working on sqli intro
This commit is contained in:
parent
d952732f69
commit
fad70625fd
|
|
@ -0,0 +1,4 @@
|
||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
# Argument $1 is the source markdown file
|
||||||
|
pandoc -s --mathml -i -t revealjs "$1" -o presentation.html -V theme=dracula
|
||||||
|
|
@ -41,7 +41,7 @@
|
||||||
}
|
}
|
||||||
@media print {
|
@media print {
|
||||||
pre > code.sourceCode { white-space: pre-wrap; }
|
pre > code.sourceCode { white-space: pre-wrap; }
|
||||||
pre > code.sourceCode > span { text-indent: -5em; padding-left: 5em; }
|
pre > code.sourceCode > span { display: inline-block; text-indent: -5em; padding-left: 5em; }
|
||||||
}
|
}
|
||||||
pre.numberSource code
|
pre.numberSource code
|
||||||
{ counter-reset: source-line 0; }
|
{ counter-reset: source-line 0; }
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,33 @@
|
||||||
|
import sqlite3
|
||||||
|
|
||||||
|
con = sqlite3.connect("secrets.db")
|
||||||
|
cur = con.cursor()
|
||||||
|
|
||||||
|
cur.execute(
|
||||||
|
"""
|
||||||
|
CREATE TABLE user_data(
|
||||||
|
user_id INTEGER PRIMARY KEY AUTOINCREMENT,
|
||||||
|
username TEXT, password TEXT, notes TEXT
|
||||||
|
);
|
||||||
|
"""
|
||||||
|
)
|
||||||
|
|
||||||
|
|
||||||
|
res = cur.execute(
|
||||||
|
"""
|
||||||
|
INSERT INTO user_data (username, password, notes)
|
||||||
|
VALUES (
|
||||||
|
'admin',
|
||||||
|
's3cur3P455w0rd',
|
||||||
|
'sqli{66d7724d872da91af56907aea0f6bfb8}'
|
||||||
|
),
|
||||||
|
(
|
||||||
|
'catweasle',
|
||||||
|
'catweasle_h3xh3x',
|
||||||
|
'sqli{f91f3b7d41a6a40070ce7112bebfaaab}'
|
||||||
|
)
|
||||||
|
;
|
||||||
|
"""
|
||||||
|
)
|
||||||
|
|
||||||
|
con.commit()
|
||||||
|
|
@ -0,0 +1,539 @@
|
||||||
|
<!DOCTYPE html>
|
||||||
|
<html>
|
||||||
|
<head>
|
||||||
|
<meta charset="utf-8">
|
||||||
|
<meta name="generator" content="pandoc">
|
||||||
|
<meta name="author" content="Stefan Friese">
|
||||||
|
<title>Introduction to SQL Injection</title>
|
||||||
|
<meta name="apple-mobile-web-app-capable" content="yes">
|
||||||
|
<meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
|
||||||
|
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no, minimal-ui">
|
||||||
|
<link rel="stylesheet" href="https://unpkg.com/reveal.js@^4//dist/reset.css">
|
||||||
|
<link rel="stylesheet" href="https://unpkg.com/reveal.js@^4//dist/reveal.css">
|
||||||
|
<style>
|
||||||
|
.reveal .sourceCode { /* see #7635 */
|
||||||
|
overflow: visible;
|
||||||
|
}
|
||||||
|
code{white-space: pre-wrap;}
|
||||||
|
span.smallcaps{font-variant: small-caps;}
|
||||||
|
div.columns{display: flex; gap: min(4vw, 1.5em);}
|
||||||
|
div.column{flex: auto; overflow-x: auto;}
|
||||||
|
div.hanging-indent{margin-left: 1.5em; text-indent: -1.5em;}
|
||||||
|
/* The extra [class] is a hack that increases specificity enough to
|
||||||
|
override a similar rule in reveal.js */
|
||||||
|
ul.task-list[class]{list-style: none;}
|
||||||
|
ul.task-list li input[type="checkbox"] {
|
||||||
|
font-size: inherit;
|
||||||
|
width: 0.8em;
|
||||||
|
margin: 0 0.8em 0.2em -1.6em;
|
||||||
|
vertical-align: middle;
|
||||||
|
}
|
||||||
|
/* CSS for syntax highlighting */
|
||||||
|
pre > code.sourceCode { white-space: pre; position: relative; }
|
||||||
|
pre > code.sourceCode > span { line-height: 1.25; }
|
||||||
|
pre > code.sourceCode > span:empty { height: 1.2em; }
|
||||||
|
.sourceCode { overflow: visible; }
|
||||||
|
code.sourceCode > span { color: inherit; text-decoration: inherit; }
|
||||||
|
div.sourceCode { margin: 1em 0; }
|
||||||
|
pre.sourceCode { margin: 0; }
