CS 595G: Hack Meetings

Shellphish

Me

• Paul Grosen
• Senior at Dos Pueblos
• Hacking for about 5 years now
• Started by reverse engineering games
• Later, played in CTFs
• Joined Shellphish about 2.5 years ago during the Cyber Grand Challenge
• Endless hacking since!

This class

• Series of presentations on various security concepts
• Feel free to ask questions during talks!
• Most sessions will involve a “challenge” afterwards that you will attempt and hopefully solve
• See int80.net/cs595g/ for class links
• Prior Knowledge
• Basic command line concepts
• You’ll need to be able to manage a linux server over ssh
• Some python knowledge strongly encouraged, but you can pick this up during the quarter with a little extra effort outside class
• Please enroll via UCSB Gold!
• CMPSC 595G: Group Studies in Computer Science: Security (81042)
• If you’re an undergrad you will need to petition for this, which requires Giovanni’s signature

Requirements

• Come to the meetings!
• You won’t pass if you don’t come regularly
• Bring a laptop
• Don’t worry about performance -- we won’t do anything computationally intensive
• Have some method of connecting over ssh
• ssh on linux/mac
• PuTTY on Windows
• Watch the Slack for announcements
• You can configure it to send you emails if you like
• Complete the challenges (They’re really not that hard!)

SQL

• Structured Query Language
• Each database has a number of tables
• Each table has a “schema” attached that specifies a number of named, typed “columns”
• Each table contains a number of “rows” that hold concrete values

​

Table Creation

• The CREATE TABLE statement
• CREATE TABLE users (username TEXT, password TEXT, id INTEGER)
• Optionally, use CREATE TABLE IF NOT EXISTS users (...) to prevent creation if the table is already in the database

​

Inserting Rows

• The INSERT statement
• INSERT INTO users VALUES (‘paul’, ‘foo’, 4), (‘john’, ‘bar’, 3)

​

Selecting Rows

• The SELECT statement
• SELECT password FROM users WHERE username=’paul’
• Optionally, select multiple columns at once:
• SELECT password, id FROM users WHERE username=’paul’
• SELECT * FROM users WHERE username=’paul’
• Use logic operators to join filter clauses
• SELECT password, id FROM users WHERE username=’paul’ AND id=4
• Select multiple rows at once
• SELECT * FROM users WHERE lastname=’grosen’

Interacting with an SQL engine (sqlite3)

The database object represents a connection to a database:

1 | db = sqlite3.connect(“sqlite3:////path/to/database.db”)

​

The “cursor” allows for manipulation of data:

2 | cursor = db.cursor()

​

The .execute method enables execution of queries:

3 | cursor.execute(“CREATE TABLE IF NOT EXISTS users (...)”)

​

If a statement is intended to make changes to the database, be sure to commit:

4 | db.commit()

​

Interacting with an SQL engine (sqlite3)

To get rows (e.g. via SELECT), also use .execute:

5 | cursor.execute(“SELECT * FROM users”)

​

Then grab the results using .fetchone or .fetchall:

6 | print cursor.fetchall()

​

The Row object, returned from a fetch, acts like a tuple and dictionary:

7 | print cursor.fetchone()[“id”]

​

Prepared statements

Sometimes, you might want to pass a value into a statement; for example, you might try:

8 | “SELECT * FROM users WHERE username=’%s’” % (creds[0])

​

​

Why should you NEVER, EVER do this?

​

Prepared statements

Sometimes, you might want to pass a value into a statement; for example, you might try:

8 | “SELECT * FROM users WHERE username=’%s’” % (creds[0])

​

• What if someone put a single-quote in their credentials?
• The SQL query would no longer be valid
• An attacker can use this to “escape” the string and begin to append custom query parameters
• For example, ‘ OR <some clause> could make for an easy bypass of the intended check

​

Prepared statements

Instead, let the API pass the parameters to the engine for you:

8 | c.execute(“SELECT * FROM users WHERE username=’?’”, creds[0])

​

The 595G Server System

595G Servers

• Each of you will receive access to a server in the AWS cloud
• You will use it to complete the weekly challenges
• You are free to use your own computers to work on the challenges, but you need to submit solutions on your server

Please go add your handle and email to the sheet at

int80.net/cs595g/servers.html

github.com/pcgrosen/595g-files/

​

This week

• Solve admin-login