DOCSLIB.ORG

Prevention of SQL Injection Attacks Using AWS WAF Mohammed Kareem St

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Prevention of SQL Injection Attacks Using AWS WAF Mohammed Kareem St St. Cloud State University theRepository at St. Cloud State Culminating Projects in Information Assurance Department of Information Systems 5-2018 Prevention of SQL Injection Attacks using AWS WAF Mohammed Kareem St. Cloud State University, [email protected] Follow this and additional works at: https://repository.stcloudstate.edu/msia_etds Recommended Citation Kareem, Mohammed, "Prevention of SQL Injection Attacks using AWS WAF" (2018). Culminating Projects in Information Assurance. 47. https://repository.stcloudstate.edu/msia_etds/47 This Starred Paper is brought to you for free and open access by the Department of Information Systems at theRepository at St. Cloud State. It has been accepted for inclusion in Culminating Projects in Information Assurance by an authorized administrator of theRepository at St. Cloud State. For more information, please contact [email protected]. Prevention of SQL Injection Attacks using AWS WAF by Mohammed Abdul Kareem A Starred Paper Submitted to the Graduate Faculty of St. Cloud State University in Partial Fulfillment of the Requirements for the Degree of Master of Science in Information Assurance May 2018 Starred Paper Committee: Susantha Herath, Chairperson Dien D. Phan Balasubramanian Kasi 2 Abstract SQL injection is one of several different types of code injection techniques used to attack data driven applications. This is done by the attacker injecting an input in the query not intended by the programmer of the application gaining the access of the database which results in potential reading, modification or deletion of users’ data. The vulnerabilities are due to the lack of input validation which is the most critical part of software security that is often not properly covered in the design phase of the software development lifecycle. This paper presents different techniques and some of the countermeasures for detection and prevention of SQL injection attacks. The proposed procedure in the paper is to use a database firewall between the client (user) side and the database server through AWS to avoid the malicious codes injected by the attackers. 3 Table of Contents List of Tables ................................................................................................................... 6 List of Figures .................................................................................................................. 7 Chapter I: Introduction ..................................................................................................... 8 Introduction ........................................................................................................... 8 Problem Statement ............................................................................................... 9 Nature and Significance of the Problem ............................................................... 9 Web Application Environment............................................................................. 10 Objective of the Research .................................................................................. 12 SQL Injection Attack Overview ........................................................................... 12 Applications Vulnerable to SQL Injection ............................................................ 14 Summary ............................................................................................................ 16 Chapter II. Background and Literature Review .............................................................. 17 Introduction ......................................................................................................... 17 Literature Related to the Problem ....................................................................... 18 Literature Related to the Methodology ................................................................ 20 Types of SQL Injection Attacks........................................................................... 21 Tautologies ......................................................................................................... 21 Illegal or Logically Incorrect Queries ................................................................... 22 Union Query ....................................................................................................... 24 Piggy-Backed Queries ........................................................................................ 25 Stored Procedures .............................................................................................. 26 4 Inference ............................................................................................................ 28 Blind Injection ..................................................................................................... 29 Timing Attacks .................................................................................................... 29 Alternate Encodings ........................................................................................... 31 Main Causes of SQL Injection ............................................................................ 33 Detection and Prevention Techniques ................................................................ 35 Injection Detection at the Web Tier ..................................................................... 39 Summary ............................................................................................................ 40 Chapter III. Methodology ............................................................................................... 41 Introduction ......................................................................................................... 41 Design of the Study ............................................................................................ 42 Data Analysis ...................................................................................................... 44 Summary ............................................................................................................ 45 Chapter IV: Analysis of Results ..................................................................................... 46 Introduction ......................................................................................................... 46 Data Presentation ............................................................................................... 47 Compute ............................................................................................................. 47 Storage ............................................................................................................... 49 Security .............................................................................................................. 51 Networking.......................................................................................................... 52 Data Analysis ...................................................................................................... 52 Overview for IPv4 ............................................................................................... 57 5 Overview for IPv6 ............................................................................................... 58 Create a VPC ..................................................................................................... 64 Template 1.......................................................................................................... 69 Create an Amazon S3 Bucket ............................................................................ 76 Template 2.......................................................................................................... 76 Summary ............................................................................................................ 80 Chapter V: Conclusions and Future Work ..................................................................... 81 Results ............................................................................................................... 81 Conclusion .......................................................................................................... 82 Future Work ........................................................................................................ 82 References .................................................................................................................... 83 6 List of Tables 4.1 Routing for IPv4 ................................................................................................................... 60 4.2 Routing for IPv6 ...................................................................................................... 61 4.3 Security for IPv4 ...................................................................................................... 62 4.4 Security for IPv6 ...................................................................................................... 64 7 List of Figures 1.1 Web Application Firewall .................................................................................................... 10 1.2 Web Tier Environment............................................................................................. 11 1.3 SQL Injection Attack Overview ................................................................................ 14 3.1 AWS WAF Architecture ........................................................................................... 43 4.1 Configure Instance Details .....................................................................................
