

The WHERE statement will return the first ID from the users table, which is commonly the administrator. This means the attacker can access the application without authentication, and also has administrator privileges. 

A more advanced form of this attack is where the attacker adds a code comment symbol at the end of the SQL statement, allowing them to further manipulate the SQL query. The following will work in most databases including MySQL, PostgreSQL, and Oracle:

' OR '5'='5' /*

Learn more in our detailed guide to sql injection test .

In this example, the following code obtains the current username, and searches for items matching a certain item name, where the owner is the current user.

... string userName = ctx.getAuthenticatedUserName(); string query = "SELECT * FROM items WHERE owner = "'"                 + userName + "' AND itemname = '"                 + ItemName.Text + "'"; ...

This code has the same weakness as in the previous example – the use of concatenation. After combining the username and item name, the code creates the following query:

SELECT * FROM items  WHERE owner = AND itemname = ;

If the attacker provides the following string for itemname :

Widget' OR 5=5

The SQL statement becomes:

SELECT * FROM items WHERE owner = 'John' AND itemname = 'Widget' OR 5=5';

Which is the same as: SELECT * FROM items;

This means the query will return the data of the entire table, giving the attacker unauthorized access to sensitive data.

This is a simple SQL injection attack based on user input. The attacker uses a form that requires first name and last name as inputs. The attacker inputs:

• First name: malicious'ex
• Last name: Smith

The attacker’s first name variable contains a malicious expression, which we denoted as ‘ex. The SQL statement that processes the form inputs looks like this:

SELECT id, firstname, lastname FROM authors

Once the attacker injects a malicious expression into the first name, the statement looks like this:

SELECT id, firstname, lastname FROM authors WHERE firstname = 'malicious'ex' and lastname ='newman'

The database identifies incorrect syntax due to the single apostrophe, and tries to execute the malicious statement.

For many more examples of malicious SQL code, see our detailed guide to SQL injection payloads .

This is a summarized version of the excellent OWASP SQL injection prevention cheat sheet .

Defense Option 1: Prepared Statements (with Parameterized Queries)

Prepared statements are easy to learn and use, and eliminate the problem of SQL injection. They force you to define SQL code, and pass each parameter to the query later, making a strong distinction between code and data. 

If an attacker supplies a malicious string like in the above examples, for example providing John' or 1=1 for a username, the prepared statement will evaluate this as a literal string. It will look for a user named John' or 1=1 (and fail, because no such user exists) instead of evaluating this statement as code.

Prepared statements are available in all programming languages. Here is an example in Java. To be on the safe side, OWASP recommends validating the input parameter just in case.

// Separate definition of input variable String custname = request.getParameter("customerName"); // Separate definition of SQL statement String query = "SELECT account_balance FROM user_data WHERE user_name = ? "; // PreparedStatement command securely combines inputs and SQL syntax PreparedStatement pstmt = connection.prepareStatement( query ); pstmt.setString( 1, custname); ResultSet results = pstmt.executeQuery( );

Defense Option 2: Stored Procedures

Stored procedures are similar to prepared statements, only the SQL code for the stored procedure is defined and stored in the database, rather than in the user’s code. In most cases, stored procedures can be as secure as prepared statements, so you can decide which one fits better with your development processes.

There are two cases in which stored procedures are not secure:

• The stored procedure includes dynamic SQL generation – this is typically not done in stored procedures, but it can be done, so you must avoid it when creating stored procedures. Otherwise, ensure you validate all inputs.
• Database owner privileges – in some database setups, the administrator grants database owner permissions to enable stored procedures to run. This means that if an attacker breaches the server, they have full rights to the database. Avoid this by creating a custom role that allows storage procedures only the level of access they need.

Here is an example of a stored procedure in Java (Java calls it a CallableStatement ). We assume that the sp_getAccountBalancer stored procedure implements the same logic as the prepared statement in option 1 above.

// Separate definition of user inputs String custname = request.getParameter("customerName"); // Executing the stored procedure sp_getAccountBalancer try {   CallableStatement cs = connection.prepareCall("{call sp_getAccountBalance(?)}");   cs.setString(1, custname);   ResultSet results = cs.executeQuery();   // result set handling } catch (SQLException se) {   // logging and error handling }

Learn more in our detailed guide to union sql injection .

Snapshots are good. Continuous security testing is better.

Modern, enterprise-grade security testing for web, API, business logic, and LLMs at the speed of deployment.

Defense Option 3: Allow-list Input Validation

This is another strong measure that can defend against SQL injection. The idea of allow-list validation is that user inputs are validated against a closed list of known legal values.

For example, if a user input is used to select a database table, you can use code like this to ensure that it can only match one of several, known table names:

String tableName; switch(PARAM):   case "Value1": tableName = "fooTable";                  break;   case "Value2": tableName = "barTable";                  break;   ...   default      : throw new InputValidationException("unexpected value                   Provided" + " for table name");

Another safe way to handle user inputs is to convert them to a non-string form. For example, if the user input determines whether the query should be ordered in ascending or descending order, the input can be converted to a boolean. And then this boolean value is used to determine the sort order:

public String someMethod(boolean sortOrder) {  String SQLquery = "some SQL ... order by Salary " + (sortOrder ? "ASC" : "DESC");` ...

Defense Option 4: Escaping All User-Supplied Input

Escaping means to add an escape character that instructs the code to ignore certain control characters, evaluating them as text and not as code. 

This option is the least secure of the four, and should only be used as a last resort. This is because escaping user input is only effective if the code escapes all possibilities of control characters, and attackers come up with numerous creative ways to inject them. Therefore, OWASP does not recommend this method and advises the use of options 1 or 2 above.

For example, in MySQL there are two escaping modes – ANSI_QUOTES SQL mode and MySQL mode:

• in ANSI_QUOTES mode, to escape control characters, encode all ‘ (single tick) characters with ” (two ticks)
• \0  [the number zero, not the letter O]
• \\ [escaping a single slash character]
• Replace all other non-alphanumeric characters with ASCII values
• Replace numbers less than 256  with \c where ‘c’ is the original number

OWASP provides the free, open source Enterprise Security API (ESAPI) , which can help you implement escaping in legacy database code. It provides codecs for popular databases, which have escaping for all unsafe control patterns. 

ESAPI currently supports Oracle and MySQL, and will soon support encoders for SQL Server and PostgreSQL.

Bright Dynamic Application Security Testing (DAST) helps automate the detection and remediation of many vulnerabilities including SQLi, early in the development process, across web applications and APIs. 

By shifting DAST scans left, and integrating them into the SDLC, developers and application security professionals can detect vulnerabilities early, and remediate them before they appear in production. Bright completes scans in minutes and achieves zero false positives, by automatically validating every vulnerability. This allows developers to adopt the solution and use it throughout the development lifecycle. 

Scan any web app, or REST and GraphQL APIs to prevent SQL injection vulnerabilities with Bright !

See Additional Guides on Key Data Security Topics

Together with our content partners, we have authored in-depth guides on several other topics that can also be useful as you explore the world of data security .

Authored by Cynet

• EDR Security: Protecting the Network From Endpoint Threats
• EPP vs. EDR: What Matters More, Prevention or Response?
• Endpoint Detection and Response (EDR) in Healthcare

Penetration Testing

Authored by HackerOne

• Penetration Testing on AWS: A Practical Guide
• What is Penetration Testing? A Complete Guide
• What is Penetration Testing as a Service (PTaaS)?

Object Storage

Authored by Cloudian

• What is Object Storage: Definition, How It Works and Use Cases
• Object Storage vs. File Storage: What’s the Difference?
• Object Storage vs. Block Storage: Head to Head

DORA: Exploring The Path to Financial Institutions’ Resilience

DORA (Digital Operational Resilience Act) is the latest addition to the EU regulatory arsenal. A framework designed to bolster the cyber resilience of financial entities operating within the EU. But let’s face it: there’s no lack of regulations issued by the European Union legislature, and they’re not exactly known for keeping things light and easy.

IASTless IAST – The SAST to DAST Bridge

Streamline appsec with IASTless IAST. Simplify deployment, enhance accuracy, and boost your security posture by combining SAST and Bright’s DAST.

Bringing DAST security to AI-generated code

AI-generated code is basically the holy grail of developer tools of this decade. Think back to just over two years ago; every third article discussed how there weren’t enough engineers to answer demand; some companies even offered coding training for candidates wanting to make a career change. The demand for software and hardware innovation was

Web attacks

API attacks

Business logic attacks

LLM attacks

Interfaces & extensions

Integrations

Book a demo

Webinars & events

Case studies

Trust center

Bug bounty program

Get our newsletter

SQL Injection Examples (2024): The 4 Worst Attacks Ever

By Tibor Moes / Updated: January 2024

SQL Injection remains a prevalent and dangerous cybersecurity threat, exploiting vulnerabilities in databases to compromise sensitive data.

In this article, we’ll explore four of the most catastrophic SQL Injection attacks in history, providing insights into their impact and lessons learned for stronger digital defenses.

SQL Injection is a cybersecurity attack that exploits vulnerabilities in database-driven applications to manipulate or steal data.

• Heartland Payment Systems (2008): A major payment processor faced one of the largest data breaches due to SQL Injection. Approximately 130 million credit and debit card numbers were exposed.
• Sony Pictures (2011): Sony’s network suffered a severe SQL Injection attack, compromising its digital infrastructure. Around 77 million PlayStation Network accounts were affected, costing Sony an estimated $170 million.
• Yahoo! (2012): Yahoo! Voices experienced a massive data breach, impacting its vast user base. The attack leaked about half a million email addresses and passwords.
• TalkTalk (2015): This telecom giant was hit by a cyberattack that compromised customer data. Nearly 157,000 customers had their personal details exposed.

Don’t become a victim of cybercrime. Protect your devices with the best antivirus software and your privacy with the best VPN service .

SQL Injection Examples

1. heartland payment systems (2008): a digital catastrophe.

In 2008, Heartland Payment Systems, a major payment processing company, fell victim to one of the largest data breaches in history due to an SQL Injection attack. This breach was not just a small glitch in the system but a massive exposure, resulting in approximately 130 million credit and debit card numbers being compromised.

This staggering statistic, reported by Proofpoint, underscores the sheer magnitude of the breach​​. The incident serves as a stark reminder of the vulnerabilities in digital payment systems and the devastating consequences of security lapses. Businesses and individuals alike were forced to confront the harsh reality that no entity is impervious to cyber threats, setting a precedent for cybersecurity measures in the financial sector.

2. Sony Pictures (2011): A Virtual Nightmare

Fast forward to 2011, and we witness another colossal cybersecurity failure, this time impacting entertainment giant Sony Pictures. The attack on Sony’s network was not just a breach of data but an outright assault on the company’s digital infrastructure.

According to The Washington Post, approximately 77 million PlayStation Network accounts were compromised, revealing personal details of millions of users​​. The financial repercussions were equally severe, with the breach costing Sony an estimated $170 million.

This incident highlighted the vulnerability of even the most sophisticated digital networks to SQL Injection attacks, underscoring the critical need for robust cybersecurity measures. It served as a wake-up call to the entire digital entertainment industry, emphasizing the importance of safeguarding user data against evolving cyber threats.

3. Yahoo! (2012): A Massive Data Breach

In July 2012, Yahoo! experienced a colossal data breach, particularly impacting Yahoo! Voices, formerly known as Associated Content. This breach was not a minor incident but a significant cyberattack, leading to the leak of approximately half a million email addresses and passwords associated with the Yahoo! Contributor Network.

As reported by The Christian Science Monitor, the scale of this breach was alarming, highlighting the vulnerabilities in even well-established internet companies​​. The incident exposed the personal information of countless users, raising serious concerns about data security and privacy. It underscored the need for stronger data protection measures and the importance of constant vigilance in the digital age.

4. TalkTalk (2015): A Wake-Up Call for Telecom Security

The year 2015 marked a significant event in the history of cyberattacks with the TalkTalk breach. Nearly 157,000 customers of the UK-based telecom company TalkTalk had their personal details compromised, as reported by BBC News​​. This cyber-attack didn’t just breach customer accounts; it shook the foundation of trust between consumers and digital service providers.

The breach served as a crucial wake-up call for the telecommunications industry, emphasizing the need for robust cybersecurity strategies to protect sensitive customer data. It highlighted the ever-present risks in the digital world and the necessity for continuous improvement in security protocols to safeguard against such invasive attacks.

The examples of Heartland Payment Systems, Sony Pictures, Yahoo!, and TalkTalk illustrate the devastating effects of SQL Injection attacks, demonstrating their ability to compromise millions of data records and inflict substantial financial losses. These incidents highlight the critical need for robust cybersecurity measures and constant vigilance in the digital landscape. They serve as a reminder that cybersecurity is an ongoing challenge requiring continuous improvement and adaptation.

