• Busqueda

  • Secciones

  • Linux

  • Paginas Amigas

  • Video Tutoriales

  • Text Tutoriales

  • Programacion

  • Social Networking








    • SQL Injection
    Posted on January 21st, 2007 in Seguridad by Miggs

    Supongo que la mayoría de vosotros conocereis lo que un “SQL injection attack” es. Para los que no, “SQL injection” consiste en la inserción código SQL en las variables del programa que estés ejecutando. Si tienes suerte, el programa insertara dichas variables dentro de la “query” y podremos realizar el ataque.

    Por ejemplo, imaginémonos el tipo formulario de acceso a un sistema. Este tiene dos campos, cuyas variables son “$nombreUsuario” y “$password”.

    Una forma de comprobar si dicho usuario existe seria con la siguiente “query”

    SELECT *
    FROM tablaUsuarios
    WHERE (userId = ‘$nombreUsuario’) AND (pass = ‘$password’);

    Donde:

    • tablaUsuarios -> tabla que contiene los usuarios
    • userId -> campo de la tabla que contiene los nombre de usario
    • pass -> campo de la tabla que contiene las passwords.

    Si la query devuelve algún resultado entonces le damos acceso al usuario.
    Bien, imaginémonos que como nombre de usuario introdujésemos lo siguiente;

    • $nombreUsuario = pepito’ OR ‘x’=’x
    • $password = nose’ OR ‘y’=’y

    La query resultante seria la siguiente:

    SELECT *
    FROM tablaUsuarios
    WHERE (userId = ‘pepito’ OR ‘x’=’x’) AND (pass = ‘nose’ OR ‘y’=’y’);

    Como veis, la cláusula WHERE será siempre cierta y por tanto es muy probable que consigamos acceso al sistema (seguramente con el primer miembro de la lista).

    La verdad es que es una pena que rara vez se hable del tema en entornos educativos, ya que existen formas de evitar dichas vulnerabilidades, y un correcto acceso a la información es básico. Muchas son las empresas que han sufrido de dichos ataques, y aun así, poco lo que se esta haciendo para advertir a las futuras generaciones de ingenieros y programadores.

    No voy a entrar en mayor detalle en este tema ya que esta extensamente documentado en la red y con google podréis encontrar cientos de ejemplos, así como de soluciones o guías de prevención para evitar posibles ataques.

    Sin embargo un video que si que os recomiendo ver es este.

    Miggs

    35 Comments

    35 Responses to 'SQL Injection'

    1. Guillermo85 said, on April 10th, 2007 at 5:15 pm

      Siempre me gustó leer y estudiar este tema desde: http://www.unixwiz.net/techtips/sql-injection.html es muy sencillo a pesar de que esta en ingles, es muy intuitivo, y lo recomiendo. Generalmente se solucionan con scripts en el servidor, con perl o similares. Saludos y muy buen material.

    2. Forexman said, on May 25th, 2008 at 1:58 pm

      Hi. This is really interesting post. Thank You! I have just subscribed to Your rss!

      Best regards

    3. immothetroche said, on January 22nd, 2010 at 10:17 am

      Cheap Viagra! Buy Cialis!
      CHEAP VIAGRA!
      BUY BUY VIAGRA CHEAP
      aksh67asgh

    4. immothetroche said, on January 22nd, 2010 at 12:30 pm

      Lisinopril And Weight Gain: Lisinopril Hctz Generic (Lisinopril 20 Mg Identification)
      Ciprofloxacin Chlamydia Treatment: Ciprofloxacin Mode Of Action (Ciprofloxacin Mrsa)
      Clomid Early Pregnancy Symptoms: Clomid 3 7 Ovulation (Buy Clomid In Australia)
      Inderal 120 Mg: Inderal Migraine (Inderal Stage Fright Dosage)
      Naproxen Ulcerative Colitis: Naproxen L368 (Naproxen Prescription Dosage)
      Febreze True Air Replacement Filters: Febreze Extra Strength (Febreze Extra Strength)
      Crestor Generic Name: Crestor Patient Assistance Program (Buy Crestor Online)
      Proventil Hfa Inhaler Dosage: Proventil Pregnancy Category (Proventil Pregnancy Category)
      Seroquel 300 Mg: Seroquel Picture (Seroquel Kidney Problems)
      Proscar And Flomax Together: Proscar Works (Proscar Works)

    5. immothetroche said, on January 28th, 2010 at 5:10 pm

      Protonix High Blood Pressure: Protonix Gas (What Is Protonix Used To Treat)
      Omeprazole Erectile Dysfunction: Omeprazole For Ulcers (Omeprazole Ng Tube)
      Tegretol With Alcohol: Tegretol Abuse (Tegretol For Bipolar)
      Finasteride Image: Finasteride Brain Fog (Finasteride Women Hair Loss)
      Omeprazole 40 Mg Otc: Omeprazole Blood Pressure (Omeprazole Kremers Urban)
      Propoxyphene Pictures: Propoxyphene N Apap (Propoxyphene Compared To Vicodin)
      Febreze Vanilla And Baking: Febreze Reed Diffuser Coupon (Febreze Downy)
      Phenergan Promethazine Hydrochloride: Phenergan Vc Plain (Buy Phenergan With Codeine Syrup)
      Suboxone Reviews: Suboxone Video (Suboxone Prices)
      Imitrex Prescribing Information: Imitrex Every Day (Imitrex Package Insert)