|
||||||
|
@media screen {
|
||||||
|
div.sourceCode { overflow: auto; }
|
||||||
|
}
|
||||||
|
@media print {
|
||||||
|
pre > code.sourceCode { white-space: pre-wrap; }
|
||||||
|
pre > code.sourceCode > span { display: inline-block; text-indent: -5em; padding-left: 5em; }
|
||||||
|
}
|
||||||
|
pre.numberSource code
|
||||||
|
{ counter-reset: source-line 0; }
|
||||||
|
pre.numberSource code > span
|
||||||
|
{ position: relative; left: -4em; counter-increment: source-line; }
|
||||||
|
pre.numberSource code > span > a:first-child::before
|
||||||
|
{ content: counter(source-line);
|
||||||
|
position: relative; left: -1em; text-align: right; vertical-align: baseline;
|
||||||
|
border: none; display: inline-block;
|
||||||
|
-webkit-touch-callout: none; -webkit-user-select: none;
|
||||||
|
-khtml-user-select: none; -moz-user-select: none;
|
||||||
|
-ms-user-select: none; user-select: none;
|
||||||
|
padding: 0 4px; width: 4em;
|
||||||
|
color: #aaaaaa;
|
||||||
|
}
|
||||||
|
pre.numberSource { margin-left: 3em; border-left: 1px solid #aaaaaa; padding-left: 4px; }
|
||||||
|
div.sourceCode
|
||||||
|
{ }
|
||||||
|
@media screen {
|
||||||
|
pre > code.sourceCode > span > a:first-child::before { text-decoration: underline; }
|
||||||
|
}
|
||||||
|
code span.al { color: #ff0000; font-weight: bold; } /* Alert */
|
||||||
|
code span.an { color: #60a0b0; font-weight: bold; font-style: italic; } /* Annotation */
|
||||||
|
code span.at { color: #7d9029; } /* Attribute */
|
||||||
|
code span.bn { color: #40a070; } /* BaseN */
|
||||||
|
code span.bu { color: #008000; } /* BuiltIn */
|
||||||
|
code span.cf { color: #007020; font-weight: bold; } /* ControlFlow */
|
||||||
|
code span.ch { color: #4070a0; } /* Char */
|
||||||
|
code span.cn { color: #880000; } /* Constant */
|
||||||
|
code span.co { color: #60a0b0; font-style: italic; } /* Comment */
|
||||||
|
code span.cv { color: #60a0b0; font-weight: bold; font-style: italic; } /* CommentVar */
|
||||||
|
code span.do { color: #ba2121; font-style: italic; } /* Documentation */
|
||||||
|
code span.dt { color: #902000; } /* DataType */
|
||||||
|
code span.dv { color: #40a070; } /* DecVal */
|
||||||
|
code span.er { color: #ff0000; font-weight: bold; } /* Error */
|
||||||
|
code span.ex { } /* Extension */
|
||||||
|
code span.fl { color: #40a070; } /* Float */
|
||||||
|
code span.fu { color: #06287e; } /* Function */
|
||||||
|
code span.im { color: #008000; font-weight: bold; } /* Import */
|
||||||
|
code span.in { color: #60a0b0; font-weight: bold; font-style: italic; } /* Information */
|
||||||
|
code span.kw { color: #007020; font-weight: bold; } /* Keyword */
|
||||||
|
code span.op { color: #666666; } /* Operator */
|
||||||
|
code span.ot { color: #007020; } /* Other */
|
||||||
|
code span.pp { color: #bc7a00; } /* Preprocessor */
|
||||||
|
code span.sc { color: #4070a0; } /* SpecialChar */
|
||||||
|
code span.ss { color: #bb6688; } /* SpecialString */
|
||||||
|
code span.st { color: #4070a0; } /* String */
|
||||||
|
code span.va { color: #19177c; } /* Variable */
|
||||||
|
code span.vs { color: #4070a0; } /* VerbatimString */
|
||||||
|
code span.wa { color: #60a0b0; font-weight: bold; font-style: italic; } /* Warning */
|
||||||
|
</style>
|
||||||
|
<link rel="stylesheet" href="https://unpkg.com/reveal.js@^4//dist/theme/dracula.css" id="theme">
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
<div class="reveal">
|
||||||
|
<div class="slides">
|
||||||
|
|
||||||
|
<section id="title-slide">
|
||||||
|
<h1 class="title">Introduction to SQL Injection</h1>