In light of these attacks, the importance of investing in reliable antivirus software, especially for users of Windows 11 , cannot be overstated. Brands like Norton , Avast , TotalAV , Bitdefender , McAfee , Panda , and Avira offer advanced security features that can significantly enhance your system’s defenses against such vulnerabilities.

These antivirus solutions provide real-time protection, regular updates, and specialized tools to detect and prevent SQL Injection and other forms of cyber threats. Investing in these security measures is not just a precaution; it’s an essential step towards safeguarding your digital assets and personal information in an increasingly interconnected world.

• Proofpoint.com
• Washingtonpost.com
• CSmonitor.com

Author: Tibor Moes

Founder & Chief Editor at SoftwareLab

Tibor has tested 39 antivirus programs and 30 VPN services , and holds a Cybersecurity Graduate Certificate from Stanford University.

He uses Norton to protect his devices, CyberGhost for his privacy, and Dashlane for his passwords.

You can find him on LinkedIn or contact him here .

Antivirus Comparisons

Best Antivirus for Windows 11 Best Antivirus for Mac Best Antivirus for Android Best Antivirus for iOS

Antivirus Reviews

Norton 360 Deluxe Bitdefender Total Security TotalAV Antivirus McAfee Total Protection

Burp Scanner

Burp Suite's web vulnerability scanner

Product comparison

What's the difference between Pro and Enterprise Edition?

Download the latest version of Burp Suite.

• Web Security Academy

SQL injection

In this section, we explain:

• What SQL injection (SQLi) is.
• How to find and exploit different types of SQLi vulnerabilities.
• How to prevent SQLi.

If you're familiar with the basic concepts behind SQLi vulnerabilities and want to practice exploiting them on some realistic, deliberately vulnerable targets, you can access labs in this topic from the link below.

• View all SQL injection labs

What is SQL injection (SQLi)?

SQL injection (SQLi) is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. This can allow an attacker to view data that they are not normally able to retrieve. This might include data that belongs to other users, or any other data that the application can access. In many cases, an attacker can modify or delete this data, causing persistent changes to the application's content or behavior.

In some situations, an attacker can escalate a SQL injection attack to compromise the underlying server or other back-end infrastructure. It can also enable them to perform denial-of-service attacks.

What is the impact of a successful SQL injection attack?

A successful SQL injection attack can result in unauthorized access to sensitive data, such as:

• Credit card details.
• Personal user information.

SQL injection attacks have been used in many high-profile data breaches over the years. These have caused reputational damage and regulatory fines. In some cases, an attacker can obtain a persistent backdoor into an organization's systems, leading to a long-term compromise that can go unnoticed for an extended period.

How to detect SQL injection vulnerabilities

You can detect SQL injection manually using a systematic set of tests against every entry point in the application. To do this, you would typically submit:

• The single quote character ' and look for errors or other anomalies.
• Some SQL-specific syntax that evaluates to the base (original) value of the entry point, and to a different value, and look for systematic differences in the application responses.
• Boolean conditions such as OR 1=1 and OR 1=2 , and look for differences in the application's responses.
• Payloads designed to trigger time delays when executed within a SQL query, and look for differences in the time taken to respond.
• OAST payloads designed to trigger an out-of-band network interaction when executed within a SQL query, and monitor any resulting interactions.

Alternatively, you can find the majority of SQL injection vulnerabilities quickly and reliably using Burp Scanner .

SQL injection in different parts of the query

Most SQL injection vulnerabilities occur within the WHERE clause of a SELECT query. Most experienced testers are familiar with this type of SQL injection.

However, SQL injection vulnerabilities can occur at any location within the query, and within different query types. Some other common locations where SQL injection arises are:

• In UPDATE statements, within the updated values or the WHERE clause.
• In INSERT statements, within the inserted values.
• In SELECT statements, within the table or column name.
• In SELECT statements, within the ORDER BY clause.

SQL injection examples

There are lots of SQL injection vulnerabilities, attacks, and techniques, that occur in different situations. Some common SQL injection examples include:

• Retrieving hidden data , where you can modify a SQL query to return additional results.
• Subverting application logic , where you can change a query to interfere with the application's logic.
• UNION attacks , where you can retrieve data from different database tables.
• Blind SQL injection , where the results of a query you control are not returned in the application's responses.

Retrieving hidden data

Imagine a shopping application that displays products in different categories. When the user clicks on the Gifts category, their browser requests the URL:

This causes the application to make a SQL query to retrieve details of the relevant products from the database:

This SQL query asks the database to return:

• all details ( * )
• from the products table
• where the category is Gifts
• and released is 1 .

The restriction released = 1 is being used to hide products that are not released. We could assume for unreleased products, released = 0 .

The application doesn't implement any defenses against SQL injection attacks. This means an attacker can construct the following attack, for example:

This results in the SQL query:

Crucially, note that -- is a comment indicator in SQL. This means that the rest of the query is interpreted as a comment, effectively removing it. In this example, this means the query no longer includes AND released = 1 . As a result, all products are displayed, including those that are not yet released.

You can use a similar attack to cause the application to display all the products in any category, including categories that they don't know about:

The modified query returns all items where either the category is Gifts , or 1 is equal to 1 . As 1=1 is always true, the query returns all items.

Take care when injecting the condition OR 1=1 into a SQL query. Even if it appears to be harmless in the context you're injecting into, it's common for applications to use data from a single request in multiple different queries. If your condition reaches an UPDATE or DELETE statement, for example, it can result in an accidental loss of data.

Subverting application logic

Imagine an application that lets users log in with a username and password. If a user submits the username wiener and the password bluecheese , the application checks the credentials by performing the following SQL query:

If the query returns the details of a user, then the login is successful. Otherwise, it is rejected.

In this case, an attacker can log in as any user without the need for a password. They can do this using the SQL comment sequence -- to remove the password check from the WHERE clause of the query. For example, submitting the username administrator'-- and a blank password results in the following query:

This query returns the user whose username is administrator and successfully logs the attacker in as that user.

Retrieving data from other database tables

In cases where the application responds with the results of a SQL query, an attacker can use a SQL injection vulnerability to retrieve data from other tables within the database. You can use the UNION keyword to execute an additional SELECT query and append the results to the original query.

For example, if an application executes the following query containing the user input Gifts :

An attacker can submit the input:

This causes the application to return all usernames and passwords along with the names and descriptions of products.

• SQL injection UNION attacks

Blind SQL injection vulnerabilities

Many instances of SQL injection are blind vulnerabilities. This means that the application does not return the results of the SQL query or the details of any database errors within its responses. Blind vulnerabilities can still be exploited to access unauthorized data, but the techniques involved are generally more complicated and difficult to perform.

The following techniques can be used to exploit blind SQL injection vulnerabilities, depending on the nature of the vulnerability and the database involved:

• You can change the logic of the query to trigger a detectable difference in the application's response depending on the truth of a single condition. This might involve injecting a new condition into some Boolean logic, or conditionally triggering an error such as a divide-by-zero.
• You can conditionally trigger a time delay in the processing of the query. This enables you to infer the truth of the condition based on the time that the application takes to respond.
• You can trigger an out-of-band network interaction, using OAST techniques. This technique is extremely powerful and works in situations where the other techniques do not. Often, you can directly exfiltrate data via the out-of-band channel. For example, you can place the data into a DNS lookup for a domain that you control.
• Blind SQL injection

Second-order SQL injection

First-order SQL injection occurs when the application processes user input from an HTTP request and incorporates the input into a SQL query in an unsafe way.

Second-order SQL injection occurs when the application takes user input from an HTTP request and stores it for future use. This is usually done by placing the input into a database, but no vulnerability occurs at the point where the data is stored. Later, when handling a different HTTP request, the application retrieves the stored data and incorporates it into a SQL query in an unsafe way. For this reason, second-order SQL injection is also known as stored SQL injection.

Second-order SQL injection often occurs in situations where developers are aware of SQL injection vulnerabilities, and so safely handle the initial placement of the input into the database. When the data is later processed, it is deemed to be safe, since it was previously placed into the database safely. At this point, the data is handled in an unsafe way, because the developer wrongly deems it to be trusted.

Examining the database

Some core features of the SQL language are implemented in the same way across popular database platforms, and so many ways of detecting and exploiting SQL injection vulnerabilities work identically on different types of database.

However, there are also many differences between common databases. These mean that some techniques for detecting and exploiting SQL injection work differently on different platforms. For example:

• Syntax for string concatenation.
• Batched (or stacked) queries.
• Platform-specific APIs.
• Error messages.

After you identify a SQL injection vulnerability, it's often useful to obtain information about the database. This information can help you to exploit the vulnerability.

You can query the version details for the database. Different methods work for different database types. This means that if you find a particular method that works, you can infer the database type. For example, on Oracle you can execute:

You can also identify what database tables exist, and the columns they contain. For example, on most databases you can execute the following query to list the tables:

• Examining the database in SQL injection attacks
• SQL injection cheat sheet

SQL injection in different contexts

In the previous labs, you used the query string to inject your malicious SQL payload. However, you can perform SQL injection attacks using any controllable input that is processed as a SQL query by the application. For example, some websites take input in JSON or XML format and use this to query the database.

These different formats may provide different ways for you to obfuscate attacks that are otherwise blocked due to WAFs and other defense mechanisms. Weak implementations often look for common SQL injection keywords within the request, so you may be able to bypass these filters by encoding or escaping characters in the prohibited keywords. For example, the following XML-based SQL injection uses an XML escape sequence to encode the S character in SELECT :

This will be decoded server-side before being passed to the SQL interpreter.

How to prevent SQL injection

You can prevent most instances of SQL injection using parameterized queries instead of string concatenation within the query. These parameterized queries are also know as "prepared statements".

The following code is vulnerable to SQL injection because the user input is concatenated directly into the query:

You can rewrite this code in a way that prevents the user input from interfering with the query structure:

You can use parameterized queries for any situation where untrusted input appears as data within the query, including the WHERE clause and values in an INSERT or UPDATE statement. They can't be used to handle untrusted input in other parts of the query, such as table or column names, or the ORDER BY clause. Application functionality that places untrusted data into these parts of the query needs to take a different approach, such as:

• Whitelisting permitted input values.
• Using different logic to deliver the required behavior.

For a parameterized query to be effective in preventing SQL injection, the string that is used in the query must always be a hard-coded constant. It must never contain any variable data from any origin. Do not be tempted to decide case-by-case whether an item of data is trusted, and continue using string concatenation within the query for cases that are considered safe. It's easy to make mistakes about the possible origin of data, or for changes in other code to taint trusted data.

• Find SQL injection vulnerabilities using Burp Suite's web vulnerability scanner

Register for free to track your learning progress

Practise exploiting vulnerabilities on realistic targets.

Record your progression from Apprentice to Expert.

See where you rank in our Hall of Fame.

Already got an account? Login here

Want to track your progress and have a more personalized learning experience? (It's free!)

Find SQL injection vulnerabilities using Burp Suite

This is a headline!

This is a subheadline!

This is a paragraph!

This is a banner!

• Resource Center

Application security

• How SQL injection attacks work: Examples and video walkthrough

Injection attacks are the number one web application security risk, according to the OWASP Top 10. Learn how they work and how you can defend against them in this walkthrough from Infosec Skills author John Wagnon .

How to prevent SQL injection

In this episode of Cyber Work Applied, John explains what a SQL injection attack is and walks through how easily an attacker could gain unauthorized access to a web application built upon insecure code.

Watch the full breakdown below of how the attack works:

New episodes of Cyber Work Applied are released every other week. Check out the full collection of free Cyber Work Applied training videos .

More Free Training Videos

SQL injection attack walkthrough

The edited transcript of the SQL injection attack walkthrough video is provided below, separated into each step John covers in the video.

How does an injection attack work?

(0:00–1:04) Have you ever heard of an injection attack? It's the number one critical security risk for web applications according to the OWASP Top 10 rankings. I'm Infosec Skills author John Wagnon, and I'm going to show you exactly why injection attacks are one of the most common and dangerous risks on the internet today.

When you access a website, you're actually accessing several different components and several different technologies. There's a web server that has text and pictures and forms and all those elements for the site that you're accessing. But in addition, there's almost always this database connected that's holding a lot of information related to that website. For example, a database might hold the names and addresses of users, or maybe even more sensitive information like medical data, credit card numbers or bank information.

Injection attacks happen when an attacker takes advantage of poorly written code that allows this attacker to gain access to the database containing those types of data that are intended to be protected.

