pov: bro falls for sql injection

@arjay_mccandless

94.3K followers · usually 36.8K views a post

Views

173.2K

Likes

9.3K

Comments

83

Shares

230

SoundTikTok sound · original sound - arjay_mccandless

Promoted product

Arjay McCandless's Stan Storehttps://stan.store/arjay_the_dev ↗

Why it worked

The video effectively uses a relatable "pov" scenario to explain a complex cybersecurity concept (SQL injection) in a simple and engaging way. The demonstration of a real-world vulnerability and its subsequent fix makes the content highly educational and shareable within the target audience of CS majors and developers.

Summary

The video explains SQL injection vulnerabilities in a food ordering app's API. It demonstrates how a user can exploit a simple GET request to drop the entire restaurant table. The creator then shows a safer way to handle user input by using parameterized queries to prevent such attacks.

Structure

1Explaining the architecture of a food ordering app API
2Demonstrating a vulnerable GET request
3Showing how SQL injection can be used to drop tables
4Explaining the risks of using user input directly in queries
5Presenting a safer method using parameterized queries

Product placement

The video demonstrates SQL injection vulnerabilities and then presents a safer coding practice, implicitly promoting the creator's expertise and potentially their services or resources available through their Stan Store.

Original caption

pov: sql injection #cybersecurity #systemdesign #sql #csmajors

More from @arjay_mccandless

On-screen text

pov: bro falls for sql injection Restaurants API Node.js Express JS User on Laptop Postgres HEY MAN HERE'S THE ARCHITECTURE FOR THE RESTAURANTS API FOR THE FOOD ORDERING APP Looks nice and cheap CAN YOU WALK ME THROUGH HOW A GET OUR DATABASE Get Restaurants Database Querying GET /restaurant?name=pizza SQL Query: SELECT * FROM restaurants WHERE name = '{name}'; SELECT * FROM restaurants WHERE name = 'pizza'; THE APIS ARE SUPER SIMPLE GET REQUEST IN WHATEVER NAME THEY WANT FOR A RESTAURANT AND AND THAT'S JUST GONNA DIRECTLY GO STRAIGHT INTO THIS SEQUEL QUERY TO GET THE INFORMATION WAIT YOU'RE USING USER ENTERED INFORMATION DIRECTLY IN A SEQUEL QUERY SOMETHING LIKE 1 EQUALS 1 I HUH SO BECAUSE 1 EQUALS 1 IS TRUE RETURN OUR ENTIRE TABLE TO THEM YEAH AND THEY CAN USE THAT SAME SYNTAX TO RUN ANY SEQUEL COMMAND THEY WANT I MEAN I GUESS ALL THEY'RE DOING IS JUST READING OUR TABLE RESTAURANTS ANYWAYS OKAY RUN A COMMAND LIKE DROP TABLE WAIT BECAUSE THIS IS MY API THEY CAN LITERALLY DROP THE ENTIRE RESTAURANT'S TABLE AND DELETE OUR WHOLE DATABASE YES BUT SQL INJECTION HAS LITERALLY BEEN AROUND FOR DECADES SO THERE'S SO MANY EASY WAYS TO PREVENT IT SOMETHING LIKE THIS HAHA OKAY Safer Call User inputs: GET /restaurant?name=pizza; DROP TABLE restaurants; -- const query = `SELECT * FROM restaurants WHERE name = $1`; const result = await pool.query(query, [query.name]); REALLY NICE AND AN EASY FIX THANKS BRO

Transcript

Hey man here's the architecture for the restaurants API for the food ordering app. Looks nice and cheap. Can you walk me through how a get request might look to our database? The APIs are super simple. We just have this get request and users can put in whatever name they want for a restaurant and that's just gonna directly go straight into this sequel query to get the information. Wait, you're using user entered information directly in a sequel query? What if they do something like 1 equals 1? Huh? So because 1 equals 1 is true, this is just gonna return our entire table to them. Yeah. And they can use that same syntax to run any sequel command they want. Yeah. I mean, I guess all they're doing is just reading our table. Restaurants anyways, okay. Run a command like drop table. Wait. Because this is my API, they can literally drop the entire restaurant's table and delete our whole database? Yes. But SQL injection has literally been around for decades. So there's so many easy ways to prevent it. Something like this, haha. Okay. Oh, okay. I see. This is really nice and an easy fix. Thanks bro.