Anti SQL Injection (I tried everything but Havij still picks up)

Asked

Viewed 667 times

2

Hello! I’m going through a rough patch, I’ve tried ALL the techniques I found on the Internet that can stop SQL Injection, and yet Havij can get my data.

This is the code of the page I’m making the attack on:

$id = mysql_real_escape_string($_GET['id']);

$sql = $id;
$sql = preg_replace(sql_regcase("/(from|select|insert|delete|where|drop table|show tables|or|=|#|\*|--|\\\\)/"),"",$sql);
$sql = trim($sql);
$sql = strip_tags($sql);
$sql = addslashes($sql);
$id = $sql;
$id = intval($id);

// Connect to the database
$mysqli     = new mysqli($MySQL_HOST, $MySQL_USER, $MySQL_USER_PASS, $MySQL_DB) or die("Erro ao conectar ao bando de dados");   

// Prepare the query
$sql        = $mysqli->prepare('SELECT autor, noticia, data, titulo, tipo, logo FROM noticias WHERE id = ?') or die("erro ao preparar consulta");

// Bind the parameter, i --> int, datatype of column
$sql->bind_param('i', $id);

// Execute SQL
$sql->execute() or die("erro ao executar consulta");

$sql->bind_result($autor, $noticia, $data, $titulo, $tipo, $imagem);

$sql->fetch();

$sql->close();

I’ve even tried to take the direct parameter of the sql query, replacing it with a fixed number. I’ve tried to take out the search line, take out the connection line, and even BOTH! The site doesn’t even work but havij attacks like crazy! There’s no logic to it! And to make matters worse, I activated the sql logs thinking that he could be taking the connection alone and sending the prompts by himself or another page, and all the answer I have is that he does half a dozen searches on the table with the id 999999, nothing different. Now as a program grabs my entire database with half a dozen Selects in a nonexistent id? inserir a descrição da imagem aqui

sql sql-injection

  • If you take the connection line, there is no way the tool can inject SQL through that page. She may have saved her access data from a previous attempt that worked.

  • Your SQL log should not be picking up all queries. Try using a different SQL monitor and monitor! Try changing the database password in case it has your connection data.

1 answer

1

If you want to try to avoid even more an Injection sql, try using a "stored Procedure", so mysql will accept any sql code as a variable, regardless of what is typed.

My specialty is oracle, and at least in my case the vulnerabilities fall a lot when using a stored Procedure. In the case of Oracle, I use a NUMERIC parameter, equivalent to the INT for input and a SYS_REFCURSOR parameter, which would be the query as output. Since Procedure expects an integer as a parameter, it will give error in the Procedure if an sql is inserted and the function will return a failure. It seems to me that Mysql does not need this SYS_REFCURSOR and returns the query as result without needing the output variable

Browser other questions tagged sql sql-injection

You are not signed in. Login or sign up in order to post.