Demo time for injection.
Yeah, we're looking specifically at sequel injection.
There are some defenses that are specific to sequel and that's what we're
focusing on this applies to creating raw sequel strings using link to generate
your entity framework queries already parameterizes them.
And so it won't be a problem.
The SVS requirement 5.3 0.4 verifies that data selection or
database queries are parameterized for both AD O .NET queries
and entity framework queries.
We're going to see how we can do just that in our survey controller.
A quick note on link here,
we've got some link using first or default with a Lambda which is
effectively saying give us the rule where the id is the id passed in
from a web request using a link like this is safe because it does
parameterize values for you scrolling up.
We've got survey complete message ado which is using ADO .NET
to make a raw SQL query in the interface.
We're going to see how it's used normally after completing a survey,
it can be used to deliver a completion message.
The id in the UOL is a string.
So it is lacking input validation.
If we change that we can add a single quote.
And the response gives us an error that strongly
suggests we have a sequel injection issue,
adding all one equals one hyphen hyphen,
we get the message from two surveys.
There are only two rows in the database that shows us we've
managed to use all one equals one as a command.
This verifies that we can send commands to the database from there.
We would be able to do other things like drop tables perhaps to fix
that we're putting our query into command text.
But using at ID as the placeholder in there,
instead of concatenating the id into the string,
we're then using command dot parameters dot A to create a
parameter with the name ID and the value from the ID that
should be it back to the interface.
It works for a valid id.
If we add a single chord, it returns nothing.
That's because it's trying to find an id with a single quote on the end,
it looks like we've got a defense at the rest of the injection.
Again,
we can see it doesn't work moving on to and I
framework RL is slightly different,
but the functionality is the same going to that it works.
We add a single court and there's an error to suggest vulnerability,
adding the injection and we get both records so that is vulnerable to the code.
And we're just going to make a slight change instead of
concatenating the value into the string,
we're adding a placeholder then providing the ID as a parameter.
We can add as many placeholders and parameters as we need here.
And that's it running that again.
It still works from the correct id.
So we add a single quote which gives us an empty page.
Adding the full injection also doesn't help.
That's both ED and entity framework protections working.