Overview

NoSQLinjectionisacodeinsertiontechniqueusedtoattackdatadriven
applications,inwhichmaliciouscodeisinsertedtonormalSQLstatementtodump
contentsfromdatabase.
Thereisvulnerabilitywithsomewebapplicationswhichallowtheattackerto
submitSQLcommandstothedatabase.Mostoftenthisiscausedbydataentered
throughthewebapplicationwithoutvalidationorencodingresultinginacommand
orquery.Thesystemdoesnotdeterminetheintendedcommandsversusthe
attackersinjection.Thisallowstheattackertocreate,read,modifyordelete
sensitivedata.
Withthismethodcanallowanattackercouldtobypassauthentication,access,
modifyanddeletedatawithinadatabase.SQLinjectioncanbeusedtoexecute
commandsontheoperatingsysteminturnallowinganattackertoescalatetomore
damagingattacksinsideofanetworkthatsitsbehindafirewall.
OneformofSQLinjectionoccurswhenanattackerisabletousethesame
communicationchanneltobothlaunchtheattackandgatherresults.Thismethod
coulduseerrormessagesthrownbythedatabaseservertoobtaininformationabout
thestructureofthedatabase.Whileerrorsareveryusefulduringthedevelopment
phaseofawebapplication,theyshouldbedisabledonaproductiondatabaseor
loggedtoafilewithrestrictedaccessinstead.AnothertechniqueusestheUNION
SQLoperatortocombinetheresultsoftwoormoreSELECTstatementsintoa
singleresultwhichisthenreturnedaspartoftheHTTPresponse.

Anothertechniquedoesnotinvolvetransferringdatawiththewebapplication.The
attackerisabletoreconstructthedatabasestructurebysendingpayloads,observing
thewebapplicationsresponseandtheresultingbehaviorofthedatabaseserver.
OnemethodreliesonsendinganSQLquerytothedatabasewhichforcesthe
applicationtoreturnadifferentresultdependingonwhetherthequeryreturnsa
TRUEorFALSEresult.Dependingontheresult,thecontentwithintheHTTP
responsewillchange,orremainthesame.Thisisaslowermethodastheattacker
wouldneedtoenumerateadatabase,characterbycharacter.
Whenlookingatthetimebasedtechniquethedatabaseforcesthedatabasetowait
foraspecifiedamountoftime(inseconds)beforeresponding.Theresponsetime
willindicatetotheattackerwhethertheresultofthequeryisTRUEorFALSE.
Dependingontheresult,anHTTP
SQLinjectionattacksdonothavetoreturndatadirectlytotheusertobeuseful.
Theuseoftimingorotherperformanceindicatorsanderrormessagescanbeused
todeducethesuccessorresultsofanattack.
Preventionmethodsincludeusingpreparedstatementsinsteadofdynamicqueries
usingstringconcatenation,validatinginputandinputtypesandusingaleast
privilegeapproachforapplicationaccounts.