SQL attacks, Session Hijacking

Introduction
By increasing the worth of technology, people become more advanced with the
passage of time. All day to day transactions are done by electronically using web-
based applications for example e-shopping, online banking or online booking etc.
Web applications provides services to different users, multiple users use web bases
application for multiple tasks. Applications used by web paid great roles of crumble
and improvement of succeed results. All the data travelled by network is stored in
databases and the databases is not too much secured to protect data. Databases
where this material is located, extremely effect by SQL injection attacks, in which
an attacker or eavesdropper put some statements that in return may give them
access to that databases. The attacker can get illegal entree to the database and
the web-based submission and cause much destruction by misusing the weakness
of web application and database.
Some important problems that are occurring in web-based applications are:
Structure Query Language Injection (SQLi), Cross site scripting, Cross site Request
Forgery, Local File Inclusion, Local File disclosure, Broken authentication & Session
management. In recent history, performance measurements of web-based
applications are taken by two main belongings, authentication and session
management. We define user authentication as a situation when a valid user of
web applications accidentally or suddenly disconnect with his communication
while the session is going on or in network, at the same time an invalid or
unauthorized user pick the same session of valid user and present like real one and
get entry into session and start communication over the network. Broken
Authentication is a problem occur due to misconfiguration of session management.

1
Cracked Authentication and Session Management susceptibility misuse risk is
becoming extremely higher due to attackers’ artistic services, weak key points in
system designing and improper execution of applications used by web. The
significance of the above misuse may result not only individuality theft but also
removal/alter private information.
Session is works like a storage media or a data structure which stores information
of a user for a limited period when he/she get entry into system by providing
credentials as a login till then he/she get completed by logging out. The session
which is associated to a user is identify by the mean of a session token, which is
created by the server and transfer to web as a cookie. A session is created when a
single user or multiple users request for a login to web browser for data
communication by providing the credentials like username or password etc.
It is also known as HTTP cookie theft or magic cookie hack. A cookie that is used to
authenticate a user on a computer is called Magic cookie. To maintain the sessions
on www and storage of remote address is done by cookies.
But cookies are not a secure source of storing addresses and for maintaining a
connection between end users and server computers, cookies also have many
limitations with them, they contain several security risks, they may divert to a task
or a function for which they were not introduced. Cookies are motionless, a
challenger can use them to get unauthorized access to the user’s session. While
theses session hijacking attacks are occurred frequently, a substantial number of
www applications are still defenseless.
Here we analyzed the authentication defenselessness attack i.e. Broken
Authentication and Session Management, its misuse types and their impact upon
inspecting on 267 websites of public and private sectors in Bangladesh. 56%

2
websites of our samples were found weak with the given weaknesses by directing
the scrutiny using manual diffusion testing method following double blind testing
policy. The result shows the impact and percentage of this susceptibility attacks.
In 2015, Pakistani hackers spoiled more than 180 websites of Bangladesh for the
problems of broken authentication. Ranges of vulnerability exploitations by the
Pakistani hackers were 63% of broken authentication vulnerability, 26% in SQL
injection.
Literature Review
These days web applications are most susceptible to SQLIAs. Mostly data of
manipulators are extracted from the web and stored in the databases. SQL attacks
can cause of many threats to this data, just like harm of data, effect the privacy of
data, theft of users, steeling customer data security, identity fraud etc. It is also
possible by attacker to get control of the system by some tricks of programming or
something else, he or she can pretend as an actual user on the web and can works
like a real user of that system. Garter group makes a study of these types of attacks
, according to them about 300 websites or web applications are under the SQLI
attacks. In the term of Injection, these attacks occur when a person on the attacker
side or we cam say intruder put some additional inputs or statements in the SQL
quires for the sake of getting entry in the system as a authentic person, in this way
they can do this and can break security of the system or web application, they can
steel confidential information of the user and make them misuse. [1]
We discussed session hijacking and session side jacking both terms in one meaning,
getting unauthorized access to an authentic system by entering in already formed
session for the sake of steeling information or loss of confidential information
Known as Man-in-the-Middle Attack. A person who is an authentic user of a system

