University of Waterloo

• ECE 458

• Suggested Solutions to Selected Practice Problems – Set #5 1 – SQL Injection A certain website stores a cookie with name sessionid and value 751345244 on your browser. (a) Speculate on what purpose this cookie serves. (b) Speculate on the general format that this cookie would have. We notice that it only has numeric digits; since it is quite a few, we can reasonably speculate that it is not a hex-encoded numeric value; being in the order of 700 million, it makes sense to speculate that it is a 32-bit integer; maybe signed, maybe unsigned (why are both reasonable guesses? why is, say, 64-bit integer value not a reasonable guess? ) (c) Speculate on how this cookie is used by the server application that receives it (or more in general, the server applications (plural) that receive it). See OWASP page on Session management (posted on LEARN, but you can just do a Google search for it). (d) What could be the goal of an SQL injection attack using this cookie? Show the details of such an attack (i.e., what you would need to do, and how you would accomplish that). An attacker can “hand craft” a cookie with that name and value texttt1 or true under the guess that the server will do an SQL statement to verify whether the cookie is valid (and of course under the hope that it will not have SQLi countermeasures in place); the injected “or true” would make the SQL statement return a non-zero number of rows, and that may be all that the server application checks (e) Design validation and all necessary sanitation procedures for the server application in relation to this cookie. See slides (and/or the OWASP / Wikipedia pages on this). Notice that this question is particularly open-ended; it is intended to illustrate the problems that hackers face (which may be extremely open-ended), and in particular, it’s intended to help you estimate what sorts of things hackers (the malicious ones, the bad guys) could conceivably think of about systems that you (the good guys) design! BTW, if you have additional ideas about what the application could do with that cookie, and for which the attack would be different, please let me know, and I will amend this suggested answer. 2 – Web Security (SQLi, XSS, XSRF) In a LinkedIn-like (or Facebook-like, etc.) system, you have a certain network of contacts— other users of that same system. When you log in, you are taken to a page that displays something like (example given for my account, assuming tha