Mitigation: SQL Injection (en)

SQL injection attacks are one of the biggest security threats to web applications. This attack allows attackers to inject malicious SQL code into user input, thereby manipulating databases, stealing sensitive data, or even taking control of the server.

Building a Mitigation System with Snort

Snort is a very popular Intrusion Detection System (IDS) and Intrusion Prevention System (IPS). Snort can be used to detect various types of network attacks, including SQL injection.

Analysis with Wireshark

• Capture Traffic: Use Wireshark to capture network traffic during a SQL injection attack. Pay attention to traffic patterns, suspicious payloads, and unique signatures.
• Identify Patterns: Look for patterns indicating attempts at SQL injection, such as special characters (', ", ;, --), SQL keywords (SELECT, INSERT, UPDATE, DELETE), or unusual payloads.
• Create Basic Rules: Based on the analysis results, create basic Snort rules to detect these patterns.

Creating Snort Rules

• Syntax: Snort uses a relatively simple syntax for creating rules. An example rule for detecting SQL keywords:

alert tcp any any -> any any (msg:"SQL Injection Attempt"; content:"|0x53|0x45|0x4c|0x45|0x43|0x54|"; flow:to_server; sid:1000001; rev:1;)

• Customization: Tailor the rules to the patterns found in the Wireshark analysis. You can use various logical operators, wildcards, and functions to create more complex rules.

Configuring Snort IDS

• Installation: Ensure Snort is installed and running on your Ubuntu system.
• Main Configuration: Edit the main Snort configuration file (usually snort.conf) to set the interface to be monitored, the logs to be generated, and other options.

# ... (other configurations)
# Load rules
config: rule-path /etc/snort/rules
# ... (other configurations)

• Load Rules: Load the created rules into the Snort configuration.
• Start Snort: Start the Snort daemon to enable the rules to begin functioning.

Configuring Snort IPS

• Enable IPS Mode: Configure Snort to operate in IPS mode. This will allow Snort to block traffic considered malicious.
• Set Actions: Specify the actions to be taken when Snort detects an attack, such as blocking packets, generating logs, or executing scripts.

Integrating Snort with WAF

• WAF: A Web Application Firewall (WAF) is a solution specifically designed to protect web applications.
• Collaboration: Integrate Snort with WAF for more comprehensive protection. Snort can detect attacks at the network level, while WAF can protect at the application level.
• Correlation: Configure both systems to share information and complement each other.

Mitigation in PHP Coding

Filtering and Validating User Input

• Filtering:
  • Limit the types of data accepted (e.g., only numbers for numeric fields, only letters for text fields).
  • Use PHP built-in functions like `filter_var()` to validate data types.
  • Limit input length to prevent overflow.

• Validation:
  • Check if the input matches the expected format (e.g., valid email address, correct date format).
  • Use regular expressions to validate input patterns.

// Example of filtering and validating input
$name = filter_var($_POST['name'], FILTER_SANITIZE_STRING);
if (!filter_var($name, FILTER_VALIDATE_REGEXP, array("options"=>array("regexp"=>"/^[a-zA-Z ]+$/")))) {
    die("Invalid name");
}

Prepared Statements

• Concept:
  • Separate data from the SQL query.
  • The database server will compile the query once and then execute it repeatedly with different data.

• Implementation:
  • Use `mysqli_prepare()` and `mysqli_execute()` functions in PHP.
  • Bind parameters using `mysqli_stmt_bind_param()`.

// Example of using prepared statements
$stmt = $conn->prepare("SELECT * FROM users WHERE username = ?");
$stmt->bind_param("s", $username);
$stmt->execute();

Escaping

• Concept:
  • Convert special characters in user input into a safe form to include in the SQL query.

• Function:
  • Use `mysqli_real_escape_string()` for escaping strings.

// Example of using escaping
$name = mysqli_real_escape_string($conn, $_POST['name']);
$query = "SELECT * FROM users WHERE name = '$name'";

Note: While escaping can still be used, prepared statements are the more recommended method as they are safer and more efficient.

Conclusion

By combining analysis with Wireshark, creating effective Snort rules, configuring Snort IDS and IPS, and implementing input sanitation in applications, you can significantly reduce the risk of SQL injection attacks. Integration with WAF will provide an additional layer of protection.

Note:

• This is a basic example. Actual Snort configurations will be more complex and tailored to the specific needs of your environment.
• Always update Snort rules and signatures to counter the latest threats.
• Implement other best security practices, such as restricting database access, using strong passwords, and regularly updating systems.

Interesting Links

• Forensic: IT
• Snort Documentation:
• OWASP: [1](https://owasp.org/)