SQL Injection Demo

This project demonstrates the difference between a web application that is vulnerable to SQL Injection attacks and one that is protected using parameterized queries.

Project Overview

This application consists of two different websites:

1. Vulnerable Website: Allows SQL injection attacks because it directly concatenates user input into SQL queries.
2. Secure Website: Prevents SQL injection attacks by using parameterized queries.

Both websites have:

• Login pages that require correct user ID and password
• User registration pages
• Dashboard pages that display sensitive data after successful authentication

Features

• User authentication with MD5 hashed passwords
• Demonstration of SQL injection vulnerabilities
• Comparison of vulnerable vs. secure coding practices
• PostgreSQL database integration

Prerequisites

• Node.js (v18 or higher)
• PostgreSQL database
• npm or yarn

Setup Instructions

1. Clone the repository:

   git clone [repository-url]
   cd [repository-directory]
   

2. Install dependencies:

   npm install
   

3. Configure your PostgreSQL database:

   • Create a PostgreSQL database named authdb
   • Update the database connection details in src/env.ts if necessary

4. Set up the database tables and seed data:

   npm run setup-db
   

   This will create the necessary tables and add sample users:

   • Username: admin, Password: admin123
   • Username: user, Password: user123

5. Start the development server:

   npm run dev
   

6. Access the application: Open your browser and navigate to http://localhost:3000

SQL Injection Examples (Vulnerable App)

Here are some examples of SQL injection attacks you can try on the vulnerable app:

1. Login Bypass:

   • Username: admin' --
   • Password: (anything)

2. Always True Condition:

   • Username: ' OR '1'='1
   • Password: ' OR '1'='1

3. Dangerous Operations (prevented in this demo):

   • Username: admin'; DROP TABLE users; --
   • Password: (anything)

Security Implementation

Vulnerable Implementation

The vulnerable version builds SQL queries by directly concatenating user input:

const sql = `SELECT * FROM users WHERE username = '${username}' AND password = '${hashedPassword}'`;

Secure Implementation

The secure version uses parameterized queries to prevent SQL injection:

const sql = 'SELECT * FROM users WHERE username = $1 AND password = $2';
const result = await pool.query(sql, [username, hashedPassword]);

License

This project is for educational purposes only.

Disclaimer

This application intentionally contains security vulnerabilities for demonstration purposes. Do not use this code in production environments.