A Case Study of SQL Injection Vulnerabilities Assessment of .bd Domain Web Applications

Abstract

Web applications or services play an important role in present day to day life. They have impact on the development of both individual and a country. Easy access to services such as online education, banking, reservation, shopping, resources, and information sharing have been proven most efficient for every day life. Various government and private organizations of Bangladesh have started to use web services to support clients. Most of the web applications of Bangladesh is registered with .bd domain and developed using content management system (CMS), various scripting language and SQL or MySQL database. Web applications are popular target for web attackers. However the security issues of the .bd domin web applications are not looked appropriately upon as of yet. One of the most attacked vulnerability of the database driven web applications is SQL injection or SQLi. SQLi through URL and user-input field is extremely high risk in current web based applications. Restricting user access to URL and user input field defies the purpose of web applications. However, the un-restricted user access exposes the vulnerable fields to web attacks. To prevent these exploitation's it is essential to have knowledge of the vulnerabilities adversaries uses to exploit the web applications. This paper presents an evaluation and analysis of SQLi vulnerabilities present in the existing web applications of .bd domain using black box penetration testing approach. User input based SQLi has been used for evaluation.Index Terms -SQLi, web applications, vulnerability, get and post based SQLi.

Penetration Testing using Kali Linux: SQL Injection, XSS, Wordpres, and WPA2 Attacks

“…Once the database is identified it further the attacks to exploit the system information of the database and the OS or webserver platform as shown in Table 1. As discussed in [13], the SQL was exploitable by syntax of one single quote as what we did in this research project. The number 10 did not exist in the SQL database we injected.…”

“…With the syntax of one single quote inserted along the input 10, it makes the database exploitable. Order by query is used to treasure the number of column that exists in the database table and union select or union all select query is used to explore the vulnerable columns in the database table [13]. The usage of these queries can be observed in the sqlmap log file as displayed in Figure 5.…”

SAISAN: An Automated Local File Inclusion Vulnerability Detection Model

“…Others conducted case study on different web application vulnerability exploitations in various domains of Bangladesh. A study on three major SQLi techniques implemented on the educational and financial websites of Bangladesh and executes analysis web applications for figuring out the security condition [3], [4]. Another study found on LFI vulnerability and its exploitation techniques based on SQLi and RFI vulnerability in which they examined 153 LFI vulnerable web applications and shown its impact in Bangladesh [5].…”

Evaluating the Readiness of Cyber Resilient Bangladesh

“…About 65% of the web applications were vulnerable to single quote (') attack. Another reason of this vulnerability is the development language used to build the web applications [8]. In the dataset 33% of the vulnerable web applications were built using php version 4.9 and older then this as shown in Figure 19.…”

“…From the rest od the dataset, 4% were built using joomla and 9% were built using Microsoft asp.net. The vulnerability level is identified by the type and amount of data that could be retrieved from attacking the web applications [8]. The statistics of vulnerability level of educational websites of Bangladesh in shown in Figure 21.…”