Load more

Recommended publications
  • ITEE Journal
    Volume 3, Issue 6 ISSN: - 2306-708X December 201 4 ITEE Jo urnal Information Technology & Electrical Engineering ©2012-14 International Journal of Information Technology and Electrical Engineering Malware Contaminated Website Detection by Scanning Page Links 1 Mehdi Dadkhah, 2 Amin Dadkhah, 3 Jie Deng 1 Lecturer of Tiran Branch, Islamic Azad University, Isfahan, Iran. 2 Student of Tiran Branch, Islamic Azad University, Isfahan, Iran. 3 Queen Mary University London, London, UK. E-mail: [email protected], [email protected], 3 [email protected] ABSTRACT With increasing growth of communication networks, social interactions and financial transactions have been migrate to virtual environments. Internet is one of the most substantial platform for most people's social interactions and transactions. However, the notable challenge in online transactions is security in cyber environments and to understand the hazards accompanied with this communication platform. Because of the increased use of Internet and virtual environments in daily affairs such as financial transactions, this platform has become the focus of attackers and swindlers, for example the stealing of users' passwords. In this paper, we introduce main methods which attackers use to contaminate websites by malware. Even though several articles have been written on the subject, our main goal is introducing the advanced type of these frauds conducted by professional attackers which includes contaminating websites by any kind of malware like using phishing attacks, security vulnerability in web, social engineering and click hijacking. Finally we present our approach for confronting frauds conducted by installing spyware by contaminated websites attack and malware behavior. Keywords: Online fraud, cyber environment, phishing, web vulnerability, spyware.
    [Show full text]
  • Best Practices: Use of Web Application Firewalls
    OWASP Papers Program Best Practice: Use of Web Application Firewalls Best Practices: Use of Web Application Firewalls Version 1.0.4, March 2008, English translation 25. May 2008 Author: OWASP German Chapter with collaboration from: Maximilian Dermann Mirko Dziadzka Boris Hemkemeier Achim Hoffmann Alexander Meisel Matthias Rohr Thomas Schreiber OWASP Papers Program Best Practice: Use of Web Application Firewalls Abstract Web applications of all kinds, whether online shops or partner portals, have in recent years increasingly become the target of hacker attacks. The attackers are using methods which are specifically aimed at exploiting potential weak spots in the web application software itself – and this is why they are not detected, or are not detected with sufficient accuracy, by traditional IT security systems such as network firewalls or IDS/IPS systems. OWASP develops tools and best practices to support developers, project managers and security testers in the development and operation of secure web applications. Additional protection against attacks, in particular for already productive web applications, is offered by what is still a emerging category of IT security systems, known as Web Application Firewalls (hereinafter referred to simply as WAF), often also called Web Application Shields or Web Application Security Filters. One of the criteria for meeting the security standard of the credit card industry currently in force (PCI DSS - Payment Card Industry Data Security Standard v.1.1) for example, is either a regular source code review or the use of a WAF. The document is aimed primarily at technical decision-makers, especially those responsible for operations and security as well as application owners (specialist department, technical application managers) evaluating the use of a WAF.
    [Show full text]
  • Protecting Against the Top 5 Attack Vectors Stay Secure from the Most Common Threats Seen by Arctic Wolf’S Security Team
    Protecting Against the Top 5 Attack Vectors Stay secure from the most common threats seen by Arctic Wolf’s security team ©2019 Arctic Wolf Networks, Inc. All rights reserved. | Public PERSONAL | PREDICTABLE | PROTECTION CONTENTS Major Cyberattacks in the News ......................................................................................................................................3 The Top 5 Attack Vectors ...................................................................................................................................................4 The Cyber Kill Chain .............................................................................................................................................................7 Protecting Against the Top 5 Attacks Malware/Ransomware ....................................................................................................................................8 Phishing Attack ...................................................................................................................................................9 PUP/Adware ..................................................................................................................................................... 10 Account Hijacking ........................................................................................................................................... 11 Unpatched/Outdated Software .................................................................................................................
