What Is SQL Injection?
Hacksplaining
https://www.youtube.com/watch?v=wcaiKgQU6VE

Transkript (automatisch erstellt)

0:03 [Music] Welcome to the hack explaining video tutorial series. In this video, we will
0:14 learn about SQL injection. One of the most common and dangerous methods hackers can use to attack your website. This is the vulnerable application we'll
0:23 be trying to hack with a SQL injection attack. Here are the application logs. Watch what happens here when we interact with the vulnerable application.
0:35 First, let's try guessing the password. Okay, so guessing the password didn't work. Let's try adding a quote character
0:49 after the password. The application crashed with an unexpected error. What could that mean?
1:00 The logs show a SQL syntax error. This indicates that the quote character messed something up in an unexpected way.
1:09 This is what the application code looks like behind the scenes. Watch how the SQL code gets built as we enter the login details. Let's enter the password
1:18 with a trailing quote character once more. The quote is inserted directly into the SQL string and terminates the query
1:29 early. This is what caused the syntax error we saw in the logs. This behavior indicates that the application might be vulnerable to SQL
1:38 injection. Now let's try a specifically crafted password.
1:53 And we're in. We successfully gained access to the application without having to guess the password using SQL injection.
2:01 The double dashes we entered caused the database to ignore the rest of the SQL statement, allowing us to be authenticated without having to supply
2:08 the real password. SQL injection is one of the most prevalent vulnerabilities on the
2:15 internet. If you only have time to protect yourself against one vulnerability, you should be checking for SQL injection in your codebase.
2:23 Click on the link to learn how to protect yourself or move on to the next video.
2:31 [Music]