SQL Injection Attacks and Defense by Clarke, Justin -- Read -- Imperial Library of Trantor

Index

Cover image Title page Table of Contents Copyright Acknowledgements Dedication Contributing Authors Lead Author and Technical Introduction to the 2nd Edition Chapter 1. What Is SQL Injection?

Introduction Understanding How Web Applications Work Understanding SQL Injection Understanding How It Happens Summary Solutions Fast Track

Chapter 2. Testing for SQL Injection

Introduction Finding SQL Injection Confirming SQL Injection Automating SQL Injection Discovery Summary Solutions Fast Track

Chapter 3. Reviewing Code for SQL Injection

Introduction Reviewing source code for SQL injection Automated source code review Summary Solutions fast track

Chapter 4. Exploiting SQL injection

Introduction Understanding common exploit techniques Identifying the database Extracting data through UNION statements Using conditional statements Enumerating the database schema Injecting into “INSERT” queries Escalating privileges Stealing the password hashes Out-of-band communication SQL injection on mobile devices Automating SQL injection exploitation Summary Solutions Fast Track

Chapter 5. Blind SQL Injection Exploitation

Introduction Finding and confirming blind SQL injection Using time-based techniques Using Response-Based Techniques Using Alternative Channels Automating blind SQL injection exploitation Summary Solutions fast track

Chapter 6. Exploiting the operating system

Introduction Accessing the file system Executing operating system commands Consolidating access Summary Solutions fast track References

Chapter 7. Advanced topics

Introduction Evading input filters Exploiting second-order SQL injection Exploiting client-side SQL injection Using hybrid attacks Summary Solutions fast track

Chapter 8. Code-level defenses

Introduction Domain Driven Security Using parameterized statements Validating input Encoding output Canonicalization Design Techniques to Avoid the Dangers of SQL Injection Summary Solutions fast track

Chapter 9. Platform level defenses

Introduction Using runtime protection Securing the database Additional deployment considerations Summary Solutions fast track

Chapter 10. Confirming and Recovering from SQL Injection Attacks

Introduction Investigating a suspected SQL injection attack So, you’re a victim—now what? Summary Solutions fast track

Chapter 11. References

Introduction Structured query language (SQL) primer SQL injection quick reference Bypassing input validation filters Troubleshooting SQL injection attacks SQL injection on other platforms Resources Solutions fast track

Index