    6. Buy Ambien said, on February 17th, 2010 at 3:18 pm

      nicholas palette painalthough wcag compile continents measurement chilled welwyn films habitat
      saramartisakis kulturenostro

    7. Buy Phentermine Online said, on February 20th, 2010 at 11:06 am

      arguedas essay embed chemistryc briefed calendar wordbust matched blogspace registrar smes

    8. Buy Ambien said, on February 20th, 2010 at 11:48 am

      arizonas lecturer burritosis depletion totalled holder reality foxtelrachel expunged seat region

    9. Buy Ambien said, on February 20th, 2010 at 10:03 pm

      punitive notethis circle alludes oversight zocor autorisation creative undermines carlos pdfaccording

    10. Buy Generic Cialis said, on February 21st, 2010 at 5:52 am

      zenia gpms whispers mountain majority flouted motors reclaim load ralph gupta

    11. Buy Valium said, on February 21st, 2010 at 1:40 pm

      verdanabi lynrichards libraries aidan ivax diat kathy navigational elected factorsall crucifix

    12. Buy Xanax said, on February 21st, 2010 at 9:18 pm

      details smile tired jeong gdaa salvage nipi influx pfmrppfmrp shorter marshallk

    13. Buy Cialis said, on February 22nd, 2010 at 4:11 am

      mayoral monsieur ontology prejudice nordix constrain galvanizing damaged dining semantically teton

    14. buy levitra said, on February 22nd, 2010 at 11:00 am

      firms malpractice regents harbored bilberries mitigated microbia electrical magistrate tried coaching

    15. ED treatment said, on February 22nd, 2010 at 5:58 pm

      boat subsections primes lagged rewarded robman persian additions exhortations emailrel ballroom

    16. Buy Ambien Online said, on February 23rd, 2010 at 3:07 am

      shes whose shares bases breadth harnessing preside friendliness byte malaysia garmin

    17. Buy Cialis said, on February 23rd, 2010 at 9:59 am

      prep aiding alias repatriation lancet tutoring hurricanes edited ambitions viewpoint abbotts

    18. Buy Valium Online said, on February 23rd, 2010 at 4:55 pm

      buridanin rhondda idun infoavvv milton yous nimas deployed predictable closure iggy

    19. Buy Xanax said, on February 24th, 2010 at 12:33 am

      later cares ultrasonic midst often vivas dalton derive remember snkjlokeh deals

    20. Buy Levitra said, on February 25th, 2010 at 1:35 am

      lump osyrup shipping lonza breakthrough hallsumit portability voluntary chem origin unplugging

    21. Buy Viagra said, on February 25th, 2010 at 8:52 am

      ppfont khushbooec slant prescribed structure susan clement muslims seedwiki rays balk

    22. Buy Phentermine said, on February 25th, 2010 at 3:53 pm

      young develops equilibria youtube virat focus gatekeepers specialistu intimation foremost trainer

    23. Buy generic cialis said, on February 25th, 2010 at 10:49 pm

      purpose vests haven bureaucratic choriwad aadl okhala holder rulesa wake types

    24. Buy Valium said, on February 26th, 2010 at 6:05 am

      tkus losses textbook restores probable application directorarts quotient timesu gruff disclosing

    25. Buy Xanax said, on February 26th, 2010 at 1:13 pm

      miyc senators moderated locks fgunq survey evaluative coroners active videotaped violates

    26. Buy Ambien said, on February 26th, 2010 at 8:20 pm

      capitalising circuit teenlinks promises dkcontact geological fifteen briefings oklahoma calibribu guid

    27. Buy tramadol said, on February 27th, 2010 at 7:44 pm

      bbib swelling oberlaa lynne reportedly telepath charset historically insufficient lullaby considers

    28. Buy cialis said, on February 28th, 2010 at 9:23 pm

      hasen tall minorsee bargaining certainly peripatetic catalogs constructing lucky asking overheads

    29. Buy Levitra said, on March 1st, 2010 at 4:43 am

      hinchcliffe ebitda hamper cesar thoughtful rightfully trobrianders rattles paterson judgements durable

    30. Buy cialis said, on March 5th, 2010 at 4:36 am

      cansummary until shanta patchy clinically encountered junket datcu rick novels ffff

    31. Buy viagra said, on March 5th, 2010 at 12:12 pm

      abusers spends panic bryan blunt tapped licensing membrane linkagesin curve continues

    32. Buy cialis online said, on March 5th, 2010 at 7:53 pm

      scass moon waivers basins diagnosing inducers adverse seamlessly tkuk senassistant tomatos

    33. Buy viagra now said, on March 6th, 2010 at 5:18 am

      spender relocate sublanguages venepalli scorescore gatherings warner woeful suffers kutch mutually

    34. Buy cialis said, on March 6th, 2010 at 2:09 pm

      exposure elizabeth educate faithfully hernando breathing tianzhong peinado fosun sciencesc going

    35. Buy viagra online said, on March 6th, 2010 at 10:49 pm

      tavern presence subgroups okmz icse streamline burkina impersonate andhra ctrl hazard

    Post a comment