How does SQL injection work?

(1:05-3:00) A SQL injection attack is a common type of injection attack. Remember that database we were just talking about? Well, a database uses a specific language to talk. It's called the Structured Query Language, or SQL, and that uses SQL to carry out these commands that make the database run.

SQL commands are used to do all kinds of things, like insert data, remove data, find data and manipulate that database, right? When a web application is written, if the code used to write it doesn't check things like manipulated SQL commands, then it could inadvertently allow a SQL command to run against the database and allow an attacker to gain access to that database or web application — and gain access to all the data stored in the database.

Here's an example. Let's say you have a web application that has a username and password combination that allows a user access to that website. Let's also say that the same web application has that database on the backend that stores usernames and passwords. When a user enters a username and password, a SQL query is created, and it's executed to search against that database to verify that the user is who they say they are. If the matching entries are found on the database, then the user is authenticated to the website.

But if the application doesn't do proper user input checks, then an attacker could come in and manipulate the username or the password field so that the resulting input creates this strange, yet valid SQL command. If the attacker uses the proper SQL syntax, then they could manipulate the database to return these "true" statements back to the web application. Then the web application would grant user access to that site.

A SQL injection attack example

(3:01-4:24) In this example, the username could be manipulated to be something like:

But what that does is it gets translated into a SQL command that might look something like:

SELECT * FROM users WHERE name=" or 1=1

So while this username looks really strange in the website login box, it looks completely valid to the database on the backend holding the username and password fields. The database is looking for a username that matches the input value the user supplied. If the values match, then the database returns a true response to the web application, and the application allows the user access to the web application.

In this specific case, the SQL command has been manipulated to tell the database to return a true statement, or a true response, as long as the username is either quote or as long as the statement one equals one is true. Of course there's no username that is a quote, right? But the logical statement one equals one is, of course, true. So the database would return a true response back to the web application.

And so now this user, or in fact, the attacker, would be granted access to the web application.

Other types of injection attacks

(4:24-4:57) SQL is not the only type of injection attack. You can also use this same approach for things like lightweight directory access protocol, or LDAP servers. The syntax is slightly different between LDAP and SQL, but the idea is exactly the same. You manipulate the user input so that the backend system will be tricked into granting access or spilling data that was intended to be protected.

These injection attacks lead to dozens of breaches every year where millions of records are compromised.

SQL injection prevention

(4:57-5:42) How do you defend against injection attacks, like the ones we've just talked about? Well, you should check all of your user input, using things like prepared statements or stored procedures. Essentially, you want to make sure that the user input coming into your web application is what you expect it to be. You can also implement things like the concept of least privilege, where you only allow users the minimum amount of access and permission to do their job.

You can see that injection attacks are really dangerous, but there are things you can do to stop them. That's why it's important that cybersecurity professionals should know how these attacks work and how they can mitigate them.

Check out my Infosec Skills learning path for the OWASP Top 10 to learn all about injection attacks and many more.

11 courses, 8+ hours of training

More free training videos

If you want more free training from John and other Infosec instructors, check out the Cyber Work Applied training series, where you'll learn:

• How to carry out man-in-the-middle attacks and watering hole attacks
• How to hack Wi-Fi and crack passwords
• How to use Wireshark for protocol analysis
• How cross-site scripting attacks work
• How to write a port scanner in Python
• And many more!

Jeff Peters is a communications professional with more than a decade of experience creating cybersecurity-related content. As the Director of Content and Brand Marketing at Infosec, he oversees the Infosec Resources website, the Cyber Work Podcast and Cyber Work Hacks series, and a variety of other content aimed at answering security awareness and technical cybersecurity training questions. His focus is on developing materials to help cybersecurity practitioners and leaders improve their skills, level up their careers and build stronger teams.

In this Series

DevSecOps: Moving from “shift left” to “born left”

What’s new in the OWASP Top 10 for 2023?

DevSecOps: Continuous Integration Continuous Delivery (CI-CD) tools

Introduction to DevSecOps and its evolution and statistics

• MongoDB (part 3): How to secure data
• MongoDB (part 2): How to manage data using CRUD operations
• MongoDB (part 1): How to design a schemaless, NoSQL database
• Understanding the DevSecOps Pipeline
• API Security: How to take a layered approach to protect your data
• How to find the perfect security partner for your company
• Security gives your company a competitive advantage
• 3 major flaws of the black-box approach to security testing
• Can bug bounty programs replace dedicated security testing?
• The 7 steps of ethical hacking
• Laravel authorization best practices and tips
• Learn how to do application security right in your organization
• How to use authorization in Laravel: Gates, policies, roles and permissions
• Is your company testing security often enough?
• Authentication vs. authorization: Which one should you use, and when?
• Why your company should prioritize security vulnerabilities by severity
• There’s no such thing as “done” with application security
• Understanding hackers: The insider threat
• Understanding hackers: The 5 primary types of external attackers
• Want to improve the security of your application? Think like a hacker
• 5 problems with securing applications
• Why you should build security into your system, rather than bolt it on
• Why a skills shortage is one of the biggest security challenges for companies
• How should your company think about investing in security?
• How to carry out a watering hole attack: Examples and video walkthrough
• How cross-site scripting attacks work: Examples and video walkthrough
• Securing the Kubernetes cluster
• How to run a software composition analysis tool
• How to run a SAST (static application security test): tips & tools
• How to run an interactive application security test (IAST): Tips & tools
• How to run a dynamic application security test (DAST): Tips & tools
• Introduction to Kubernetes security
• Key findings from ESG’s Modern Application Development Security report
• Microsoft’s Project OneFuzz Framework with Azure: Overview and concerns
• Software maturity models for AppSec initiatives
• Best free and open source SQL injection tools [updated 2021]
• Pysa 101: Overview of Facebook’s open-source Python code analysis tool
• Improving web application security with purple teams
• Open-source application security flaws: What you should know and how to spot them
• Android app security: Over 12,000 popular Android apps contain undocumented backdoors
• 13 common web app vulnerabilities not included in the OWASP Top 10
• Fuzzing, security testing and tips for a career in AppSec
• 14 best open-source web application vulnerability scanners [updated for 2020]
• 6 ways to address the OWASP top 10 vulnerabilities
• Ways to protect your mobile applications against hacking
• Introduction to the OWASP API Top Ten
• Secure Coding for .NET Training Boot Camp
• OWASP Top 10 Training Boot Camp
• CSIS Top 20 Critical Security Controls Training Boot Camp
• Secure Coding for C/C++ Training Boot Camp
• Mobile and Web Application Penetration Testing Training Boot Camp
• ISC2 CSSLP® Training Boot Camp
• Secure Coding in PHP Training Boot Camp
• Secure Coding for Java Training Boot Camp

Get free resources in your inbox!

• MyAccount sign in: manage your personal or Teams subscription >
• Cloud Console sign in: manage your cloud business products >
• Partner Portal sign in: management for Resellers and MSPs >

SQL injection

Cybercriminals use SQL injections to exploit software vulnerabilities in web applications and gain unauthorized access to your sensitive and valuable data.

.st0{fill:#0D3ECC;} DOWNLOAD MALWAREBYTES FOR FREE

Also for  Windows ,  iOS ,  Android ,  Chromebook  and  For Business

What is a SQL injection attack?

You may not know what a SQL injection (SQLI) attack is or how it works, but you definitely know about the victims. Target, Yahoo, Zappos, Equifax, Epic Games, TalkTalk, LinkedIn, and Sony Pictures—these companies were all hacked by cybercriminals using SQL injections.

A SQLI is a type of attack by which cybercriminals exploit software vulnerabilities in web applications for the purpose of stealing, deleting, or modifying data, or gaining administrative control over the systems running the affected applications.

Cybersecurity researchers regard the SQLI as one of the least sophisticated, easy-to-defend-against cyberthreats. Malwarebytes Labs ranked SQLI as number three in the The Top 5 Dumbest Cyber Threats that Work Anyway , citing the fact that SQLI is a known, predictable attack with easily implemented countermeasures.

SQLI attacks are so easy, in fact, attackers can find vulnerable websites using advanced Google searches, called Google Dorking . Once they’ve found a suitable target, SQLI attackers can use automated programs to effectively carry out the attack for them. All they have to do is input the URL of the target site and watch the stolen data roll in.

And yet SQLI attacks are commonplace and happen every day. In fact, if you have a website or online business, cybercriminals have likely tried using the SQLI to try and break into your website already. One study by the Ponemon Institute on The SQL Injection Threat & Recent Retail Breaches found that 65% of the businesses surveyed were victims of a SQLI-based attack.

Frequently targeted web applications include: social media sites, online retailers, and universities. Small-to-medium sized businesses are especially vulnerable as they are often not familiar with the techniques cybercriminals use in a SQLI attack and, likewise, don’t know how to defend against such an attack.

With that, let’s take the first step in defending against a SQL injection by educating ourselves on the topic. Here’s your primer on SQL injections.

“A SQLI is a type of attack by which cybercriminals exploit software vulnerabilities in web applications for the purpose of stealing, deleting, or modifying data, or gaining administrative control over the systems running the affected applications.”

How does a SQL injection work?

Developed in the early 70s, SQL (short for structured query language) is one of the oldest programming languages still in use today for managing online databases. These databases contain things like prices and inventory levels for online shopping sites. When a user needs to access database information, SQL is used to access and present that data to the user. But these databases can also contain more sensitive and valuable data like usernames and passwords, credit card information, and social security numbers. This is where SQL injections come into play.

Put simply, a SQL injection is when criminal hackers enter malicious commands into web forms, like the search field, login field, or URL, of an unsecure website to gain unauthorized access to sensitive and valuable data.

Here’s an example. Imagine going to your favorite online clothing site. You’re shopping for socks and you’re looking at a Technicolor world of colorful socks, all available with a click of your mouse. The wonders of technology! Every sock you see exists in a database on some server somewhere. When you find a sock you like and click on that sock, you’re sending a request to the sock database, and the shopping site responds with the information on the sock you clicked. Now imagine your favorite online shopping website is constructed in a slipshod manner, rife with exploitable SQL vulnerabilities.

A cybercriminal can manipulate database queries in such a way that a request for information about a pair of socks returns the credit card number for some unfortunate customer. By repeating this process over and over again, a cybercriminal can plumb the depths of the database and steal sensitive information on every customer that’s ever shopped at your favorite online clothing site—including you. Taking the thought experiment even further, imagine you’re the owner of this clothing site. You’ve got a huge data breach on your hands.

One SQLI attack can net cybercriminals personal information, emails, logins, credit card numbers, and social security numbers for millions of consumers. Cybercriminals can then turnaround and sell this personal info on the gloomiest corners of the dark web , to be used for all kinds of illegal purposes.

Stolen emails can be used for phishing and malspam attacks. Malspam attacks, in turn, can be used to infect victims with all kinds of destructive malware like ransomware , adware , cryptojackers , and Trojans (e.g. Emotet ), to name a few. Stolen phone numbers for Android and iOS mobile devices can be targeted with robocalls and text message spam.

Stolen logins from social networking sites can even be used to send message spam and steal even more logins for additional sites. Malwarebytes Labs previously reported on hacked LinkedIn accounts being used to spam other users with InMail messages containing bad URLs spoofed, or faked, to look like a Google Docs login page by which cybercriminals could harvest Google usernames and passwords.

“A cybercriminal can manipulate database queries in such a way that a request for information about a pair of socks returns the credit card number for some unfortunate customer.”

What is the history of SQL injections?

The SQL injection exploit was first documented in 1998 by cybersecurity researcher and hacker Jeff Forristal. His findings were published in the long running hacker zine Phrack. Writing under the moniker Rain Forest Puppy, Forristal explained how someone with basic coding skills could piggyback unauthorized SQL commands onto legitimate SQL commands and pull sensitive information out of the database of an unsecured website.

When Forristal notified Microsoft about how the vulnerability impacted their popular SQL Server product, they didn’t see it as a problem. As Forristal put it, “According to them [Microsoft], what you’re about to read is not a problem, so don’t worry about doing anything to stop it.”

What makes Microsoft’s lackadaisical response so shocking is many industries and institutions seriously depended (then and now) on the company’s database management technology to keep their operations running, including retail, education, healthcare, banking, and human resources. This leads us to the next event in the SQLI history timeline—the first major SQLI attack.

In 2007, the biggest convenience store chain in the United States, 7-Eleven, fell victim to a SQLI attack. The Russian hackers used SQL injections to hack into the 7-Eleven website and use that as a stepping stone into the convenience store’s customer debit card database. This allowed the hackers to then withdraw cash back home in Russia. All told, the culprits made off with two million dollars, as Wired magazine reported.

