As you've seen so far Eskil injections are very dangerous and also they're very easy to occur and very
easy to find.
You'll find them everywhere and some really famous websites people try to prevent these vulnerabilities
using filters.
Filters can make it look like there is no exploits.
But if you actually try harder by using encoding different types of encoding or using a proxy then you'll
be able to bypass most of these filters.
Some programmers use a blacklist.
So for example they prevent the use of union they prevent the use of insert and stuff like that.
Again it's not 100 percent secure.
It can be bypassed using a whitelist exactly the same issues as the blacklist.
The best way to do it is to program your web application in a way that it does not allow code to be
injected into it and then execute it.
So the best way to do that is to do to use parameter rights statements where the data and the code is
separated.
And the best way to show you what I mean by that is using an example I'm keeping the least amount of
program and in this example I don't want it to be a program an example.
There's actually mistakes in the program in there but I'm trying to give you the concept more than how
to program it.
So the vulnerable code that we were looking at used to do this so it used to do select star from accounts
where user name is equal to whatever we put in Text Box 1 and then we used to put in Text Box 1 let's
just put it here.
We used to say admin and then it closed the code and then were able to do a union select and execute
something else.
And then once we're done we used to add the comment which basically ignores everything that comes in
after it.
So when you copy this and you paste it in here
you'll see what's happening.
So it's selecting.
Now let's just get rid of this because this is just making the colors not nice I'm actually going to
just put a comment on this so it's gonna do a select star from accounts where user name is equal to
admin union select and execute whatever we want to do.
This is very bad and it's very hard to protect against as I said user filters and stuff will only hide
the problem will not fix it.
The best way to do this is using the parameter rise statements just like so.
So this is the safe way to do it.
First of all you prepare your statement most languages like BHP and all of them they actually have a
function like that and you can prepare select staff from accounts where user name is equal to question
mark and then you send the values.
So BHP now knows the Eskil statement is select staff from accounts where user name is equal to something
and then it's going to take the value of Text Box 1.
So even if we come in and we use our very sneaky statement right here and pasted in there the web application
will know that the value for this is admin unions select so it will actually try to go and select staff
from accounts where the user name and then it actually it'll add its own quotes and they try to find
a user name with the following user name.
So this whole thing will be executed like so
so it will be select staff from accounts where user name is equal to admin unions select this hashtag
so it will never whatever you put in your text box will be sent as a value.
And the web application will know that this is a value it's not a code and it'll never executed.
Therefore this will protect you against as cruel injections.
You can use the filters as second line of defense.
And I also advise that you use the least privilege as possible so use for each database.
Use one user with the least amount of privileges they want so don't allow the users to do anything that
they won't allow them.
If if it's a simple site that only does selection that only allows the user to select if it only needs
to select an insert then only allow them to select an insert.
And this is a rule you should keep with everything even within its systems make sure the parent with
the permissions are always as these as possible each user don't have any extra permissions that they
don't need.