|
||||||
|
<p class="author">Stefan Friese</p>
|
||||||
|
<p class="date">11 April, 2024</p>
|
||||||
|
</section>
|
||||||
|
|
||||||
|
<section id="topics" class="slide level1">
|
||||||
|
<h1>Topics</h1>
|
||||||
|
<ul>
|
||||||
|
<li class="fragment">How an SQL Injection is Created</li>
|
||||||
|
<li class="fragment">How to Exploit an SQL Injection</li>
|
||||||
|
<li class="fragment">SPOILER: How to Prevent an SQL Injection in the
|
||||||
|
Next Presentation</li>
|
||||||
|
</ul>
|
||||||
|
</section>
|
||||||
|
<section class="slide level1">
|
||||||
|
|
||||||
|
<h2 id="how-does-it-happen">How Does it Happen</h2>
|
||||||
|
<p>An SQL injection occurs when two things come together.</p>
|
||||||
|
</section>
|
||||||
|
<section class="slide level1">
|
||||||
|
|
||||||
|
<h3 id="number-1">Number 1</h3>
|
||||||
|
<p>An SQL Query as a string embedded in other languages</p>
|
||||||
|
<div class="sourceCode" id="cb1"><pre
|
||||||
|
class="sourceCode python"><code class="sourceCode python"><span id="cb1-1"><a href="#cb1-1" aria-hidden="true" tabindex="-1"></a>sql_query <span class="op">=</span> </span>
|
||||||
|
<span id="cb1-2"><a href="#cb1-2" aria-hidden="true" tabindex="-1"></a> cursor.execute(</span>
|
||||||
|
<span id="cb1-3"><a href="#cb1-3" aria-hidden="true" tabindex="-1"></a> <span class="st">"SELECT * FROM user_data where username = 'foo' and password = 's3cur3P4ssw0rd"</span></span>
|
||||||
|
<span id="cb1-4"><a href="#cb1-4" aria-hidden="true" tabindex="-1"></a> )</span></code></pre></div>
|
||||||
|
</section>
|
||||||
|
<section class="slide level1">
|
||||||
|
|
||||||
|
<h3 id="number-2">Number 2</h3>
|
||||||
|
<p>User input is possible as a part of said SQL query</p>
|
||||||
|
<div class="sourceCode" id="cb2"><pre
|
||||||
|
class="sourceCode python"><code class="sourceCode python"><span id="cb2-1"><a href="#cb2-1" aria-hidden="true" tabindex="-1"></a>sql_query <span class="op">=</span> cursor.execute(<span class="st">"SELECT * FROM user_data where username = '</span><span class="sc">%s</span><span class="st">'"</span> <span class="op">%</span> username)</span></code></pre></div>
|
||||||
|
</section>
|
||||||
|
<section class="slide level1">
|
||||||
|
|
||||||
|
<h2 id="how-to-exploit-an-sql-injection">How to Exploit an SQL
|
||||||
|
Injection</h2>
|
||||||
|
<p>Work is a product of power by time.<br />
|
||||||
|
<code>P</code> is your power to solve an issue.</p>
|
||||||
|
<p><code>W = P x t</code></p>
|
||||||
|
<p>The smarter you tackle work, the less time you need to solve an
|
||||||
|
issue.</p>
|
||||||
|
</section>
|
||||||
|
<section class="slide level1">
|
||||||
|
|
||||||
|
<h2 id="knowledge-is-a-map">Knowledge is a Map</h2>
|
||||||
|
<p>You conventiently drive around the city using the underground. That’s
|
||||||
|
how you get to know the main spots of the city.</p>
|
||||||
|
<p><img src="./images/london_underground.jpg" alt="London Underground" width="50%" height="auto"></p>
|
||||||
|
</section>
|
||||||
|
<section class="slide level1">
|
||||||
|
|
||||||
|
<h2 id="knowledge-is-a-map-1">Knowledge is a Map</h2>
|
||||||
|
<p>Invest some time and explore deeper on foot. That’s how you get to
|
||||||
|
know the back alleys.</p>
|
||||||
|
<p><img src="./images/london_by_foot.jpg" alt="London by Foot" width="50%" height="auto"></p>
|
||||||
|
</section>
|
||||||
|
<section id="ghidra-an-overview" class="slide level1">
|
||||||
|
<h1>Ghidra – an Overview</h1>
|
||||||
|
</section>
|
||||||
|
<section class="slide level1">
|
||||||
|
|
||||||
|
<figure>
|