Not all SQLI attacks are motivated by greed. In another noteworthy example from 2007, cybercriminals used SQLI to gain administrative control over two US Army-related websites and redirect visitors to websites with anti-American and anti-Israeli propaganda.

The 2008 MySpace data breach ranks as one of the largest attacks on a consumer website. Cybercriminals stole emails, names, and partial passwords of almost 360 million accounts. And this is why we don’t reuse passwords from one site to the next.

The title for most egregious lack of security goes to Equifax. The 2017 Equifax data breach yielded extremely personal information (i.e., names, social security numbers, birth dates, and addresses) for 143 million consumers. For an organization that acts as the gatekeepers of information for every single American, except those living off the grid, you’d think they would take precautions against a basic SQLI attack. Before the data breach occurred, a cybersecurity research firm even warned Equifax they were susceptible to a SQLI attack, but the credit bureau took no action until it was too late.

In what ranks as the creepiest hack in history, a 2015 SQLI attack on toy manufacturer Vtech led to a breach of nearly five million parents and 200,000 children. Speaking with Motherboard, the online multimedia publication, the hacker responsible claimed they had no plans for the data and did not publish the data anywhere online. Conversely, the hacker also explained that the data was very easy to steal and someone else could have gotten to it first. Cold comfort indeed.

Moving forward to today, the SQLI attack is still a thing. Every three years the Open Web Application Security Project (OWASP) ranks the Top 10 Most Critical Web Application Security Risks. In the most recent 2017 edition , the SQLI attack ranked as number one.

Beyond the longevity of the SQLI attack, what’s interesting is that SQLI attacks haven’t changed or evolved in any way. SQLI attacks work and will continue to work until people change their attitudes about cybersecurity. Be that change.

News on SQL injections

• What is a honeypot? How they are used in cybersecurity
• Interview with a bug bounty hunter: Youssef Sammouda
• A zero-day guide for 2020: Recent attacks and advanced preventive techniques
• Vulnerabilities in financial mobile apps put consumers and businesses at risk
• How to secure your content management system
• Explained: SQL injection
• OWASP top ten – Boring security that pays off
• The top 5 dumbest cyber threats that work anyway

How do SQL Injections affect my business?

As reported in our Cybercrime Tactics and Techniques report , cyberattacks (of all kind) on businesses went up 55% in the second half of 2018, while attacks on individual consumers rose only 4%. The stats are not surprising. Businesses with crummy security present criminals with a soft target, holding a treasure trove of valuable data worth millions.

Conversely, a business at the center of a data breach can expect to pay out millions. An IBM study found the average cost of a data breach , including remediation and penalties, to be $3.86 million. The LinkedIn data breach mentioned previously ended up costing the business networking site $1.25 million in an out-of-court settlement.

After their data breach, Target was forced to pay the largest amount on record—$18.5 million—to settle investigations brought on by multiple states. This was in addition to the $10 million Target paid to settle a class action lawsuit brought on by consumers.

Granted, these are huge data breaches affecting millions of consumers. However, small-to-medium sized businesses can still expect to payout $148 for each stolen consumer record.

The moral of the story? Take your security seriously and avoid being a “Target” for cybercriminals.

How can I protect against SQL injections?

All this hand wringing aside, you’re here because you know SQL injections are a serious threat. Now, let’s do something about it. Here’s some tips for protecting your business against SQL injection attacks.

Update your database management software. Your software is flawed as it comes from the manufacturer. This is a fact. There’s no such thing as bug-free software. Cybercriminals can take advantage of these software vulnerabilities, or exploits, with a SQLI. You can protect yourself by just patching and updating your database management software.

Enforce the principle of least privilege (PoLP). PoLP means each account only has enough access to do its job and nothing more. For example, a web account that only needs read access to a given database shouldn’t have the ability to write, edit or change data in any way.

Use prepared statements or stored procedures. As opposed to dynamic SQL, prepared statements limit variables on incoming SQL commands. In this way, cybercriminals can’t piggyback malicious SQL injections onto legitimate SQL statements. Stored procedures similarly limit what cybercriminals are able to do by storing SQL statements on the database, which are executed from the web application by the user.

Hire competent, experienced developers. SQLI attacks often result from sloppy coding. Let your software developers know in advance what you expect as far as security is concerned.

What if my personal information was stolen in a data breach? You should take a look at our data breach checklist . There you’ll learn all about cleaning up and staying safe after a SQLI attack data breach impacts you.

Visit OWASP. The Open Web Application Security Project, OWASP for short, is the leading authority on web applications and they have lots of additional reading on how to prevent SQL injections .

And if you just can’t get enough SQL injection in your life, visit the Malwarebytes Labs blog for all the latest happenings in the world of cyberthreats and cybersecurity.

Select your language

A Comprehensive Study on SQL Injection Attacks, Their Mode, Detection and Prevention

• Conference paper
• First Online: 20 September 2021
• Cite this conference paper

• Sabyasachi Dasmohapatra 19 &
• Sushree Bibhuprada B. Priyadarshini 19  

Part of the book series: Advances in Intelligent Systems and Computing ((AISC,volume 1374))

1197 Accesses

1 Citations

SQL injection indicates the type of attack that exploits vulnerability and security prevailing in the database systems concerned with any application. This vulnerability is mostly encountered within web pages having dynamic contents. In this study, for any kind of vulnerability, we discuss the way how attackers of these types could get benefit out of such vulnerability and execute vulnerable codes along with the strategy to countermeasure such negative impacts associated with database systems. In this context, web operations are commonly employed for online administrations spanning from high range of informal communication to administering transaction accounts, while dealing with private user information which is confidential. However, the underlying problem is that, this information is vulnerable to attacks owing to unauthorized access, where the attackers avail access into the system through different hacking and cracking techniques with surprisingly negative intentions. The attacker can employ some more well-versed queries and some novel strategies to bypass the authentication while conjointly attaining complete control over the web application as well as the server. A lot of novel algorithms have been developed till now to encrypt data query for preventing such attacks by framing desired query change plan. In this paper, we will be collaborating on the background of injection attack, types of injection attack, various case studies and preventive measures associated with SQL injection attack along with a suitable illustration.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Subscribe and save.

• Get 10 units per month
• Download Article/Chapter or Ebook
• 1 Unit = 1 Article or 1 Chapter
• Cancel anytime
• Available as PDF
• Read on any device
• Instant download
• Own it forever
• Available as EPUB and PDF
• Compact, lightweight edition
• Dispatched in 3 to 5 business days
• Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Similar content being viewed by others

Understanding Query Vulnerabilities for Various SQL Injection Techniques

SQL Injection Attacks and Mitigation Strategies: The Latest Comprehension

SQL Injection Attacks, Detection Techniques on Web Application Databases

Shema, M. (2010). Seven Deadliest Web Application Attacks. Elsevier Inc., (pp. 47–69).

Google Scholar  

Halfond, W. G. J. & Orso, A. (2006). Preventing SQL injection attacks using Amnesia. In Presented at the Proceedings of the 28th international conference on Software engineering (ICSE), ACM , Shanghai, China, (vol. 11, pp. 795–798), May 20–28, (2006).

Alazab, A., & Khresiat, A. (2016) New strategy for mitigating of SQL injection attack. International Journal of Computer Applications (IJCA), 154 , 11.

Halfond, W. G., & Orso. A. (2005). Analysis and monitoring for neutralizing SQL-injection attacks. In Proceedings of the 20th IEEE/ACM International Conference on Automated Software Engineering .

Som, S., Sinha, S. & Kataria, R. (2016) Studyon SQL injection attacks mode, detection and prevention. International Journal of Engineering Applied Sciences and Technology(IJEAST), 1 (8), 212–220.

Dornseif, M. (2005). Common failures in internet applications. http://md.hudora.de/presentations/2005-common-failures/dornseif-common-failures-(2005-05-5).pdf .

Patel, N. (2015) Implementation of pattern matching algorithm to defend SQLIA/International Conference on Advanced Computing Technologies and Applications (ICACTA- 2015) / Procedia Computer Science 45, pp. 444–450, ( 2015 ) https://www.ptsecurity.com/ww-en/analytics/knowledge-base/how-to-prevent-sql-injection-attacks/ .

Andreu, A. (2006). Professional Pen Testing for Web Applications. Wrox, 2 , 113–120.

MathSciNet   Google Scholar  

Chris, A. (2010). Advanced SQL injection in SQL server applications, vol. 9, p. 2. http://www.nextgenss.com/papers/advanced_sql_injection.pdf (2002).

Stephen, J. F. (2005). SQL Injection attacks by example, vol. 3, pp. 3–5

Elmasri, R., & Navathe, S. B. (2011). Fundamentals of database systems (6th ed.). United States of America: Addison-Wesley.

MATH   Google Scholar  

Nithya, V., Regan, R, & Vijayaraghavan, J. (2013). A survey on SQL injection attacks, their detection and prevention techniques. International Journal Of Engineering And Computer Science (IJECS), 2 (4), 886–905.

Limei, M., et al. (2019). Research on SQL injection attack and prevention technology based on web. In International Conference on Computer Network, Electronic and Automation (pp. 176–179).

Su, G., et al. (2018) Research on SQL injection vulnerability attack model. In 5th IEEE International Conference on Cloud Computing and Intelligence System (pp. 217–221).

Download references

Author information

Authors and affiliations.

Siksha ‘O’ Anusandhan Deemed to be University, Bhubaneswar, India

Sabyasachi Dasmohapatra & Sushree Bibhuprada B. Priyadarshini

You can also search for this author in PubMed   Google Scholar

Editor information

Editors and affiliations.

Department of Computer Science Engineering, Maharaja Agrasen Institute of Technology, Rohini, Delhi, India

Deepak Gupta

Maharaja Agrasen Institute of Technology, Rohini, Delhi, India

Ashish Khanna

Institute of Engineering and Technology, Lucknow, Uttar Pradesh, India

Vineet Kansal

University of Calabria, Rende, Cosenza, Italy

Giancarlo Fortino

Department of Information Technology, Cairo University, Giza, Egypt

Aboul Ella Hassanien

Rights and permissions

Reprints and permissions

Copyright information

© 2022 The Author(s), under exclusive license to Springer Nature Singapore Pte Ltd.

About this paper

Cite this paper.

Dasmohapatra, S., Priyadarshini, S.B.B. (2022). A Comprehensive Study on SQL Injection Attacks, Their Mode, Detection and Prevention. In: Gupta, D., Khanna, A., Kansal, V., Fortino, G., Hassanien, A.E. (eds) Proceedings of Second Doctoral Symposium on Computational Intelligence . Advances in Intelligent Systems and Computing, vol 1374. Springer, Singapore. https://doi.org/10.1007/978-981-16-3346-1_50

Download citation

DOI : https://doi.org/10.1007/978-981-16-3346-1_50

Published : 20 September 2021

Publisher Name : Springer, Singapore

Print ISBN : 978-981-16-3345-4

Online ISBN : 978-981-16-3346-1

eBook Packages : Intelligent Technologies and Robotics Intelligent Technologies and Robotics (R0)

Share this paper

Anyone you share the following link with will be able to read this content:

Sorry, a shareable link is not currently available for this article.

Provided by the Springer Nature SharedIt content-sharing initiative

• Publish with us

Policies and ethics

• Find a journal
• Track your research

You are now being redirected to google.com....

Academia.edu no longer supports Internet Explorer.

To browse Academia.edu and the wider internet faster and more securely, please take a few seconds to  upgrade your browser .

Enter the email address you signed up with and we'll email you a reset link.

• We're Hiring!
• Help Center

CASE STUDY OF SQL INJECTION ATTACKS

Today, most of the web applications are associated with database at back-end so there are possibilities of SQL injection attacks (SQLIA) on it. A number of preventive measures have also been discovered by various researchers to overcome this attack, but which measure is more convenient and provides fast access to application without compromising the security is also a major concern nowadays. This paper provides a clear distinction among different types of SQLIAs and how these can be performed on local server. Also, demonstration of SQLIAs on live websites is provided for better understanding of URL attacks. Finally, a complete set of guidelines is provided to help understand the causes of various SQLIAs and how to detect them prior and their preventive measures for the developers of database-driven web applications and researchers.

Related Papers

Shubham Srivastava

Abstract—In this paper we present a detailed review on various types of SQL injection attacks and prevention technique for web application. Here we are presenting our findings from deep survey on SQL injection attack. This paper is consist of following five section:[1] ...

