SQL Injection Types In Cyber Security Training Ppt

Slide 2

This slide talks about SQL Injection. SQL injection, or SQLI, is a common cyber attack method that uses malicious SQL code to manipulate backend databases to access data that is private and not meant to be shown in public.

Slide 3

This slide lists types of SQL Injections. These include: In-Band SQLi, Inferential or Blind SQLi, and Out-of-Band SQLi.

Slide 4

This slide discusses In-Band SQLi. The threat actor uses the same communication channel to launch attacks and gather results.

Slide 5

This slide highlights types of In-Band SQL injections. These are: Error-Based SQLi and Union-Based SQLi.

Slide 6

This slide talks about Inferential or Blind SQLi. To better understand the server's architecture, the threat actor sends data payloads to the server and monitors how it responds and behaves.

Slide 7

This slide highlights types of Inferential or Blind SQL injections. Blind SQL injections are either boolean or time-based.

Slide 8

This slide discusses Out-of-Band SQLi. Out-of-band SQLi is executed when the attacker cannot use the same transmission channel to launch the attack and collect data or when a server is unstable or too slow for these actions to be conducted.

Slide 9

This slide highlights ways of mitigating SQL Injection attacks. These are: Object relational mappers, web application firewalls, escaping, parameterized statements, database permissions, and pattern check. 

Slide 10

This slide discusses how Object Relational Mappers (ORM) can be used to mitigate the risk of SQL injection attacks. Developers can use ORM frameworks to create database queries in a secure and user-friendly way.

Slide 11

This slide talks about how Web Application Firewalls (WAFs) are used to mitigate the risk of SQL injection attacks. WAF technologies can make discovery and exploitation significantly more challenging for an attacker.

Slide 12

This slide discusses how Escaping mitigates the risk of SQL injection attacks. A way to prevent SQL injections is to attempt to escape all characters with special significance in SQL.

Slide 13

This slide discusses how Parameterized Statements mitigate the risk of SQL injection attacks. Instead of integrating user input into the statement, most development platforms allow the usage of parameterized statements that operate with restrictions.

Slide 14

This slide discusses how Database Permissions can be used to mitigate the risk of SQL injection attacks. Limiting the permissions or rights on the database login may help reduce the effectiveness of any SQL injection attack.

Slide 15

This slide discusses how Pattern Check can be used to mitigate the risk of SQL injection attacks. String parameters, integers, float, or boolean, can be checked if their value is a valid representation for the specified type.