||||||
|
<img data-src="./images/Ghidra-Overview.png"
|
||||||
|
alt="Main View of Ghidra" />
|
||||||
|
<figcaption aria-hidden="true">Main View of Ghidra</figcaption>
|
||||||
|
</figure>
|
||||||
|
</section>
|
||||||
|
<section class="slide level1">
|
||||||
|
|
||||||
|
<h2 id="watch-out-for-low-hanging-fruits">Watch Out for Low Hanging
|
||||||
|
Fruits</h2>
|
||||||
|
</section>
|
||||||
|
<section class="slide level1">
|
||||||
|
|
||||||
|
<ul>
|
||||||
|
<li class="fragment">Data Segment</li>
|
||||||
|
<li class="fragment">Names of Functions</li>
|
||||||
|
<li class="fragment">Conditions & Comparisons</li>
|
||||||
|
<li class="fragment">Strings: Usernames, Passwords</li>
|
||||||
|
<li class="fragment">URLs, IP & Port Numbers</li>
|
||||||
|
</ul>
|
||||||
|
<p><strong>Do not try to understand the whole code at once, it will only
|
||||||
|
drive you mad.</strong></p>
|
||||||
|
</section>
|
||||||
|
<section class="slide level1">
|
||||||
|
|
||||||
|
<h3 id="data-segments">Data Segments</h3>
|
||||||
|
<p><img src="./images/data-segments.png" alt="A look into the read only data segment" width="70%" height="auto"></p>
|
||||||
|
<p>A look into the read only data segment</p>
|
||||||
|
</section>
|
||||||
|
<section class="slide level1">
|
||||||
|
|
||||||
|
<h3 id="name-of-functions">Name of Functions</h3>
|
||||||
|
<figure>
|
||||||
|
<img data-src="./images/symbol-tree.png"
|
||||||
|
alt="Functions contained in the binary a.k.a. Symbol Tree" />
|
||||||
|
<figcaption aria-hidden="true">Functions contained in the binary a.k.a.
|
||||||
|
Symbol Tree</figcaption>
|
||||||
|
</figure>
|
||||||
|
</section>
|
||||||
|
<section class="slide level1">
|
||||||
|
|
||||||
|
<h3 id="conditions-comparisions">Conditions & Comparisions</h3>
|
||||||
|
<p><img src="./images/decompiled-code.png" alt="Input is Compared to a Hard Coded String" width="50%" height="auto"></p>
|
||||||
|
<p>Input is compared to a hard coded string</p>
|
||||||
|
</section>
|
||||||
|
<section class="slide level1">
|
||||||
|
|
||||||
|
<h3 id="function-graph">Function Graph</h3>
|
||||||
|
<p><img src="./images/function-graph.png" alt="Take a Look at the Flow Graph of Functions" width="50%" height="auto"></p>
|
||||||
|
<p>Take a look at the flow graph of functions</p>
|
||||||
|
</section>
|
||||||
|
<section class="slide level1">
|
||||||
|
|
||||||
|
<h3 id="strings">Strings</h3>
|
||||||
|
<p><img src="./images/defined-strings-menu.png" alt="Open the Defined Strings Menu" width="50%" height="auto"></p>
|
||||||
|
<p>Strings can not only be located in data but also in other code
|
||||||
|
segments, sometimes obfuscated</p>
|
||||||
|
</section>
|
||||||
|
<section class="slide level1">
|
||||||
|
|
||||||
|
<h3 id="strings-1">Strings</h3>
|
||||||
|
<figure>
|
||||||
|
<img data-src="./images/defined-strings.png" alt="An old friend" />
|
||||||
|
<figcaption aria-hidden="true">An old friend</figcaption>
|
||||||
|
</figure>
|
||||||
|
</section>
|
||||||
|
<section class="slide level1">
|
||||||
|
|
||||||
|
<h3 id="binary-patching">Binary Patching</h3>
|
||||||
|
<p>Bypass any undesireable condition via a <code>NOP</code>
|
||||||
|
instruction.</p>
|
||||||
|
<p><img src="./images/nop.jpg" alt="NOP, export your patched binary" width="30%" height="auto"></p>
|
||||||
|
<p>NOP, export your patched binary</p>
|
||||||
|
</section>
|
||||||
|
<section class="slide level1">
|
||||||
|
|
||||||
|
<h3 id="do-it-yourselves">Do It Yourselves!</h3>
|
||||||
|
<ul>
|
||||||
|
<li class="fragment"><a href="https://ghidra-sre.org/">Download
|
||||||
|
