SQL Injection is a technique often used to attack a website. It is the most common website vulnerability on the Internet.
Objective
The objective of this lab is to provide expert knowledge on SQL Injection attacks and other responsibilities that include:
- Understanding when and how a web application connects to a database server in order to access data
- Extracting basic SQL Injection flaws and vulnerabilities
- Testing web applications for Blind SQL Injection vulnerabilities
- Scanning web servers and analyzing the reports
- Information on securing web applications and web servers
Scenario
The SQL Injection attack is carried out by including portions of SQL statements in a web form entry field in an attempt to get the website to pass a newly formed rogue SQL command to the database (e.g., dump the database contents to the attacker). SQL injection is a code injection technique that exploits a security vulnerability in a website's software. The vulnerability happens when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed. SQL commands are thus injected from the web form into the database of an application (like queries) to change the database content or dump the database information like credit card or passwords to the attacker. SQL injection is mostly known as an attack vector for websites but can be used to attack any type of SQL database.
As an expert Penetration Tester or a Security Administrator, you must use diverse solutions, prepare statements with bind variables and whitelisting input validation and escaping. Input validation can be used to detect unauthorized input before it is passed to the SQL query.
SQL Penetration Testing
The Security Analyst Exercises / SQL Penetration Testing contains the following Exercises:
- SQL Injection Attacks on MS SQL Database
The Virtual Private Cloud for this Lab set utilizes:
Security Analyst Exercises are available as part of the following subscription:
Each subscription provides 6 months access to 15 Different Exercises. Each exercise contains a Scenario, Objectives, and individual step by step tasks to guide the user through all steps necessary to complete the exercise. The Penetration Testing Exercises are designed to give the user an ultimate hands-on experience. Each exercise category above has it’s own Virtual Private Cloud that comes preconfigured with Vulnerable websites, Victim Machines, and the environment is LOADED with tools. Included in your network share are all the supporting tools required to practice in the Cyber Range / Lab environment.
Lab exercises are included for:
- TCPIP Packet Analysis
- Information Gathering
- Vulnerability Analysis
- External Penetration Testing
- Internal Network Penetration Testing
- Firewall Penetration Testing
- IDS Penetration Testing
- Password Cracking Penetration Testing
- Social Engineering Penetration Testing
- Web Application Penetration Testing
- SQL Penetration Testing
Price: $199