3
or effectively entered into the system by providing credentials. Webserver
maintain a session of that user and server to communicate over the network. As a
session hijacking attacker or intruder gets the access of the system by effecting
session maintained between user and server, Attacker receipts the control from
valid user and pretend himself as an actual user of that session and replay back.
Session hijacking is just like listening someone , he or she can not make any changes
between the communications or break of the defense of firewalls.[2]
In recent history, an open basis tool which programs the process of perceiving and
manipulating command injection faults on web applications. All the phases which
are required include a) attack vector creation, b) susceptibility discovery c)
manipulation. It is designed and maintained for a modular approach and is supports
an excess of functionalities that trying to cover different manipulating situations
just like different validation instrument, custom header, tor networking, attacks
that are generated by programming tools, system and user record etc. In this
research they also present an un-documented approach for blind command
injections. In this an enemy can use passing manuals, to store output of inserted
commands in a text file and after that, time-based facility inserting procedure is
used to deliver the insides of the text file. Commix improved discovery and
manipulation abilities associated to other similar tools.[3]
Some challenges that are web bases applications are facing covering through some
studies of decision, so that persons and huge number of managements could make
familiar judgments about and emergent threats of modern web-based applications
and related problems and challenges. They discussed possible flaws of web-based
applications such as level of manipulating of attacks vectors, occurrence, detection

4
properties. Threat Evaluation Practice is also used, which specifies different factors
to support the level of threat equivalent to a familiar susceptibility.[4]
Man-in-the-Middle Attack is also a part of session hijacking or session attacks. In
this attacker switch between communication point, invader also locate on one
similar network or communication channel where the user is located. Attacker
divides the TCP in two different parts, one is maintained among user and attacker
and second is maintained among invader and server. In a less protect link like HTTP,
communication of both users can easily hack by intruder without any problem. In
HTTPS linking a single TCP protocol is achieved by making two independents SSL
linking. This immoral type of attack can affect a country’s economy and can be a
reason of disputes between different entities for theft, changing, loss of data,
private methods etc. But there are no future research directions in this study for
Man-in-the-Middle attack.[5]
A proxy-based method is also used for session management, known as cookies Wall
at the client side to droplet the reply/packet contains cookies. Cookies Wall is
applied by using python code and compared with some of the popular existing
schemes. Cookies Wall is efficient and faster.[6]

5
References
[1] K. D’silva, J. Vanajakshi, K. N. Manjunath, and S. Prabhu, “An effective method for preventing SQL
injection attack and session hijacking,” RTEICT 2017 - 2nd IEEE Int. Conf. Recent Trends Electron. Inf.
Commun. Technol. Proc., vol. 2018-January, pp. 697–701, 2018.

[2] P. Kamal, “State of the Art Survey on Session Hijacking,” Glob. J. Comput. Sci. Tecnol., vol. 16, no. 1,
pp. 39–49, 2016.

[3] A. Stasinopoulos and C. Ntantogian, “injections. Although there are many software tools to detect
and exploit other no dedicated and specialized software that detects and exploits, automatically, that
automates the process of detecting and exploiting command injection mix). We present an,” pp. 1–54,
2018.

[4] S. Gupta and B. B. Gupta, “Detection, Avoidance, and Attack Pattern Mechanisms in Modern Web
Application Vulnerabilities,” Int. J. Cloud Appl. Comput., vol. 7, no. 3, pp. 1–43, 2017.

[5] A. Mallik, A. Ahsan, M. M. Z. Shahadat, and J.-C. Tsou, “Man-in-the-middle-attack: Understanding in

simple words,” Int. J. Data New. Sci., vol. 3, pp. 77–92, 2019.

[6] W. Zhou and Y. Xiang, “Network and system security,” J. Netw. Comput. Appl., vol. 32, no. 2, pp. 345–
346, 2009.