Ghidra</a></li>
|
||||||
|
<li class="fragment"><a href="https://crackmes.one">Download binaries at
|
||||||
|
crackmes.one</a></li>
|
||||||
|
<li class="fragment"><a href="https://hackthebox.eu">Find more binaries
|
||||||
|
on hackthebox</a></li>
|
||||||
|
<li class="fragment"><a href="https://tryhackme.com">Or Find even more
|
||||||
|
on tryhackme</a></li>
|
||||||
|
<li class="fragment">Download firmware of your favorite IoT
|
||||||
|
appliances</li>
|
||||||
|
</ul>
|
||||||
|
</section>
|
||||||
|
<section class="slide level1">
|
||||||
|
|
||||||
|
<h2 id="a-word-on-binary-obfuscation">A Word On Binary Obfuscation</h2>
|
||||||
|
<p>Software Obfuscation was born in 1984 at the <a
|
||||||
|
href="https://ioccc.org/">International Obfuscated C Code
|
||||||
|
Contest</a></p>
|
||||||
|
<p><img src="./images/donut.gif" alt="A donut as code compiles to a spinning donut by Jim Hague" width="50%" height="auto"></p>
|
||||||
|
</section>
|
||||||
|
<section class="slide level1">
|
||||||
|
|
||||||
|
<h3 id="what-exactly-might-be-obfuscated-in-your-code">What Exactly
|
||||||
|
might be Obfuscated in Your Code?</h3>
|
||||||
|
<section>
|
||||||
|
<a
|
||||||
|
href="https://cybersecurity.springeropen.com/track/pdf/10.1186/s42400-020-00049-3.pdf">Layered
|
||||||
|
obfuscation: a taxonomy of software obfuscation techniques for layered
|
||||||
|
security by Hui Xu et. al</a>
|
||||||
|
</section>
|
||||||
|
<section>
|
||||||
|
<ul>
|
||||||
|
<li class="fragment">Code Element Layers
|
||||||
|
<ul>
|
||||||
|
<li class="fragment">Layout</li>
|
||||||
|
<li class="fragment">Controls</li>
|
||||||
|
<li class="fragment">Data</li>
|
||||||
|
<li class="fragment">Methods</li>
|
||||||
|
<li class="fragment">Classes</li>
|
||||||
|
</ul></li>
|
||||||
|
</ul>
|
||||||
|
</section>
|
||||||
|
<section>
|
||||||
|
<ul>
|
||||||
|
<li class="fragment">Component
|
||||||
|
<ul>
|
||||||
|
<li class="fragment">Library Calls</li>
|
||||||
|
<li class="fragment">Used Resources</li>
|
||||||
|
</ul></li>
|
||||||
|
<li class="fragment">Application Layer
|
||||||
|
<ul>
|
||||||
|
<li class="fragment">DRM System</li>
|
||||||
|
<li class="fragment">Neural Networks</li>
|
||||||
|
</ul></li>
|
||||||
|
</ul>
|
||||||
|
</section>
|
||||||
|
</section>
|
||||||
|
<section class="slide level1">
|
||||||
|
|
||||||
|
<h2 id="techniques-of-obfuscation">Techniques of Obfuscation</h2>
|
||||||
|
</section>
|
||||||
|
<section class="slide level1">
|
||||||
|
|
||||||
|
<h3 id="splitting-merging-of-strings">Splitting & Merging of
|
||||||
|
Strings</h3>
|
||||||
|
<div class="sourceCode" id="cb3"><pre class="sourceCode sh"><code class="sourceCode bash"><span id="cb3-1"><a href="#cb3-1" aria-hidden="true" tabindex="-1"></a><span class="ex">a</span> = <span class="st">"BABE"</span></span>
|
||||||
|
<span id="cb3-2"><a href="#cb3-2" aria-hidden="true" tabindex="-1"></a><span class="ex">b</span> = <span class="st">"CAFFEE"</span></span>
|
||||||
|
<span id="cb3-3"><a href="#cb3-3" aria-hidden="true" tabindex="-1"></a><span class="ex">f</span><span class="st">"{b}{a}"</span></span></code></pre></div>
|
||||||
|
<p><a href="https://github.com/mandiant/flare-floss/">String
|
||||||
|
Deobfuscation with FLOSS</a></p>
|
||||||
|
</section>
|
||||||
|
<section class="slide level1">
|
||||||
|
|
||||||
|
<h2 id="packing">Packing</h2>
|
||||||
|
<p>Compress binary data</p>
|
||||||
|
<div class="sourceCode" id="cb4"><pre class="sourceCode sh"><code class="sourceCode bash"><span id="cb4-1"><a href="#cb4-1" aria-hidden="true" tabindex="-1"></a> <span class="ex">ooooo</span> ooo ooooooooo. ooooooo ooooo</span>