International journal of engineering research and technology

Pushkar Jane

The uses of web application has become increasingly popular in our daily life as reading news paper, reading magazines, making online payments for shopping etc. At the same time there is an increase in number of attacks that target them. In particular, SQL injection, a class of code injection attacks in which specially crafted input strings result in illegal queries to a database, has become one of the most serious threats to web applications. This paper proposes a novel specification-based methodology for the prevention of SQL injection Attacks. The two most important advantages of the new approach against existing analogous mechanisms are that, first, it prevents all forms of SQL injection attacks; second, Current technique does not allow the user to access database directly in database server. The innovative technique “Web Service Oriented XPATH Authentication Technique” is to detect and prevent SQL Injection Attacks in database the deployment of this technique is by generating f...

International Journal IJRITCC

— Web applications witnessed a rapid growth for online business and transactions are expected to be secure, efficient and reliable to the users against any form of injection attacks. SQL injection is one of the most common application layer attack techniques used today by hackers to steal data from organizations. It is a technique that exploits a security vulnerability occurring in the database layer of a web application. The attack takes advantage of poor input validation in code and website administration. It allows attackers to obtain illegitimate access to the backend database to change the intended application generated SQL queries.. In spite of the development of different approaches to prevent SQL injection, it still remains a frightening risk to web applications. In this paper, we present a detailed review on various types of SQL injection attacks, detection and prevention techniques, and their comparative analysis based on the performance and practicality.

International Journal of Advanced Computer Science and Applications

Chandershekhar Sharma

—The increasing innovations in web development technologies direct the augmentation of user friendly web applications. With activities like-online banking, shopping, booking, trading etc. these applications have become an integral part of everyone's daily routine. The profit driven online business industry has also acknowledged this growth because a thriving application provides the global platform to an organization. Database of web application is the most valuable asset which stores sensitive information of an individual and of an organization. SQLIA is the topmost threat as it targets the database on web application. It allows the attacker to gain control over the application ensuing financial fraud, leak of confidential data and even deleting the database. The exhaustive survey of SQL injection attacks presented in this paper is based on empirical analysis. This comprises the deployment of injection mechanism for each attack with respective types on various websites, dummy databases and web applications. The paramount security mechanism for web application database is also discussed to mitigate SQL injection attacks.

Proceedings of the 2010 2nd International Conference on Computational Intelligence Communication Systems and Networks

Atefeh Tajpour

International Journal of Scientific Research in Science and Technology

International Journal of Scientific Research in Science and Technology IJSRST

Web applications generally interact with backend information to retrieve persistent data and then present the information to the user as dynamically generated output, like HTML websites. This communication is commonly done through a low–level API by dynamically constructing query strings within a general-purpose programming language. SQL Injection Attack (SQLIA) is one of the very serious threats to web applications. This paper is a review on preventing technique for a SQL injection attack which can secure web applications against SQLimplantation. This paper also demonstrates a technique for preventing SQL Injection Attack (SQLIA) using Aho–Corasick pattern matching algorithm

Abhay Kolhe

jaydeep gheewala

Abstract—The Internet and web applications are playing very important role in our today‘s modern day life. Several activities of our daily life like browsing, online shopping and booking of travel tickets are becoming easier by the use of web applications. Most of the web applications use the database as a back-end to store critical information such as user credentials, financial and payment information, company statistics etc. An SQL injection attack targets web applications that are database-driven. This is done by including portions of SQL statements in a web form entry field in an attempt to get the website to pass a newly formed rogue SQL command to the database. Multiple client side and server side vulnerabilities like SQL injection and cross site scripting are discovered and exploited by malicious users. The principle of basic SQL injection is to take advantage of insecure code on a system connected to the internet in order to pass commands directly to a database and to then ...

International Journal of Engineering Research and Technology (IJERT)

IJERT Journal

https://www.ijert.org/a-sql-injection-internal-investigation-of-injection-detection-and-prevention-of-sql-injection-attacks https://www.ijert.org/research/a-sql-injection-internal-investigation-of-injection-detection-and-prevention-of-sql-injection-attacks-IJERTV3IS11133.pdf SQL Injection has been always as the top threat in any web site and web application. In this paper we are making a dummy web site and injecting some SQL queries, detecting the SQL injection using the IP tracking method, preventing SQL injection using different types of defense mechanism. We have made the dummy website to inject, detect and prevent the SQL injection attacks. We are also giving the internal view where it is required to explain these attacks, the detection and defense mechanism through the explanation of the source codes.

IJSRP Journal

Web applications are used by many users.web applications are consist of web forms, web server and backend. These applications are vulnerable due to attacks and scripts as the number of web application users are increasing. Web application can have sensitive and confidential data which is stored in database.web applications accepts the data from the users. This data is retrieved from the database through the queries.SQL Injection attack is one of the most popular attack used in system hacking or cracking. Using SQL INJECTION ATTACK attacker can gain information or have unauthorized access to the system. When attacker gains control over web application maximum damage is caused. This paper illustrates SQLIA methods and prevention and detection tools.

Loading Preview

Sorry, preview is currently unavailable. You can download the paper by clicking the button above.

RELATED PAPERS

The ISC International Journal of Information Security

ISECURE Journal

Njoku Donatus

Vishal Andodariya

2022 5th International Conference on Advances in Science and Technology (ICAST)

Varshil Shah , Tejas Sheth , Nikita Joshi

IRJET Journal

Santosh Soni

Tehnički glasnik

Tomislav Horvat

Journal of Computer and Communications

Yasser Fouad

Avinash Kumar Singh

Hương Trần Kim

International Journal of Advances in Computer Science and Technology

WARSE The World Academy of Research in Science and Engineering

Vinod Kannan

International Journal of Computer Applications

Pratik Adhikari

International Journal of Scientific & Technology Research

RANIAH ATTIATALLAH ALSAHAFI

Atul Shegokar

Wisdom Torgby

International Journal of Science and Research (IJSR)

Dhanashree Phalke

2012 International Conference on Communication Systems and Network Technologies

Rahul Johari

Suhaimi Ibrahim

2nd International Conference Recent Innovation in Science and Engginerring

Aniruddha Holey

Yash Tiwari

Ammar Alazab

•   We're Hiring!
•   Help Center
• Find new research papers in:
• Health Sciences
• Earth Sciences
• Cognitive Science
• Mathematics
• Computer Science
• Academia ©2024

• Advanced Search

SQL injection authentication security threat

New citation alert added.

This alert has been successfully added and will be sent to:

You will be notified whenever a record that you have chosen has been cited.

To manage your alert preferences, click on the button below.

New Citation Alert!

Please log in to your account

Information & Contributors

Bibliometrics & citations, view options, recommendations, a survey of detection methods for xss attacks.

Cross-site scripting attack (abbreviated as XSS) is an unremitting problem for the Web applications since the early 2000s. It is a code injection attack on the client-side where an attacker injects malicious payload into a vulnerable ...

Prevention of SQL Injection Attacks to Login Page of a Website Application using Prepared Statement Technique

The rise of digital transaction of different business and internet users for web service, mobile or desktop web application is increasing every day. Backend database is use to retrieved data for all web application and should be readily available for ...

Mitigation of SQL Injection Attacks using Threat Modeling

Day after day, SQL Injection (SQLI) attack is consistently proliferating across the globe. According to Open Web Application Security Project (OWASP) Top Ten Cheat Sheet-2014, SQLI is at top in the list of online attacks. The cause of spread of SQLI is ...

Information

Published in.

Inderscience Publishers

Geneva 15, Switzerland

Publication History

Author tags.

• web application
• vulnerabilities
• Research-article

Contributors

Other metrics, bibliometrics, article metrics.

• 0 Total Citations
• 0 Total Downloads
• Downloads (Last 12 months) 0
• Downloads (Last 6 weeks) 0

View options

Login options.

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Share this publication link.

Copying failed.

Share on social media

Affiliations, export citations.

• Please download or close your previous search result export first before starting a new bulk export. Preview is not available. By clicking download, a status dialog will open to start the export process. The process may take a few minutes but once it finishes a file will be downloadable from your browser. You may continue to browse the DL while the export process is in progress. Download
• Download citation
• Copy citation

We are preparing your search results for download ...

We will inform you here when the file is ready.

Your file of search results citations is now ready.

Your search export query has expired. Please try again.

Solutions By Industry

• Support Log-in
• Digital Risk Portal
• Email Fraud Defense
• ET Intelligence
• Proofpoint Essentials
• Sendmail Support Log-in
• English (Asia-Pacific)
• English (Americas)
• English (Europe, Middle East, Africa)

What Is SQL Injection (Structured Query Language)?

Table of contents, how an sql injection works, what are sql queries, types of sql injection, sql injection example, impacts of an sql injection attack, prevention and detection of sql injection attacks, how proofpoint can help.

SQL injection (often abbreviated as SQLi) is a cyber threat that targets applications that use SQL (Structured Query Language) databases. Attackers exploit vulnerabilities in an application’s code by injecting malicious SQL code into queries, enabling them to gain unauthorised access to a private database that may contain potentially valuable information.

An SQL injection attack can lead to various negative consequences, including data breaches , data corruption, and loss of system control. These cyber-attacks target any application that uses an SQL database, with websites being the most vulnerable and commonly exploited targets.

Cybersecurity Education and Training Begins Here

Here’s how your free trial works:.

• Meet with our cybersecurity experts to assess your environment and identify your threat risk exposure
• Within 24 hours and minimal configuration, we’ll deploy our solutions for 30 days
• Experience our technology in action!
• Receive report outlining your security vulnerabilities to help you take immediate action against cybersecurity attacks

Fill out this form to request a meeting with our cybersecurity experts.

Thank you for your submission.

SQL injection exploits the way an application interacts with its backend SQL database. Here’s a concise breakdown of how an SQL injection works:

• Query Construction : Applications often use SQL queries to interact with databases, typically retrieving or storing data. These queries might sometimes be constructed by concatenating, or connecting, strings, with parts of the string coming from user input.
• Malicious Input : If an application doesn’t handle user input correctly, an attacker can provide input with SQL code. Instead of the application recognising this input as regular data, the database executes it as part of the SQL query.
• Manipulated Queries : When the malicious input is concatenated into the SQL query, it changes the structure or intent of the query. This can allow an attacker to retrieve unauthorised data, bypass authentication, or even execute administrative operations on the database.

The success of an SQL injection attack largely depends on how the application constructs its SQL queries and how it handles user input. Proper measures to sanitise and validate input help prevent these vulnerabilities.

SQL is the standard programming language for managing data held in a relational database management system (RDBMS) or stream processing in a relational data stream management system (RDSMS). In simple terms, it’s the declarative programming language used to store, update, remove, search, and retrieve information from the database.

SQL queries are structured commands or instructions written in the Structured Query Language to interact with relational databases. These queries allow users to perform various operations on the data stored in a database, such as retrieving, inserting, updating, and deleting data.

SQL queries can execute a wide range of specific functions within a database, including:

• Retrieve data from a database
• Insert, update, or delete records in a database
• Create entirely new databases
• Build new tables in a database
• Establish stored procedures in a database
• Create views in a database
• Set permissions on tables, procedures, and views

SQL queries are specific commands structured as statements. They are aggregated into programmes that allow users to add, modify, or retrieve data from databases.

A few basic examples of SQL queries include:

• SELECT: Intended to retrieve data from tables. SELECT column1, column2 FROM tablename WHERE condition;
• INSERT INTO: Intended to insert new data into a table. INSERT INTO tablename (column1, column2) VALUES (value1, value2);
• UPDATE: Intended to modify existing data in a table. UPDATE tablename SET column1=value1 WHERE condition;

These are fundamental examples of SQL queries. With capabilities ranging from simple data retrieval to intricate data transformations and analytics, SQL is a powerful and versatile language that allows complex operations and manipulations of relational data.

SQL injection vulnerabilities arise when malicious SQL codes are interjected into input fields, influencing the subsequent SQL operations. These threats can be broadly segmented into three categories: In-band SQLi, Inferential SQLi, and Out-of-band SQLi.

1. In-band SQLi

This is the most prevalent and straightforward form of SQL injection. In-band SQLi allows the perpetrator to inject malicious code and receive feedback through the same medium. The two most common types of in-band SQL Injection are Error-based SQLi and Union-based SQLi.

Error-based SQLi

By manipulating queries, attackers extract valuable database information from the server’s error messages. Sometimes, this method can even map out the complete database.

Union-based SQLi

This technique hinges on the UNION SQL operator. Attackers merge results from multiple SELECT operations, and the combined data gets reflected in the application’s response.

