OWASP TOP 10: SQL injection ~2023

Overview

SQL injection is a type of vulnerability that can allow attackers to inject malicious SQL code into a web application's backend database, potentially giving them access to sensitive data or even taking control of the entire system.

Syllabus

• Introduction to SQL Injection
Definition and overview of SQL injection
Importance of understanding SQL injection vulnerabilities
• Understanding the OWASP Top 10
Overview of OWASP Top 10 Security Risks
Where SQL injection fits within the OWASP Top 10
• How SQL Injection Works
Basic SQL commands and structure
Types of SQL injection (In-band, Inferential, Out-of-band)
Common vulnerabilities exploited in SQL injection attacks
• Identifying SQL Injection Vulnerabilities
Techniques for discovering SQL injection points
Tools and methods for testing web applications
Signatures and symptoms of SQL injection attacks
• Attack Vectors and Exploitation Techniques
Union-based SQL injection
Error-based SQL injection
Blind SQL injection (Boolean and Time-based)
Exploiting different database management systems (MySQL, PostgreSQL, SQL Server, Oracle)
• Impacts of SQL Injection
Data exfiltration and unauthorized data access
Database manipulation and alteration
Potential for complete system compromise
• Mitigation and Prevention Strategies
Input validation and parameterized queries
Role of ORM and stored procedures
Use of web application firewalls (WAFs)
Best practices for secure coding to prevent SQL injection
• Advanced Protection Measures
Security patches and database hardening
Implementing least privilege access controls
Continuous security testing and auditing
• Case Studies and Real-World Examples
Analysis of notable SQL injection incidents
Lessons learned from past vulnerabilities
• Practical Lab Exercises
Setting up a safe environment for practicing SQL injection
Hands-on exercises on identifying and exploiting vulnerabilities
Application of defensive coding practices in lab scenarios
• Final Assessment and Review
Review of key concepts and techniques
Final exam to evaluate understanding of SQL injection and prevention methods
• Course Completion and Next Steps
Resources for further learning and certification
Introduction to broader web application security topics

Taught by

Foyzul Islam

Subjects

Information Security (InfoSec)