|
||||||
|
<span id="cb4-2"><a href="#cb4-2" aria-hidden="true" tabindex="-1"></a> <span class="kw">`</span><span class="ex">888</span><span class="st">' `8'</span> <span class="kw">`</span>888 <span class="kw">`</span><span class="ex">Y88.</span> <span class="kw">`</span>8888 d8<span class="st">'</span></span>
|
||||||
|
<span id="cb4-3"><a href="#cb4-3" aria-hidden="true" tabindex="-1"></a><span class="st"> 888 8 888 .d88'</span> Y888..8P</span>
|
||||||
|
<span id="cb4-4"><a href="#cb4-4" aria-hidden="true" tabindex="-1"></a> <span class="ex">888</span> 8 888ooo88P<span class="st">' `8888'</span></span>
|
||||||
|
<span id="cb4-5"><a href="#cb4-5" aria-hidden="true" tabindex="-1"></a> <span class="ex">888</span> 8 888 .8PY888.</span>
|
||||||
|
<span id="cb4-6"><a href="#cb4-6" aria-hidden="true" tabindex="-1"></a> <span class="kw">`</span><span class="ex">88.</span> .8<span class="st">' 888 d8'</span> <span class="kw">`</span>888b</span>
|
||||||
|
<span id="cb4-7"><a href="#cb4-7" aria-hidden="true" tabindex="-1"></a> <span class="kw">`</span><span class="ex">YbodP</span><span class="st">' o888o o888o o88888o</span></span></code></pre></div>
|
||||||
|
<p><a href="https://upx.github.io/">UPX Packer/Unpacker</a></p>
|
||||||
|
</section>
|
||||||
|
<section class="slide level1">
|
||||||
|
|
||||||
|
<h2 id="mangling">Mangling</h2>
|
||||||
|
Library symbols in compiled code for data that have the same name
|
||||||
|
<section>
|
||||||
|
<pre><code data-trim data-noescape>
|
||||||
|
c++filt
|
||||||
|
_ZNSt7__cxx1114collate_bynameIcEC2ERKNS_12basic_stringIcSt11char_traitsIcESaIcEEEm
|
||||||
|
std::__cxx11::collate_byname<char>::collate_byname(std::__cxx11::basic_string<char,
|
||||||
|
std::char_traits<char>, std::allocator<char> > const&, unsigned long)
|
||||||
|
</code></pre>
|
||||||
|
</section>
|
||||||
|
<section>
|
||||||
|
<a href="https://demangler.io/" alt="demangler">Online Demangler</a>
|
||||||
|
</section>
|
||||||
|
</section>
|
||||||
|
<section class="slide level1">
|
||||||
|
|
||||||
|
<h2 id="code-elements">Code Elements</h2>
|
||||||
|
<ul>
|
||||||
|
<li class="fragment">Adding Unnecessary Instructions</li>
|
||||||
|
<li class="fragment">Changing Control Flows</li>
|
||||||
|
<li class="fragment">Protecting Data</li>
|
||||||
|
</ul>
|
||||||
|
<p><img src="./images/spaghetti.jpg" alt="Convoluted Code" width="26%" height="auto%"></p>
|
||||||
|
</section>
|
||||||
|
<section class="slide level1">
|
||||||
|
|
||||||
|
<h3 id="deobfuscation-tools">Deobfuscation Tools</h3>
|
||||||
|
<ul>
|
||||||
|
<li class="fragment">DotNet
|
||||||
|
<ul>
|
||||||
|
<li class="fragment"><a href="https://github.com/de4dot/de4dot">de4dot
|
||||||
|
Deobfuscator and Unpacker</a></li>
|
||||||
|
<li class="fragment"><a href="https://github.com/dnSpy/dnSpy">dnSpy
|
||||||
|
Debugger and Assembly Editor</a></li>
|
||||||
|
<li class="fragment"><a
|
||||||
|
href="https://github.com/icsharpcode/ILSpy">ILSpy Decompiler instead of
|
||||||
|
Ghidra</a></li>
|
||||||
|
</ul></li>
|
||||||
|
</ul>
|
||||||
|
</section>
|
||||||
|
<section id="the-end" class="slide level1">
|
||||||
|
<h1>The End</h1>
|
||||||
|
</section>
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<script src="https://unpkg.com/reveal.js@^4//dist/reveal.js"></script>
|
||||||
|
|
||||||
|
<!-- reveal.js plugins -->
|
||||||
|
<script src="https://unpkg.com/reveal.js@^4//plugin/notes/notes.js"></script>
|
||||||
|
<script src="https://unpkg.com/reveal.js@^4//plugin/search/search.js"></script>
|
||||||