    [Show full text]
  • SQL Injection Authored By: Stephanie Reetz, SOC Analyst
    TLP: WHITE Technical White Paper January 2013 SQL Injection Authored by: Stephanie Reetz, SOC Analyst INTRODUCTION Web applications are everywhere on the Internet. Almost everything you do online is done through a web application whether you know it or not. They come in the form of web-based email, forums, bulletin boards, bill payment, recruitment systems, health benefit and payroll systems. It is important to understand that these types of websites are all database driven. Databases are an essential element of web applications because they are able to store user preferences, personal identifiable information, and other sensitive user information Web applications interact with databases to dynamically build customized content for each user. The web application communicates with the database using Structured Query Language (SQL). SQL is a programming language for managing databases that allows you to read and manipulate data in MySQL, SQL Server, Access, Oracle, DB2, and other database systems. The relationship between the web application and the database is commonly abused by attackers through SQL injection. SQL injection is a type of injection attack in which SQL commands are supplied in user-input variables, such as a web form entry field, in an attempt to trick the web application into executing the attacker's code on the database. SQL injection was one of the primary attack vectors responsible for many of 2011’s high profile compromises including Sony Pictures, HBGary, and PBS. It was also responsible for the more recent Adobe data breach in which names, email addresses, and password hashes were stolen from one of their customer databases.
    [Show full text]
  • Blindfolded SQL Injection
    Blindfolded SQL Injection Written By: Ofer Maor Amichai Shulman Table of Contents Overview ......................................................................................................................3 Identifying Injections ................................................................................................5 Recognizing Errors ...........................................................................................................................5 Locating Errors............................................................................................................................... ...6 Identifying SQL Injection Vulnerable Parameters ........................................................................6 Performing the Injection ..........................................................................................8 Getting the Syntax Right..................................................................................................................8 Identifying the Database ..................................................................................................................9 Exploiting the Injection ...................................................................................................................10 UNION SELECT Injections ....................................................................................11 Counting the Columns....................................................................................................................11 Identifying Columns Types
    [Show full text]
  • 5 Things You Need to Know About a Web Application Firewall
    5 Things You Need to Know about a Web Application Firewall A NEUSTAR SECURITY SOLUTIONS EXCLUSIVE www.security.neustar 5 Things You Need to Know about a Web Application Firewall Table of Contents 1. What is a WAF? 03 2. Why Are Attackers Interested in Your Applications? 04 3. Why Do You Need a WAF? 05 4. Key Features to Expect from a WAF 06 5. Not All WAFs Are Equal 08 About Neustar 09 01 5 Things You Need to Know about a Web Application Firewall Web Application Firewall (WAF) is a priority item for IT professionals who are struggling to protect their customer facing and mission- critical applications. From SQL injection attacks to cleverly executed distributed denial of service (DDoS) attacks, attackers are enjoying success in areas where a WAF would otherwise stop their progression. But before you go out and buy a WAF service, here are five things you need to know. 5 Things You Need to Know about a Web Application Firewall What is a WAF? At its core, a Web Application Firewall (WAF) is responsible for inspecting the Hypertext Transfer Protocol (HTTP) request and responding based on predefined rules;processing preset actions against questionable HTTP/HTTPS requests identified during the inspection phase or the HTTP/HTTPS connection validity check; logging the malicious HTTP/HTTPS requests identified during the inspection; andmanaging visits to websites. Generally speaking, WAFs detect and protect web applications from attacks that try to exploit vulnerabilities. WAFs serve as a way to enhance the security perimeter by providing an additional barrier between attackers and your application layer.
    [Show full text]
  • CGSS DS US R2.Indd
    Gateway Content Anti-Virus Filtering Anti- ViewPoint Spyware Intrusion 24x7 Prevention Support SonicWALL Comprehensive Gateway Security Suite NETWORK SECURITY Complete Network Security in a Single Integrated Package Understanding network security can be complicated, but ensuring that your network is secure from malicious threats shouldn’t be. SonicWALL Comprehensive Security Suite (CGSS) removes the complexity associated with choosing a host of add-on security services by integrating all the network security services required for total protection into a convenient, aff ordable package that turns any SonicWALL network security appliance into a complete solution. Available on E-Class NSA, NSA and TZ Series network security appliances, SonicWALL CGSS keeps your network safe from viruses, spyware, worms, Trojans, intrusion attacks and other online threats. As soon as new threats are identified and often before software vendors ■ Complete network can patch their software, the SonicWALL security solutions are automatically updated with security solution signatures that protect against these threats and stop attacks before they can make their way into your network, ensuring you have around-the-clock protection. Your SonicWALL solution ■ Gateway anti-virus, anti-spyware and also has the ability to manage internal access to inappropriate, unproductive and potentially intrusion prevention illegal Web content with comprehensive content filtering. Finally, this powerful services ■ Application Firewall bundle also includes around-the-clock technical support, crucial firmware updates and real-time reporting capabilities. ■ Content filtering SonicWALL Comprehensive Security Suite includes the following: ■ 24x7 Support with ■ Gateway Anti-Virus, Anti-Spyware, Intrusion Prevention and Application Firewall* Service firmware updates subscription ■ ViewPoint reporting ■ Content Filtering Service subscription – Premium Edition on E-Class NSA, NSA and software TZ 210/200/100 Series.
