52
Parameter Tampering
•Target: SQL injection – database manipulation
•
•How: Modifying semantics of underlying SQL query
•
•Log manifestation – parameter value containing ‘ (or “) followed by SQL                 query fragments:
–‘ or 1=1 or ‘
–foobar ‘ or username like ‘%s’ –
–‘ – (CR) select * from tab
–‘ ; delete users ;
–Testing and understanding causes a lot of (syntax) errors – watch for “500” responses and database errors.
–‘ (testing application response)
•
•Variants: innumerable
•
•False alarms: sometimes a ‘ is just a ‘ (isn’t it?)
No notes for this slide