Not sure if I can even ask about this type of stuff but...

Just wondering if anybody has done the Lampsec CTF (Capture the flag) 4-9, we're working on it as a group project in class and we're trying to sanitize the input on each machine and fix them from the vulnerable attacks. (After doing them of course before)

I'm wondering how you guys would fix the sql injections - don't answer if this is gonna get me in trouble, but basically sanitizing input from future attacks and keeping the others out from using such attacks. (CTF only - their systems)

Thanks,
Trev

To sanitize sql injection switch to a prepared statements base like PDO. This will stop sql injections becuase it runs a prepared statement to get the results and then applies user inputed data to filter the returned results. This causes user data to never come in contact with mysql.

If you are talking about sanitizing input from other languages and projects like say a custom webserver or something, then there are a entire list of things to check and remove from single quotes to dashes to inline comments, sql queries, basically anything that should not be there. For example if the page requests a GET parameter of ID=3, then it should expect an integer and not something like "3 AND ASCII(SUBSTRING((SELECT user FROM userbase limit 1,1) FROM 1 FOR 1)) > 60"

If this is for a specific application you might want to disclose the source or something because there are to many ways to try to patch code, some simpler than others.

This post was edited by AbDuCt on Oct 2 2014 05:53pm

Okay sweet, the first idea kinda fills what we're doing! I'll do some more researching on what you said and what we're trying to do, bringing the ideas to class on tuesday so just want to have a handle on things before we try to implement anything.

Thanks a bunch! I may have some more questions after I look some more

If this is for a class I would recommend a prepared statement solution such as MYSQL PDO. Rolling your own protection scheme (such as sanitizing the input by hand) is a waste of time and likely to fail, while using a popular proven solution is much better.


You can find the php PDO manual here: http://php.net/manual/en/ref.pdo-mysql.php

And a quick definition of what it does:



http://en.wikipedia.org/wiki/Prepared_statement

This post was edited by AbDuCt on Oct 2 2014 06:49pm

Okay sweet, I'll check it out!