mirror of
https://github.com/hohn/codeql-dataflow-sql-injection.git
synced 2025-12-16 10:13:04 +01:00
'Running the program' sequence added to slides
This commit is contained in:
committed by
=Michael Hohn
parent
90a3bee380
commit
b241632815
10
README.org
10
README.org
@@ -6,26 +6,32 @@
|
||||
\033[32m---- SQL injection demo ----\[\033[33m\033[0m\]
|
||||
$?:$ '
|
||||
|
||||
|
||||
|
||||
# Build
|
||||
./build.sh
|
||||
|
||||
# Prepare db
|
||||
./admin rm-db
|
||||
./admin create-db
|
||||
./admin show-db
|
||||
|
||||
# Add regular user interactively
|
||||
./add-user 2>> users.log
|
||||
First User
|
||||
|
||||
|
||||
# Check
|
||||
./admin show-db
|
||||
|
||||
# Regular user via "external" process
|
||||
echo "sample user" | ./add-user 2>> users.log
|
||||
echo "User Outside" | ./add-user 2>> users.log
|
||||
./admin show-db
|
||||
|
||||
# Add Johnny Droptable
|
||||
./add-user 2>> users.log
|
||||
Johnny'); DROP TABLE users; --
|
||||
|
||||
|
||||
# And the problem:
|
||||
./admin show-db
|
||||
|
||||
|
||||
4
admin
4
admin
@@ -1,4 +1,8 @@
|
||||
#!/bin/bash
|
||||
rm-db () {
|
||||
rm users.sqlite
|
||||
}
|
||||
|
||||
create-db () {
|
||||
echo '
|
||||
CREATE TABLE users (
|
||||
|
||||
BIN
dataflow.key
BIN
dataflow.key
Binary file not shown.
Reference in New Issue
Block a user