2. Inferential SQLi

Inferential SQL Injection, unlike in-band SQL Injection, may take longer for an attacker to exploit, but it can still be very effective. In this type of attack, no data is actually transferred via the web application, and the attacker cannot see the result of an attack in-band (i.e., in the HTML of the application’s response). Alternatively, threat actors can reconstruct the database structure by sending payloads and observing the web application’s response and database server behaviour. The two primary forms of inferential SQLi are Blind-boolean-based SQLi and Blind-time-based SQLi.

Blind-boolean-based SQLi

Boolean-based SQL Injection works by submitting an SQL query to the database and forcing the application to produce a different response depending on whether the query returns TRUE or FALSE.

Blind-time-based SQLi

Time-based SQL Injection is an inferential SQL Injection technique that sends an SQL query to the database, forcing the application to wait for a specified amount of time (in seconds) before responding.

3. Out-of-band SQLi

Out-of-band SQL Injection is not very common, as it requires that the targeted database can connect back to the attacker’s machine. This type of SQL Injection occurs when an attacker cannot use the same channel to launch the attack and gather results. Instead, the attacker uses a different channel, such as an email, to launch the attack.

To recap, in-band SQLi is the most common and easy to exploit, while Inferential SQLi may take longer for an attacker to exploit but can still be very effective. Out-of-band SQLi is not very common, as it requires that the targeted database can connect back to the attacker’s machine.

While SQL injections can be elaborate attacks, this simplified example puts into perspective how they work.

Suppose there are two database tables, Users Logins and Customer Info. The table for User Logins has two fields for Username and Password. The Customer Info table has additional data, like First Name, Last Name, Address, Email, Phone Number, and Credit Card Number.

An attacker can insert malicious code into a login form to retrieve a user's username and password from the User Logins table. If the attacker enters the following code into the username field,

' OR 1=1 --

Then, the executed SQL statement will look like this:

SELECT * FROM Users WHERE username = '' OR 1=1 --' AND password = ''

The double hyphen at the end of the statement is used to comment out the remainder of the original SQL statement, which would have also checked the password.

The statement above will always return true because 1=1 is always true, and the double hyphen comments out the rest of the statement. As a result, the password check is ignored, and the attacker can log in without a valid password.

SQL injection attacks can have various consequences, depending on the attacker’s skills, intent, and the system’s vulnerability. When unauthorised access is achieved, the potential impacts of SQLi attacks include:

• Data Breach : One of the most immediate and damaging effects of SQLi is unauthorised access to the database’s records. Attackers can view sensitive information, such as user credentials, personal details, financial data, etc.
• Data Loss or Corruption : Malicious actors can modify, insert, and delete records, potentially causing loss of data integrity, rendering the data useless, or introducing false information.
• Denial of Service : By locking records, deleting tables, or otherwise disrupting the database, attackers can make the application unavailable to legitimate users.
• Database Server Takeover : Advanced SQLi attacks can result in attackers gaining control over the database server. In cases where the database server isn’t properly segregated from the rest of the network, this can be a steppingstone to further compromises.
• Remote Code Execution : Some database systems allow the execution of system-level commands through SQL. If an attacker discovers and exploits an SQLi vulnerability in such systems, they can potentially execute arbitrary commands on the server, leading to full system compromise.
• Data Exposure : Attackers can utilise SQLi to modify the application’s behaviour, potentially revealing confidential information that isn’t normally accessible to users.
• Identity Theft and Fraud : With access to personal and financial details, attackers can commit identity theft , unauthorised transactions, and other fraudulent activities.
• Reputational Damage : Beyond the direct technical implications, companies that fall victim to SQLi attacks risk severe reputational damage. Customers and partners might lose trust in a company’s ability to safeguard their data.
• Financial Consequences : Cleaning up after an SQLi attack can be costly. There might be expenses related to technical remediation, legal consultations, public relations efforts, compensating affected users, and potential fines for data protection regulation violations.
• Disclosure of Intellectual Property : Businesses may store proprietary algorithms, business plans, and other intellectual property in their databases. An SQLi attack can lead to the theft of this valuable data.

Understanding the potential impacts of SQLi underscores the importance of adopting secure coding practices, regular vulnerability assessments, and penetration testing to protect databases and applications from such threats.

Preventing and detecting SQL injection attacks requires a combination of secure coding, infrastructure hardening, monitoring, and education. Here are the best practices for SQL injection attack prevention and detection:

• Use Parameterised Queries (Prepared Statements) : Always use parameterised queries or prepared statements with SQL. This ensures that user input is always treated as data and never as executable code.
• Use Stored Procedures : By using stored procedures, you can abstract out and centralise the data access, limiting the exposure to raw SQL commands.
• ORM (Object-Relational Mapping) : Utilise ORMs as they often build on parameterised queries and reduce direct handling of raw SQL, but ensure the chosen ORM is secure against SQLi.
• Escape All User Input : If you must insert data into SQL queries directly, ensure all user input is escaped properly. This can be a backup measure, but it shouldn’t be the primary defence.
• Least Privilege Principle : Ensure that SQL database accounts used by web applications have the minimum necessary privileges. For example, a user account that retrieves data should not have insert or delete permissions.
• Web Application Firewalls (WAFs) : Deploy a WAF to filter and monitor HTTP traffic between the web application and the Internet. WAFs can block many injection attacks.
• Disable Verbose Error Messages : Ensure database error messages are generic and do not leak details about the database structure.
• Input Validation : Use a whitelist approach for input validation. Validate all user inputs against a set of strict rules (e.g., type, length, format, and range).
• Regularly Update and Patch : Regularly update database software, web application frameworks, and libraries to protect against known vulnerabilities.
• Regular Security Audits and Penetration Testing : Periodically conduct security audits and penetration testing to uncover and rectify potential vulnerabilities.
• SQL Query Monitoring : Monitor SQL queries executed against your database to detect unusual or unexpected queries that might indicate SQLi attempts.
• Error Monitoring : Monitor for unusual system or application error messages that might indicate attack attempts.
• Intrusion Detection Systems (IDS): Deploy IDS solutions to monitor and alert malicious activities.
• Log Monitoring and Analysis : Regularly review logs and use automated log analysis to detect signs of attacks.
• Database Integrity Checks : Regularly compare current database structures and contents against a known good backup or baseline to detect unauthorised modifications.
• Educate Developers and IT Staff : Ensure all team members know SQLi risks and prevention techniques.
• Honeypots : Deploy database honeypots to divert and study attackers, which can help detect new SQLi techniques.

Incorporating both prevention and detection mechanisms and maintaining a proactive security posture is essential to guard against SQL injection and other threats effectively.

Proofpoint provides industry-leading cybersecurity solutions that can help combat SQL injection attacks. Some of the company’s solutions in this arena include:

• Insider Threat Management (ITM) : Proofpoint’s comprehensive ITM solutions help organisations protect sensitive data from insider threats and data loss. It provides deep visibility into user activities, identifies user risk, detects insider-led data breaches, and accelerates security incident response.
• Advanced Threat Protection (ATP) : Proofpoint’s enhanced ATP service includes inline capabilities for stopping zero-day injection attacks.
• Emerging Threat Intelligence : Proofpoint’s emerging threat intelligence solutions provide visibility into the latest tactics, techniques, and procedures conducted by threat actors. With this intelligence, organisations can stay informed about the latest SQLi methodologies and adapt their defences accordingly.

Organisations that use these Proofpoint products enhance their security posture and protect their databases from SQL injection attacks. For more information, contact Proofpoint .

Related Resources

2023 update: the biggest & boldest data breaches & insider threats, protecting identities: how itdr complements edr and xdr to keep companies safer, ready to give proofpoint a try.

Start with a free Proofpoint trial.

An official website of the United States government

Here’s how you know

Official websites use .gov A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS A lock ( Lock A locked padlock ) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.

Free Cyber Services #protect2024 Secure Our World Shields Up Report A Cyber Issue

People’s Republic of China (PRC) Ministry of State Security APT40 Tradecraft in Action

This advisory, authored by the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC), the United States Cybersecurity and Infrastructure Security Agency (CISA), the United States National Security Agency (NSA), the United States Federal Bureau of Investigation (FBI), the United Kingdom National Cyber Security Centre (NCSC-UK), the Canadian Centre for Cyber Security (CCCS), the New Zealand National Cyber Security Centre (NCSC-NZ), the German Federal Intelligence Service (BND) and Federal Office for the Protection of the Constitution (BfV), the Republic of Korea’s National Intelligence Service (NIS) and NIS’ National Cyber Security Center, and Japan’s National Center of Incident Readiness and Strategy for Cybersecurity (NISC) and National Police Agency (NPA)—hereafter referred to as the “authoring agencies”—outlines a People’s Republic of China (PRC) state-sponsored cyber group and their current threat to Australian networks. The advisory draws on the authoring agencies’ shared understanding of the threat as well as ASD’s ACSC incident response investigations.

The PRC state-sponsored cyber group has previously targeted organizations in various countries, including Australia and the United States, and the techniques highlighted below are regularly used by other PRC state-sponsored actors globally. Therefore, the authoring agencies believe the group, and similar techniques remain a threat to their countries’ networks as well.

The authoring agencies assess that this group conduct malicious cyber operations for the PRC Ministry of State Security (MSS). The activity and techniques overlap with the groups tracked as Advanced Persistent Threat (APT) 40 (also known as Kryptonite Panda, GINGHAM TYPHOON, Leviathan and Bronze Mohawk in industry reporting). This group has previously been reported as being based in Haikou, Hainan Province, PRC and receiving tasking from the PRC MSS, Hainan State Security Department.[1]

The following Advisory provides a sample of significant case studies of this adversary’s techniques in action against two victim networks. The case studies are consequential for cybersecurity practitioners to identify, prevent and remediate APT40 intrusions against their own networks. The selected case studies are those where appropriate remediation has been undertaken reducing the risk of re-exploitation by this threat actor, or others. As such, the case studies are naturally older in nature, to ensure organizations were given the necessary time to remediate.

To download the PDF version of this report, visit the following link, APT40 Advisory .

Activity Summary

APT40 has repeatedly targeted Australian networks as well as government and private sector networks in the region, and the threat they pose to our networks is ongoing. The tradecraft described in this advisory is regularly observed against Australian networks.

Notably, APT40 possesses the capability to rapidly transform and adapt exploit proof-of-concept(s) (POCs) of new vulnerabilities and immediately utilize them against target networks possessing the infrastructure of the associated vulnerability. APT40 regularly conducts reconnaissance against networks of interest, including networks in the authoring agencies’ countries, looking for opportunities to compromise its targets. This regular reconnaissance postures the group to identify vulnerable, end-of-life or no longer maintained devices on networks of interest, and to rapidly deploy exploits. APT40 continues to find success exploiting vulnerabilities from as early as 2017.

APT40 rapidly exploits newly public vulnerabilities in widely used software such as Log4J ( CVE-2021-44228 ), Atlassian Confluence ( CVE-2021-31207 ,  CVE-2021-26084 ) and Microsoft Exchange ( CVE-2021-31207 ,  CVE-2021-34523 ,  CVE-2021-34473 ). ASD’s ACSC and the authoring agencies expect the group to continue using POCs for new high-profile vulnerabilities within hours or days of public release.

Figure 1: TTP Flowchart for APT40 activity

This group appears to prefer exploiting vulnerable, public-facing infrastructure over techniques that require user interaction, such as phishing campaigns, and places a high priority on obtaining valid credentials to enable a range of follow-on activities. APT40 regularly uses web shells [ T1505.003 ] for persistence, particularly early in the life cycle of an intrusion. Typically, after successful initial access APT40 focuses on establishing persistence to maintain access on the victim’s environment. However, as persistence occurs early in an intrusion, it is more likely to be observed in all intrusions—regardless of the extent of compromise or further actions taken.

Notable Tradecraft

Although APT40 has previously used compromised Australian websites as command and control (C2) hosts for its operations, the group have evolved this technique [ T1594 ].

APT40 has embraced the global trend of using compromised devices, including small-office/home-office (SOHO) devices, as operational infrastructure and last-hop redirectors [ T1584.008 ] for its operations in Australia. This has enabled the authoring agencies to better characterize and track this group’s movements.

Many of these SOHO devices are end-of-life or unpatched and offer a soft target for N-day exploitation. Once compromised, SOHO devices offer a launching point for attacks that is designed to blend in with legitimate traffic and challenge network defenders [ T1001.003 ].

This technique is also regularly used by other PRC state-sponsored actors worldwide, and the authoring agencies consider this to be a shared threat. For additional information, see joint advisories People’s Republic of China State-Sponsored Cyber Actors Exploit Network Providers and Devices and PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure .

