SQL injection via network in Computer Networks - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to identify the type of attack shown in the network log.

Computer Networks

if packet.payload.contains('[1]'):
    alert('Possible SQL injection detected')

Drag options to blanks, or click blank then click option'

AUPDATE

BDROP

CINSERT

DSELECT

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing DROP or UPDATE which are less commonly the first sign of injection.

Confusing INSERT with SELECT in detection.

The keyword SELECT is commonly used in SQL injection attacks to extract data.

2fill in blank

medium

Complete the code to block SQL injection attempts by filtering input containing {{BLANK_1}}.

Computer Networks

def is_safe(input_string):
    return '[1]' not in input_string.upper()

Drag options to blanks, or click blank then click option'

ASELECT

BDROP

CDELETE

DINSERT

Attempts:

3 left

💡 Hint

Common Mistakes

Filtering only DROP or DELETE but missing SELECT.

Not converting input to uppercase before checking.

Filtering out SELECT helps prevent common SQL injection attempts.

3fill in blank

hard

Fix the error in the network filter rule to detect SQL injection containing {{BLANK_1}}.

Computer Networks

if '[1]' in packet.payload.lower():
    log('SQL injection attempt')

Drag options to blanks, or click blank then click option'

AselECT

BSELECT

Cselect

DSeLeCt

Attempts:

3 left

💡 Hint

Common Mistakes

Using uppercase SELECT when payload is lowercase.

Using mixed case which won't match.

The payload is converted to lowercase, so the keyword to check must be lowercase select.

4fill in blank

hard

Fill both blanks to create a network rule that detects SQL injection attempts with keywords and logical operators.

Computer Networks

if '[1]' in packet.payload and '[2]' in packet.payload:
    alert('SQL injection detected')

Drag options to blanks, or click blank then click option'

ASELECT

BOR

CAND

DDROP

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing AND instead of OR which is less common in injections.

Using DROP which is a command but not a logical operator.

SQL injection often uses SELECT with logical operator OR to manipulate queries.

5fill in blank

hard

Fill all three blanks to complete the network detection code for SQL injection using keyword, operator, and comment syntax.

Computer Networks

if '[1]' in packet.payload and '[2]' in packet.payload and '[3]' in packet.payload:
    block(packet)

Drag options to blanks, or click blank then click option'

ASELECT

BOR

C--

DDROP

Attempts:

3 left

💡 Hint

Common Mistakes

Using DROP instead of comment syntax --.

Missing the comment syntax which is crucial in injections.

SQL injection payloads often include SELECT, the logical operator OR, and the comment syntax -- to ignore the rest of the query.