|
<script src="https://unpkg.com/reveal.js@^4//plugin/zoom/zoom.js"></script>
|
||||||
|
|
||||||
|
<script>
|
||||||
|
|
||||||
|
// Full list of configuration options available at:
|
||||||
|
// https://revealjs.com/config/
|
||||||
|
Reveal.initialize({
|
||||||
|
// Display controls in the bottom right corner
|
||||||
|
controls: true,
|
||||||
|
|
||||||
|
// Help the user learn the controls by providing hints, for example by
|
||||||
|
// bouncing the down arrow when they first encounter a vertical slide
|
||||||
|
controlsTutorial: true,
|
||||||
|
|
||||||
|
// Determines where controls appear, "edges" or "bottom-right"
|
||||||
|
controlsLayout: 'bottom-right',
|
||||||
|
|
||||||
|
// Visibility rule for backwards navigation arrows; "faded", "hidden"
|
||||||
|
// or "visible"
|
||||||
|
controlsBackArrows: 'faded',
|
||||||
|
|
||||||
|
// Display a presentation progress bar
|
||||||
|
progress: true,
|
||||||
|
|
||||||
|
// Display the page number of the current slide
|
||||||
|
slideNumber: false,
|
||||||
|
|
||||||
|
// 'all', 'print', or 'speaker'
|
||||||
|
showSlideNumber: 'all',
|
||||||
|
|
||||||
|
// Add the current slide number to the URL hash so that reloading the
|
||||||
|
// page/copying the URL will return you to the same slide
|
||||||
|
hash: true,
|
||||||
|
|
||||||
|
// Start with 1 for the hash rather than 0
|
||||||
|
hashOneBasedIndex: false,
|
||||||
|
|
||||||
|
// Flags if we should monitor the hash and change slides accordingly
|
||||||
|
respondToHashChanges: true,
|
||||||
|
|
||||||
|
// Push each slide change to the browser history
|
||||||
|
history: false,
|
||||||
|
|
||||||
|
// Enable keyboard shortcuts for navigation
|
||||||
|
keyboard: true,
|
||||||
|
|
||||||
|
// Enable the slide overview mode
|
||||||
|
overview: true,
|
||||||
|
|
||||||
|
// Disables the default reveal.js slide layout (scaling and centering)
|
||||||
|
// so that you can use custom CSS layout
|
||||||
|
disableLayout: false,
|
||||||
|
|
||||||
|
// Vertical centering of slides
|
||||||
|
center: true,
|
||||||
|
|
||||||
|
// Enables touch navigation on devices with touch input
|
||||||
|
touch: true,
|
||||||
|
|
||||||
|
// Loop the presentation
|
||||||
|
loop: false,
|
||||||
|
|
||||||
|
// Change the presentation direction to be RTL
|
||||||
|
rtl: false,
|
||||||
|
|
||||||
|
// see https://revealjs.com/vertical-slides/#navigation-mode
|
||||||
|
navigationMode: 'default',
|
||||||
|
|
||||||
|
// Randomizes the order of slides each time the presentation loads
|
||||||
|
shuffle: false,
|
||||||
|
|
||||||
|
// Turns fragments on and off globally
|
||||||
|
fragments: true,
|
||||||
|
|
||||||
|
// Flags whether to include the current fragment in the URL,
|
||||||
|
// so that reloading brings you to the same fragment position
|
||||||
|
fragmentInURL: true,
|
||||||
|
|
||||||
|
// Flags if the presentation is running in an embedded mode,
|
||||||
|
// i.e. contained within a limited portion of the screen
|
||||||
|
embedded: false,
|
||||||
|
|
||||||
|
// Flags if we should show a help overlay when the questionmark
|
||||||
|
// key is pressed
|
||||||
|
help: true,
|
||||||
|
|
||||||
|
// Flags if it should be possible to pause the presentation (blackout)
|
||||||
|
pause: true,
|
||||||
|
|
||||||
|
// Flags if speaker notes should be visible to all viewers
|
||||||
|
showNotes: false,
|
||||||
|
|
||||||
|
// Global override for autoplaying embedded media (null/true/false)
|
||||||
|
autoPlayMedia: null,
|
||||||
|
|
||||||
|
// Global override for preloading lazy-loaded iframes (null/true/false)