    [Show full text]
  • Choosing a WCM That Strengthens Your Cybersecurity Strategy
    CHOOSING A WCM THAT STRENGTHENS (NOT WEAKENS) YOUR CYBERSECURIT Y STRATEGY Find out what Web Content Management system features are critical in an evolving cyber threat landscape. CONTENTS 1. Introduction: A New World of Cybercrime 2. The Role of Your WCM When It Comes to Security 3. The Threat of Crippling DDoS attacks 4. Vulnerability Exploits 5. Raising Your WCM defenses - 6. What to Look for in a Secure WCM 7. Summary CHOOSING A WCM THAT STRENGTHENS (NOT WEAKENS) YOUR CYBERSECURITY STRATEGY 02 INTRODUCTION: A NEW WORLD OF CYBERCRIME On Friday, May 12, 2017, the WannaCry ransomware cryptoworm first reared its ugly head, and within 24 hours had infected over 230,000 computers in over 150 coun- tries. Britain's National Health Service (NHS), Spain's Telefónica, FedEx and Deutsche Bahn were hit, as well as many other nations and companies around the world, in what became one of the biggest cybercrime exploits in history. WannaCry is only the latest tip of the cyber threat iceberg to break the surface. According to just one cybersecurity firm, ThreatMetrix, they detected 130 million online fraud attacks alone in the first quarter of 2017, up 23% from the same period the year before. (Source: "Cybercrime: US Tops Priority, Europe Tops Production" Security Intelligence) The sophistication and proliferation of cyber threats – viruses, ransomware, DDoS attacks and more – has grown startlingly, fueled by malice, political machinations or greed, with actual “cybercriminal web stores” sprouting up where criminals buy and sell credit card data and other stolen personal information, according to security researchers. (Source: Palmer, Danny, "Super-expensive Ransomware Linked to Online Cybercrime Market, Say Security Researchers" ZDNet) Other sobering stats about the rise of various types of cybercrime? 97% of web applications contain at least one vulnerability.
    [Show full text]
  • SQL Injection Attack, Attackers Exploit Web Application Vulnerability in Order to Access the Organization’S Data in an Unauthorized Manner
    January 2013 Hacker Intelligence Initiative, Monthly Trend Report #15 Lessons Learned From the Yahoo! Hack How SQL Injection Vulnerabilities in Third-Party Code Can Make for Security Cloudy 1. Executive Summary On December 2012, an Egyptian hacker who calls himself ViruS_HimA, claimed to have breached Yahoo!’s security systems and acquired full access to certain Yahoo! databases, leading to full access on the server for that domain. Technically, we found that the hacker was able to determine the allegedly vulnerable Yahoo! application and the exact attack method – error message based SQL injection for the MSSQL (Microsoft SQL Server) database (DB). From a business perspective, this attack underscores the security problem posed by hosting third-party code – as is often done with cloud-based services. In fact, according to a survey from PricewaterhouseCoopers, 23.6% of respondents say that cloud computing has increased vulnerabilities, and the largest perceived risk is the uncertain ability to enforce provider security policies.1 In the Yahoo! incident, the vulnerable application was probably not coded by the Yahoo! team, and not even hosted on Yahoo!’s server farm. This left Yahoo! with full responsibility for securing the application on one hand, and a very limited capability to actually control the code, on the other hand. This episode underscores technical and business urgencies: Technically, security teams should: › Protect third-party Web applications against SQL injection and other Web attacks: Incorporate security into the software development life cycle, perform penetration tests and vulnerability assessments on the application, and deploy the application behind a Web Application Firewall (WAF). › Harden your system: When the application is promoted from development to production, the system configuration must be hardened to disable any irrelevant parts that may help the attacker.