APT40 does occasionally use procured or leased infrastructure as victim-facing C2 infrastructure in its operations; however, this tradecraft appears to be in relative decline.

ASD’s ACSC are sharing some of the malicious files identified during the investigations outlined below. These files have been uploaded to VirusTotal to enable the wider network defense and cyber security communities to better understand the threats they need to defend against.

Case Studies

ASD’s ACSC are sharing two anonymized investigative reports to provide awareness of how the actors employ their tools and tradecraft.

Case Study 1

This report has been anonymized to enable wider dissemination. the impacted organization is hereafter referred to as “the organization.” some specific details have been removed to protect the identity of the victim and incident response methods of asd’s acsc., executive summary.

This report details the findings of the ASD’s ACSC investigation into the successful compromise of the organization’s network between July and September 2022. This investigative report was provided to the organization to summarize observed malicious activity and frame remediation recommendations. The findings indicate the compromise was undertaken by APT40.

In mid-August, the ASD’s ACSC notified the organization of malicious interactions with their network from a likely compromised device being used by the group in late August and, with the organization’s consent, the ASD’s ACSC deployed host-based sensors to likely affected hosts on the organization’s network. These sensors allowed ASD’s ACSC incident response analysts to undertake a thorough digital forensics investigation. Using available sensor data, the ASD’s ACSC analysts successfully mapped the group’s activity and created a detailed timeline of observed events.

From July to August, key actor activity observed by the ASD’s ACSC included:

• Host enumeration, which enables an actor to build their own map of the network;
• Web shell use, giving the actor an initial foothold on the network and a capability to execute commands; and
• Deployment of other tooling leveraged by the actor for malicious purposes.

The investigation uncovered evidence of large amounts of sensitive data being accessed and evidence that the actors moved laterally through the network [ T1021.002 ]. Much of the compromise was facilitated by the group’s establishment of multiple access vectors into the network, the network having a flat structure, and the use of insecure internally developed software that could be used to arbitrarily upload files. Exfiltrated data included privileged authentication credentials that enabled the group to log in, as well as network information that would allow the actors to regain unauthorized access if the original access vector was blocked. No additional malicious tooling was discovered beyond those on the initially exploited machine; however, a group’s access to legitimate and privileged credentials would negate the need for additional tooling. Findings from the investigation indicate the organization was likely deliberately targeted by APT40, as opposed to falling victim opportunistically to a publicly known vulnerability.

Investigation Findings

In mid-August 2022, the ASD’s ACSC notified the organization that a confirmed malicious IP believed to be affiliated with a state-sponsored cyber group had interacted with the organization’s computer networks between at least July and August. The compromised device probably belonged to a small business or home user.

In late August, the ASD’s ACSC deployed a host-based agent to hosts on the organization’s network which showed evidence of having been impacted by the compromise.

Some artefacts which could have supported investigation efforts were not available due to the configuration of logging or network design. Despite this, the organization’s readiness to provide all available data enabled ASD’s ACSC incident responders to conduct comprehensive analysis and to form an understanding of likely APT40 activity on the network.

In September, after consultation with the ASD’s ACSC, the organization decided to denylist the IP identified in the initial notification. In October, the organization commenced remediation.

Beginning in July, actors were able to test and exploit a custom web application [ T1190 ] running on <webapp>2-ext , which enables the group to establish a foothold in the network demilitarized zone (DMZ). This was leveraged to enumerate both the network as well as all visible domains. Compromised credentials [ T1078.002 ] were used to query the Active Directory [ T1018 ] and exfiltrate data by mounting file shares [ T1039 ] from multiple machines within the DMZ. The actor carried out a Kerberoasting attack in order to obtain valid network credentials from a server [ T1558.003 ]. The group were not observed gaining any additional points of presence in either the DMZ or the internal network.

Visual Timeline

The below timeline provides a broad overview of the key phases of malicious actor activity observed on the organization’s network.

Detailed Timeline

July: The actors established an initial connection to the front page of a custom web application [ T1190 ] built for the organization (hereafter referred to as the “web application” or “ webapp ”) via a transport layer security (TLS) connection [ T1102 ]. No other noteworthy activity was observed.

July: The actors begin enumerating the web application’s website looking for endpoints[2] to further investigate.

July: The actors concentrate on attempts to exploit a specific endpoint.

July: The actors are able to successfully POST to the web server, probably via a web shell placed on another page. A second IP, likely employed by the same actors, also begins posting to the same URL. The actors created and tested a number of likely web shells. 

The exact method of exploitation is unknown, but it is clear that the specific endpoint was targeted to create files on  <webapp>2 -ext .

ASD's ACSC believes that the two IP address connections were part of the same intrusion due to their shared interest and initial connections occurring minutes apart.

July: The group continue to conduct host enumeration, looking for privilege escalation opportunities, and deploying a different web shell. The actors log into the web application using compromised credentials for  <firstname.surname> @ <organisation domain> .

The actors’ activity does not appear to have successfully achieved privilege escalation on  <webapp>2 -ext . Instead, the actors pivoted to network-based activity.

July:  The actor tests the compromised credentials for a service account[3] which it likely found hardcoded in internally accessible binaries.

July: The actors deploy the open-source tool Secure Socket Funnelling, which was used to connect out to the malicious infrastructure. This connection is employed to tunnel traffic from the actor's attack machines into the organization’s internal networks, whose machine names are exposed in event logs as they attempt to use the credentials for the service account.

August: The actors are seen conducting a limited amount of activity, including failing to establish connections involving the service account.

August: The actors perform significant network and Active Directory enumeration. A different compromised account is subsequently employed to mount shares[4] on Windows machines within the DMZ, enabling successful data exfiltration.

This seems to be opportunistic usage of a stolen credential on mountable machines in the DMZ. Firewalls blocked the actor from targeting the internal network with similar activity.

August – September: The SSF tool re-established a connection to a malicious IP. The group are not observed performing any additional activities until their access is blocked.

September: The organization blocks the malicious IP by denylisting it on their firewalls.

Actor Tactics and Techniques

The MITRE ATT&CK framework is a documented collection of tactics and techniques employed by threat actors in cyberspace. The framework was created by U.S. not-for-profit The MITRE Corporation and functions as a common global language around threat actor behavior.

The ASD’s ACSC assesses the following techniques and tactics to be relevant to the actor’s malicious activity:

Reconnaissance

T1594 – Search Victim-Owned Websites

The actor enumerated the custom web application’s website to identify opportunities for accessing the network.

Initial Access

T1190 – Exploit Public-Facing Application (regarding exploiting the custom web application)

T1078.002 – Valid Accounts: Domain Accounts (regarding logging on with comprised credentials)

Exploiting internet-exposed custom web applications provided an initial point of access for the actor. The actor was later able to use credentials they had compromised to further their access to the network.

T1059 – Command and Scripting Interpreter (regarding command execution through the web shell)

T1072 – Software Deployment Tools (regarding the actor using open-source tool Secure Socket Funnelling (SSF) to connect to an IP)

Persistence

T1505.003 – Server Software Component: Web Shell (regarding use of a web shell and SSF to establish access)

Credential Access

T1552.001 – Credentials from Password Stores (regarding password files relating to building management system [BMS])

T1558.003 – Steal or Forge Kerberos Tickets: Kerberoasting (regarding attack to gain network credentials)

Lateral movement

T1021.002 – Remote Services: SMB Shares (regarding the actor mounting SMB shares from multiple devices)

T1213 – Data from Information Repositories (regarding manuals/documentation found on the BMS server)

Exfiltration

T1041 – Exfiltration Over C2 Channel (regarding the actor’s data exfiltration from Active Directory and mounting shares)

Case Study 2

This report details the findings of ASD’s ACSC investigation into the successful compromise of the organization’s network in April 2022. This investigation report was provided to the organization to summarize observed malicious activity and frame remediation recommendations. The findings indicate the compromise was undertaken by APT40.

In May 2022, ASD’s ACSC notified an organization of suspected malicious activity impacting the organization’s network since April 2022. Subsequently, the organization informed ASD's ACSC that they had discovered malicious software on an internet‑facing server which provided the login portal for the organization’s corporate remote access solution. This server used a remote access login and identity management product and will be referred to in this report as 'the compromised appliance'. This report details the investigation findings and remediation advice developed for the organization in response to the investigation conducted by the ASD’s ACSC.

Evidence indicated that part of the organization’s network had been compromised by malicious cyber actor(s) via the organization’s remote access login portal since at least April 2022. This server may have been compromised by multiple actors, and was likely affected by a remote code execution (RCE) vulnerability that was widely publicized around the time of the compromise.

Key actor activity observed by the ASD’s ACSC included:

• Exploitation of internet-facing applications and web shell use, giving the actor an initial foothold on the network and a capability to execute commands;
• Exploitation of software vulnerabilities to escalate privileges; and
• Credential collection to enable lateral movement.

The ASD’s ACSC discovered that a malicious actor had exfiltrated several hundred unique username and password pairs on the compromised appliance in April 2022, as well as a number of multi-factor authentication codes and technical artefacts related to remote access sessions. Upon a review by the organization, the passwords were found to be legitimate. The ASD’s ACSC assesses that the actor may have collected these technical artefacts to hijack or create a remote login session as a legitimate user, and access the organization’s internal corporate network using a legitimate user account.

Investigation Summary

The ASD’s ACSC determined that the actor compromised appliance(s) which provide remote login sessions for organization staff and used this compromise to attempt to conduct further activity. These appliances consist of three load-balanced hosts where the earliest evidence of compromise was detected. The organization shut down two of the three load-balanced hosts shortly after the initial compromise. As a result, all subsequent activity occurred on a single host. The other servers associated with the compromised appliance were also load-balanced in a similar manner. For legibility, all compromised appliances are referred to in most of this report as a “single appliance.”

The actor is believed to have used publicly known vulnerabilities to deploy web shells to the compromised appliance from April 2022 onwards. Threat actors from the group are assessed to have attained escalated privileges on the appliance. The ASD’s ACSC could not determine the full extent of the activity due to lack of logging availability. However, evidence on the device indicates that an actor achieved the following:

• The collection of several hundred genuine username and password pairs; and
• The collection of technical artefacts which may have allowed a malicious actor to access a virtual desktop infrastructure (VDI) session as a legitimate user.

The ASD’s ACSC assesses that the actor would have sought to further the compromise of the organisation network. The artefacts exfiltrated by the actor may have allowed them to hijack or initiate virtual desktop sessions as a legitimate user, possibly as a user of their choice, including administrators. The actor may have used this access vector to further compromise organization services to achieve persistence and other goals.

Other organization appliances within the hosting provider managed environment did not show evidence of compromise.

The host with the compromised appliance provided authentication via Active Directory and a webserver, for users connecting to VDI sessions [ T1021.001 ].

The appliance infrastructure also included access gateway hosts that provide a tunnel to the VDI for the user, once they possess an authentication token generated and downloaded from the appliance.

There was no evidence of compromise of any of these hosts. However, the access gateway hosts logs showed evidence of significant interactions with known malicious IP addresses. It is likely that this reflected activity that occurred on this host, or network connections with threat actor infrastructure that reached this host. The nature of this activity could not be determined using available evidence but indicates that the group sought to move laterally in the organization’s network [ TA0008 ].

Internal Hosts

The ASD’s ACSC investigated limited data from the internal organization’s network segment. Attempted or successful malicious activity known to have impacted the internal organization’s network segment includes actor access to VDI-related artefacts, the scraping of an internal SQL server [ T1505.001 ], and unexplained traffic observed going from known malicious IP addresses through the access gateway appliances [ TA0011 ].

Using their access to the compromised appliance, the group collected genuine usernames, passwords [ T1003 ], and MFA token values [ T1111 ]. The group also collected JSON Web Tokens (JWTs) [ T1528 ], which is an authentication artefact used to create virtual desktop login sessions. The actor may have been able to use these to create or hijack virtual desktop sessions [ T1563.002 ] and access the internal organization network segment as a legitimate user [ T1078 ].

The actor also used access to the compromised appliance to scrape an SQL server [ T1505.001 ], which resided in the organization’s internal network. It is likely that the actor had access to this data.

Evidence available from the access gateway appliance revealed that network traffic occurred through or to this device from known malicious IP addresses. As described above, this may indicate that malicious cyber actors impacted or utilized this device, potentially to pivot into the internal network.

Investigation Timeline

The below list provides a timeline of key activities discovered during the investigation.

Highlighted below are several tactics and techniques identified during the investigation.

Initial access

T1190  Exploit public facing application

The group likely exploited RCE, privilege escalation, and authentication bypass vulnerabilities in the remote access login and identity management product to gain initial access to the network.

