SQL Injections

This repo contains a complete application to perform SQL injections.

• The application is a course finder that searches through a database called "unsw" (unsw.sql)
• The python code then returns the results and renders them for a web browser

This application was used in the following videos:

• SQL Injections - part 1
• SQL Injections - part 2

Installation

Requirements: Python 3

# run the script for your platform
./install/linux.sh
./install/mac.sh

# common steps
./install/initdb.sh
python3 -m pip install psycopg2-binary flask

Execution

# run server with unsafe sql query
python3 run.py

# run server resistant to sql injections
python3 run.py --use-safe

# a walkthrough of the thought process of running sql 
# injections can be found in the inject.sql file

Inspecting Database

# list all databases
psql -l

# enter our database
psql unsw
\d          # list tables
\d people   # list schema of 'people' table
\q          # exit out of psql shell