|
||||||
|
preloadIframes: null,
|
||||||
|
|
||||||
|
// Number of milliseconds between automatically proceeding to the
|
||||||
|
// next slide, disabled when set to 0, this value can be overwritten
|
||||||
|
// by using a data-autoslide attribute on your slides
|
||||||
|
autoSlide: 0,
|
||||||
|
|
||||||
|
// Stop auto-sliding after user input
|
||||||
|
autoSlideStoppable: true,
|
||||||
|
|
||||||
|
// Use this method for navigation when auto-sliding
|
||||||
|
autoSlideMethod: null,
|
||||||
|
|
||||||
|
// Specify the average time in seconds that you think you will spend
|
||||||
|
// presenting each slide. This is used to show a pacing timer in the
|
||||||
|
// speaker view
|
||||||
|
defaultTiming: null,
|
||||||
|
|
||||||
|
// Enable slide navigation via mouse wheel
|
||||||
|
mouseWheel: false,
|
||||||
|
|
||||||
|
// The display mode that will be used to show slides
|
||||||
|
display: 'block',
|
||||||
|
|
||||||
|
// Hide cursor if inactive
|
||||||
|
hideInactiveCursor: true,
|
||||||
|
|
||||||
|
// Time before the cursor is hidden (in ms)
|
||||||
|
hideCursorTime: 5000,
|
||||||
|
|
||||||
|
// Opens links in an iframe preview overlay
|
||||||
|
previewLinks: false,
|
||||||
|
|
||||||
|
// Transition style (none/fade/slide/convex/concave/zoom)
|
||||||
|
transition: 'slide',
|
||||||
|
|
||||||
|
// Transition speed (default/fast/slow)
|
||||||
|
transitionSpeed: 'default',
|
||||||
|
|
||||||
|
// Transition style for full page slide backgrounds
|
||||||
|
// (none/fade/slide/convex/concave/zoom)
|
||||||
|
backgroundTransition: 'fade',
|
||||||
|
|
||||||
|
// Number of slides away from the current that are visible
|
||||||
|
viewDistance: 3,
|
||||||
|
|
||||||
|
// Number of slides away from the current that are visible on mobile
|
||||||
|
// devices. It is advisable to set this to a lower number than
|
||||||
|
// viewDistance in order to save resources.
|
||||||
|
mobileViewDistance: 2,
|
||||||
|
|
||||||
|
// reveal.js plugins
|
||||||
|
plugins: [
|
||||||
|
RevealNotes,
|
||||||
|
RevealSearch,
|
||||||
|
RevealZoom
|
||||||
|
]
|
||||||
|
});
|
||||||
|
</script>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
|
|
@ -0,0 +1,52 @@
|
||||||
|
% Introduction to SQL Injection
|
||||||
|
% Stefan Friese
|
||||||
|
% 11 April, 2024
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
# Topics
|
||||||
|
|
||||||
|
* How an SQL Injection is Created
|
||||||
|
* How to Exploit an SQL Injection
|
||||||
|
* SPOILER: How to Prevent an SQL Injection in the Next Presentation
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## How Does it Happen
|
||||||
|
|
||||||
|
An SQL injection occurs when two things come together.
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### Number 1
|
||||||
|
|
||||||
|
An SQL Query as a string embedded in other languages
|
||||||
|
|
||||||
|
```python
|
||||||
|
sql_query =
|
||||||
|
cursor.execute(
|
||||||
|
"SELECT * FROM user_data where username = 'admin' and password = 's3cur3P4ssw0rd'"
|
||||||
|
)
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
### Number 2
|
||||||
|
|
||||||
|
User input is possible as a part of said SQL query
|
||||||
|
|
||||||
|
```python
|
||||||
|
sql_query =
|
||||||
|
cursor.execute(
|
||||||
|
"SELECT * FROM user_data where username = '%s' and password = '%s'",
|
||||||
|
% (username, password)
|
||||||
|
)
|
||||||
|
```
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
## How to Exploit an SQL Injection
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
# The End
|
||||||
Loading…
Reference in New Issue