SQL Injection Explained - What just happened...

C/C++ uses Null terminated strings '\0', where other languages have the string length stored in a separate variable.
The C/C++ function used to copy text from one string to another (strcpy) just keeps going until it finds a '\0'...
It even keeps going past the end of the of the buffer...
And keeps on going into some vital program area where the return address is stored...
Then when the computer is trying to execute the overwritten return address the program will either: 1. crash (DoS) or 2. start executing the code placed by the attacker via the oversize source string (Remote Execution)
If the exploited program has Admin privileges then it is GAME OVER and the victim computer has been completely "pwned" (pronounced "owned")
A length of No-Operation instructions (NOP-sled) can be used to catch program execution when start position is not precisely known and lead program execution to the attack code

How do I find SQL Injection vulnerabilities in my systems?

1. A Customer informs you that they found your Data on a Hacker bulleting board - Ouch (in 2013 70% of data breaches were discovered by external parties1)
2. Code Review - Yuk! mind numbing and takes forever, due to the human element not very reliable for large amounts of code. Use this once you have located the vulnerability using other means.14
3. Free open source tools - Detailed semi-automatic testing - typically one page or field at a time. Great for testing during development or for understanding the SQL injection that was found by fully automatic tools - no phone or live support.
4. Commercial Tools for testing SQL injection - Obviously these tools are great at finding SQL injections, don't forget that there could many other kinds of vulnerabilities hiding in your systems.
5. Fully automatic Vulnerability Assessment (VA) testing that will test for everything - day out and day in without human intervention. This is the best solution for making sure some change does not (re-)introduce SQL-injection or other vulnerability in your web-site. Coolest: Easy online solutions not requiring installation or training.

How do I Fix SQL Injection?

1. Using secure coding practices during development14
2. Go back and fix old code14
3. Validate and filter all input, remove SQL control characters 15
4. Update 3rd party web-applications to secure versions
5. Use a Web Application Firewall (WAF) in front of your vulnerable web servers, to intercept the Attacks before they reach your server. Configuring a WAF to protect against the SQL injections and other Web application vulnerabilities is ridiculously difficult, which is why we wrote the Critical Watch WAF OptimizerTM to automatically configure your WAF based on detected vulnerabilities.

SQL Injection Notes:
1. While SQL injections relate to SQL Databases, the problems typically need to be fixed in the application layer not in the database layers. (Updating the database will not fix the problem)
2. Short field length is a good way to minimize SQL Injection attacks, as there is a limit to how much attack code can be written into a short field. You must enforce the short field length in the back-end application or WAF as HTML restrictions are easily bypassed.
3. Non-SQL Databases like Mongo do not suffer from SQL Injection - they suffer from Non-SQL Injections2.
4. Why only do SQL Injections via SELECT Statements - here how to do it via INSERT, UPDATE and DELETE16