This initial access method is considered the most likely due to the following:

• The server was vulnerable to these CVEs at the time;
• Attempts to exploit these vulnerabilities from known actor infrastructure; and
• The first known internal malicious activity occurred shortly after attempted exploitation attempts were made.

T1059.004  Command and Scripting Interpreter: Unix Shell

The group successfully exploited the above vulnerabilities may have been able to run commands in a Unix shell available on the affected appliance.

Complete details of the commands run by actors cannot be provided as they were not logged by the appliance.

T1505.003  Server Software Component: Web Shell

Actors deployed several web shells on the affected appliance. It is possible that multiple distinct actors deployed web shells, but that only a smaller number of actors conducted activity using these web shells.

Web shells would have allowed for arbitrary command execution by the actor on the compromised appliances.

Privilege escalation

T1068  Exploitation for Privilege Escalation

Available evidence does not describe the level of privilege attained by actors. However, using web shells, the actors would have achieved a level of privilege comparable to that of the web server on the compromised appliance. Vulnerabilities believed to have been present on the compromised appliance

would have allowed the actors to attain root privileges.

Credential access

T1056.003  Input Capture: Web Portal Capture

Evidence on the compromised appliance showed that the actor had captured several hundred username-password pairs, in clear text, which are believed to be legitimate. It is likely that these were captured using some modification to the genuine authentication process which output the credentials to a file.

T1111  Multi-Factor Authentication Interception The actor also captured the value of MFA tokens

corresponding to legitimate logins. These were likely captured by modifying the genuine authentication process to output these values to a file. There is no evidence of compromise of the “secret server’ which stores the unique values that provide for the security of MFA tokens.

T1040  Network Sniffing

The actor is believed to have captured JWTs by capturing HTTP traffic on the compromised appliance. There is evidence that the utility tcpdump was executed on the compromised appliance, which may have been how the actor captured these JWTs.

T1539  Steal Web Session Cookie

As described above, the actor captured JWTs, which are analogous to web session cookies. These could have been reused by the actor to establish further access.

T1046  Network Service Discovery

There is evidence that network scanning utility nmap was executed on the compromised appliance to scan other appliances in the same network segment. This was likely used by the actor to discover other reachable network services which might present opportunities for lateral movement.

Available evidence does not reveal how actors collected data or exactly what was collected from the compromised appliance or from other systems. However, it is likely that actors had access to all files on the compromised appliance, including the captured credentials [ T1003 ], MFA token values [ T1111 ], and JWTs described above.

Command and Control

T1071.001  Application Layer Protocol: Web Protocols

Actors used web shells for command and control. Web shell commands would have been passed over HTTPS using the existing web server on the appliance [ T1572 ].

T1001.003  Data Obfuscation: Protocol Impersonation

Actors used compromised devices as a launching point for attacks that are designed to blend in with legitimate traffic.

Detection and mitigation recommendations

The ASD’s ACSC strongly recommends implementing the ASD  Essential Eight  Controls and associated  Strategies to Mitigate Cyber Security Incidents . Below are recommendations for network security actions that should be taken to detect and prevent intrusions by APT40, followed by specific mitigations for four key TTPs summarized in Table 1.

Some of the files identified above were dropped in locations such as C:\Users\Public\* and C:\Windows\ Temp\*. These locations can be convenient spots for writing data as they are usually world writable, that is, all user accounts registered in Windows have access to these directories and their subdirectories. Often, any user can subsequently access these files, allowing opportunities for lateral movement, defense evasion, low-privilege execution and staging for exfiltration.

The following Sigma rules look for execution from suspicious locations as an indicator of anomalous activity. In all instances, subsequent investigation is required to confirm malicious activity and attribution.

Mitigations

During ASD’s ACSC investigations, a common issue that reduces the effectiveness and speed of investigative efforts is a lack of comprehensive and historical logging information across a number of areas including web server request logs, Windows event logs and internet proxy logs.

ASD’s ACSC recommends reviewing and implementing their guidance on  Windows Event Logging and Forwarding  including the configuration files and scripts in the  Windows Event Logging Repository  and the Information Security Manual’s  Guidelines for System Monitoring , to include centralizing logs and retaining logs for a suitable period.

Patch Management

Promptly patch all internet exposed devices and services, including web servers, web applications, and remote access gateways. Consider implementing a centralized patch management system to automate and expedite the process. ASD’s ACSC recommend implementation of the ISM’s  Guidelines for System Management , specifically, the System Patching controls where applicable.

Most exploits utilized by the actor were publicly known and had patches or mitigations available.

Organizations should ensure that security patches or mitigations are applied to internet facing infrastructure within 48 hours, and where possible, use the latest versions of software and operating systems.

Network Segmentation

Network segmentation can make it significantly more difficult for adversaries to locate and gain access to an organizations sensitive data. Segment networks to limit or block lateral movement by denying traffic between computers unless required. Important servers such as Active Directory and other authentication servers should only be able to be administered from a limited number of intermediary servers or “jump servers.” These servers should be closely monitored, be well secured and limit which users and devices are able to connect to them.

Regardless of instances identified where lateral movement is prevented, additional network segmentation could have further limited the amount of data the actors were able to access and extract.

Additional Mitigations

The authoring agencies also recommend the following mitigations to combat APT40 and others’ use of the TTPs below.

• Disable unused or unnecessary network services, ports and protocols.
• Use well-tuned Web application firewalls (WAFs) to protect webservers and applications.
• Enforce least privilege to limit access to servers, file shares, and other resources.
• Web and cloud-based email;
• Collaboration platforms;
• Virtual private network connections; and
• Remote desktop services.
• Replace end-of-life equipment.

For additional general detection and mitigation advice, please consult the Mitigations and Detection sections on the MITRE ATT&CK technique web page for each of the techniques identified in the MITRE ATT&CK summary at the end of this advisory.

Australian organizations: visit cyber.gov.au or call 1300 292 371 (1300 CYBER 1) to report cybersecurity incidents and to access alerts and advisories.

Canadian organizations: report incidents by emailing CCCS at [email protected] .

New Zealand organizations: report cyber security incidents to [email protected] or call 04 498 7654.

United Kingdom organizations: report a significant cyber security incident at National Cyber Security Centre (monitored 24 hours) or, for urgent assistance, call 03000 200 973.

U.S. organizations: report incidents and anomalous activity to CISA 24/7 Operations Center at [email protected] or (888) 282-0870 and/or to the FBI via your local FBI field office, the FBI’s 24/7 CyWatch at (855) 292-3937, or [email protected] . When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment used for the activity; the name of the submitting company or organization; and a designated point of contact.

The information in this report is being provided “as is” for informational purposes only. The authoring agencies do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this document. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favoring by the authoring agencies.

MITRE ATT&CK – Historical APT40 Tradecraft of Interest

[1] U.S. Department of Justice. 2021.  Four Chinese Nationals Working with the Ministry of State Security Charged with Global Computer Intrusion Campaign Targeting Intellectual Property and Confidential Business Information, Including Infectious Disease Research. [2] In this context, an endpoint is a function of the web application. [3] Service accounts are not tied to individual users, but rather to services. In a Microsoft corporate domain, there are various kinds of accounts. [4] Mounting shares is the process of making files on a file system structure accessible to a user or user group.

This product is provided subject to this  Notification  and this  Privacy & Use  policy.

Please share your thoughts

We recently updated our anonymous product survey ; we’d welcome your feedback.

Related Advisories

Cisa red team’s operations against a federal civilian executive branch organization highlights the necessity of defense-in-depth, #stopransomware: black basta, #stopransomware: akira ransomware, #stopransomware: phobos ransomware.

• Partnership
• Information
• Pricing Plan
• About DQLab
• Daftar / Masuk

AI untuk Deteksi SQL Injection untuk Keamanan Database

SQL Injection mungkin terdengar seperti istilah teknis yang rumit, tapi sebenarnya ini adalah salah satu ancaman paling umum dan berbahaya bagi database. Pada dasarnya, SQL Injection adalah teknik yang digunakan oleh hacker untuk menyusup ke dalam sistem database melalui celah keamanan di aplikasi. Mereka bisa mencuri data penting, merusak database, atau bahkan mengambil alih kendali penuh.

Jadi, bagaimana kita bisa melindungi diri dari ancaman ini? Jawabannya adalah dengan menggunakan teknologi terbaru seperti Artificial Intelligence (AI) untuk mendeteksi dan mencegah SQL Injection secara otomatis.

Dengan kemajuan teknologi, AI telah membuka banyak peluang baru dalam berbagai bidang, termasuk keamanan database. Bayangkan, sebuah sistem yang bisa memonitor aktivitas database secara real-time, mendeteksi anomali, dan menghentikan serangan sebelum mereka bisa merusak. Ini bukan lagi sekedar impian, tetapi kenyataan yang bisa diwujudkan dengan AI.

Mari kita jelajahi bagaimana AI bisa membantu menjaga keamanan database kita dari ancaman SQL Injection.

1. Pengertian SQL Injection

SQL Injection adalah metode yang digunakan hacker untuk mengakses atau merusak database dengan memasukkan perintah SQL berbahaya melalui input yang seharusnya aman. Misalnya, dalam formulir login, jika input pengguna tidak divalidasi dengan benar, hacker bisa memasukkan kode yang mengubah perintah SQL asli. Ini memungkinkan mereka untuk mendapatkan akses tidak sah, melihat data pribadi, atau bahkan menghapus data penting.

Baca juga : Bootcamp Data Analyst with SQL and Python

2. Dampak Serangan SQL Injection

Serangan SQL Injection bisa memiliki dampak yang merusak bagi organisasi. Data yang dicuri bisa mencakup informasi pribadi pengguna, data keuangan, atau informasi rahasia perusahaan. Selain itu, hacker bisa merusak atau menghapus data, yang bisa mengakibatkan hilangnya informasi penting dan gangguan operasional. Kerugian finansial dan reputasi perusahaan juga bisa terjadi akibat serangan semacam ini.

3. Peran AI dalam Deteksi SQL Injection

AI memiliki potensi besar dalam mendeteksi SQL Injection. Algoritma machine learning dapat dilatih untuk mengenali pola-pola anomali dalam aktivitas database. AI dapat memantau query SQL yang masuk dan membandingkannya dengan pola yang dikenal sebagai aman atau mencurigakan. Dengan demikian, AI bisa memberikan peringatan dini atau bahkan menghentikan query berbahaya sebelum merusak database.

4. Keunggulan Menggunakan AI

Menggunakan AI untuk deteksi SQL Injection memiliki beberapa keunggulan. Pertama, AI dapat bekerja secara real-time, memberikan respons cepat terhadap serangan. Kedua, AI dapat belajar dan beradaptasi dengan ancaman baru, sehingga semakin lama semakin efektif dalam mendeteksi serangan. Ketiga, AI bisa bekerja tanpa henti, memberikan perlindungan 24/7 yang lebih handal dibandingkan pengawasan manusia.

5. Masa Depan Integrasi AI dalam Keamanan SQL

Masa depan keamanan SQL dengan AI sangat cerah. Integrasi AI diharapkan akan menjadi standar dalam sistem keamanan database. Dengan kemampuan AI yang terus berkembang, deteksi dan pencegahan serangan SQL Injection akan menjadi lebih efektif dan efisien. Selain itu, AI juga bisa digunakan untuk menganalisis log aktivitas dan memberikan wawasan tentang potensi celah keamanan lainnya.

Baca juga : Catat! Ini 3 Keuntungan Belajar SQL dalam Mengolah Data

Kamu juga nggak perlu bingung lagi jika ingin belajar dari mana tentang SQL dari nol. DQLab menyediakan berbagai modul berkualitas yang cocok bagi para pemula yang ingin belajar belajar data, dengan platform pembelajaran online dengan fitur Live Code Editor dan Ask AI Chatbot juga bisa kamu coba disini.

Selain itu, ada juga Bootcamp Data Analyst with SQL and Python dengan bimbingan para mentor profesional secara langsung menggunakan metode HERO yaitu Hands-On, Experiential Learning & Outcome-based, yang terbukti efektif mencetak ratusan talenta unggulan yang sukses berkarier di bidang data.

Tentunya kamu juga akan dilatih dengan real study case untuk menambah portofolio datamu. Jadi tunggu apa lagi? Yuk, buruan sign up di DQLab untuk informasi selengkapnya!

Postingan Terkait

Menangkan kompetisi bisnis dengan machine learning, pentingnya machine learning dalam industri bisnis, mulai karier sebagai praktisi data bersama dqlab.

Daftar sekarang dan ambil langkah pertamamu untuk mengenal Data Science .

Sudah punya akun? Login

Modal Title