[Autogenerated] Hello in this demo we will look at how mod security
can mitigate SQL injection a common attack vector used for
unauthorized backend database manipulation.
Don't worry if you're not familiar with the tools or techniques I
use in this clip I just want you to focus on how my security
responds when the attacks are executed.
I will use Kali Linux to launch manual and automated attacks
against an intentionally vulnerable web application.
First I will demonstrate successful attacks using the detection
only mode of my security then I will enable my security protection
and show how it handles the attacks.
So jumping right in the most basic SQL injection test starts with a
single quote character to check if the code that processes the input
from this form correctly validates user input.
If the web application does not correctly filter characters then
when we hit submit it should generate an error.
Alright that gave us an error.
Let's see what shows up in the logs.
Ah nothing is logged makes sense a rule against a single quote
could generate a lot of false positives.
Well let's test another approach.
This form will return the first and last name for the user IDE we input.
So is there a hack I can use to get all users at once sure if I type percent
or one equals one and put the quotes in the right places,
then hit submit.
Voila.
Now let's see if we get anything from mod security bingo so at least we
can see that this second attempt ends up in our logs.
Let's increase the threat and use SQL map to automate
finding and exploiting SQL injection flaws.
Hopefully I can dump the entire backend database and expose the user names
and passwords and after a few moments look at that jackpot,
it's pretty much game over at this point.
That was pretty easy for the threat actor.
Let's turn on mod security protection and see if we
can stop the attacks you observed.
If we go back to our sequel injection attack and try it again.
Ah This time instead of dumping all the users mod security blocked the attempt.
Now let's go back to SQL Map and see if we can dump the database again.
Give it a few seconds to complete.
Mm no database dump this time.
Notice that SQL Map is reporting the HTTP code 403 which is the equivalent of
the visual forbidden response we received using the browser.
It is important to keep in mind that although mod security
protected the deliberately vulnerable web application,
it isn't a 100% solution or an alternative to fixing known vulnerabilities
mod security is a layer in your defense so you still need to harden your
servers and implement secure coding practices