    [Show full text]
  • Classification of Malware Models Akriti Sethi San Jose State University
    San Jose State University SJSU ScholarWorks Master's Projects Master's Theses and Graduate Research Spring 5-20-2019 Classification of Malware Models Akriti Sethi San Jose State University Follow this and additional works at: https://scholarworks.sjsu.edu/etd_projects Part of the Artificial Intelligence and Robotics Commons, and the Information Security Commons Recommended Citation Sethi, Akriti, "Classification of Malware Models" (2019). Master's Projects. 703. DOI: https://doi.org/10.31979/etd.mrqp-sur9 https://scholarworks.sjsu.edu/etd_projects/703 This Master's Project is brought to you for free and open access by the Master's Theses and Graduate Research at SJSU ScholarWorks. It has been accepted for inclusion in Master's Projects by an authorized administrator of SJSU ScholarWorks. For more information, please contact [email protected]. Classification of Malware Models A Project Presented to The Faculty of the Department of Computer Science San José State University In Partial Fulfillment of the Requirements for the Degree Master of Science by Akriti Sethi May 2019 © 2019 Akriti Sethi ALL RIGHTS RESERVED The Designated Project Committee Approves the Project Titled Classification of Malware Models by Akriti Sethi APPROVED FOR THE DEPARTMENT OF COMPUTER SCIENCE SAN JOSÉ STATE UNIVERSITY May 2019 Dr. Mark Stamp Department of Computer Science Dr. Thomas Austin Department of Computer Science Dr. Philip Heller Department of Computer Science ABSTRACT Classification of Malware Models by Akriti Sethi Automatically classifying similar malware families is a challenging problem. In this research, we attempt to classify malware families by applying machine learning to machine learning models. Specifically, we train hidden Markov models (HMM) for each malware family in our dataset.
    [Show full text]
  • Best Practices: Use of Web Application Firewalls
    OWASP Papers Program Best Practice: Use of Web Application Firewalls Best Practices: Use of Web Application Firewalls Version 1.0.5, March 2008, English translation 25. May 2008 Author: OWASP German Chapter with collaboration from: Maximilian Dermann Mirko Dziadzka Boris Hemkemeier Achim Hoffmann Alexander Meisel Matthias Rohr Thomas Schreiber OWASP Papers Program Best Practice: Use of Web Application Firewalls Abstract Web applications of all kinds, whether online shops or partner portals, have in recent years increasingly become the target of hacker attacks. The attackers are using methods which are specifically aimed at exploiting potential weak spots in the web application software itself – and this is why they are not detected, or are not detected with sufficient accuracy, by traditional IT security systems such as network firewalls or IDS/IPS systems. OWASP develops tools and best practices to support developers, project managers and security testers in the development and operation of secure web applications. Additional protection against attacks, in particular for already productive web applications, is offered by what is still a emerging category of IT security systems, known as Web Application Firewalls (hereinafter referred to simply as WAF), often also called Web Application Shields or Web Application Security Filters. One of the criteria for meeting the security standard of the credit card industry currently in force (PCI DSS - Payment Card Industry Data Security Standard v.1.1) for example, is either a regular source code review or the use of a WAF. The document is aimed primarily at technical decision-makers, especially those responsible for operations and security as well as application owners (specialist department, technical application managers) evaluating the use of a WAF.
    [Show full text]
  • Securing a Modern Web Application in AWS
    Securing a Modern Web Application in AWS Explore threat modeling and learn how to create and support your web application security strategy with AWS Marketplace software seller solutions. AWS Marketplace Introduction As more organizations turn to distributed web applications to maintain high availability and reduce costs, many are choosing to store these applications in the AWS cloud for added elasticity, scalability, and ability to handle large workloads. Doing this securely, however, means addressing potential threats to multiple components, such as the front-end cloud application and corresponding databases. In this whitepaper, SANS analyst and instructor, Shaun McCullough, will provide an introduction to exploring the vulnerabilities associated with modern web applications, web application firewalls, and DevSec operations that oversee security to continually update code. This process, known as threat modeling, is vital to the ability to prioritize vulnerabilities and security operations to meet those challenges. Building on Shaun’s perspective, AWS Marketplace shares how this process can be applied to your AWS Cloud environment with an introduction to relevant AWS security services and AWS Marketplace software sellers, such as Fortinet, Barracuda, and Imperva. The featured Fortinet solutions for this use case can be accessed in AWS Marketplace Fortinet Managed Rules for AWS WAF AWS Quick Start for Fortinet FortiGate Fortinet FortiWeb Cloud WAF-as-a-Service A SANS Whitepaper How to Protect a Modern Web Application in AWS Written by Shaun McCullough Sponsored by: April 2019 AWS Marketplace Introduction As businesses move more assets to the cloud, having a security plan is essential, but nobody has the time or resources to do everything that is needed from the start.
    [Show full text]