5

My team is testing some products where we have forgone SQL as the back-end. This means that we have stopped executing any security tests around SQL injection. I have this nagging suspicion that while SQL injection is not possible, that other similar injection attacks specific to these other technologies could be possible, but I have not had much time myself to put into researching those. The two non SQL solutions that we are using specifically are HBase(on top of Hadoop) and Cassandra.

Does anyone have any good ideas around how to test this or has anyone found any good reading, examples or approaches to discovering and testing these potential attacks? Alternatively any reading or explanation that could put my mind at ease and convince me these attacks aren't possible? I have searched a bit and had no luck finding any useful information on the subject.

Improve this question

2 Answers 2

Reset to default
5

Injection Attacks can be thought of as a generalized version of SQL Injection Attacks.

Any attack which uses techniques similar to SQL injection to insert characters in the front end to invoke unexpected actions on the back end can be thought of as an Injection Attack.

Consider what kinds of escape characters, improper type handling, etc could make their way to your back end if not properly filtered. Once the back end parses the query, bad thinks could happen.

This might help: http://comments.gmane.org/gmane.comp.db.cassandra.user/17844

Improve this answer
2
  • Thanks, we're still following practices to escape characters, etc. My real concerns are that there is a lot of knowledge and specific tools and examples around SQL injection and much less info for injection against other nosql solutions.
    – Sam Woods
    Dec 14, 2012 at 20:19
  • I'm accepting this answer as it answers the question around CQL attacks. I still would like to see some tools/canned attacks, and would like to find some info specific to hbase injection attacks.
    – Sam Woods
    Dec 18, 2012 at 19:50
2

this link will not put your mind at ease but might be a starting off point for you

( google Cassandra security for more ideas )

Improve this answer
1
  • Thanks Phil, I have seen some of this information, I guess my real problem is that I feel like there are too many unknowns for me. I can find a thousand sql injection attacks with a quick search, but would have to create my own list of potential CQL injection attacks to add to my testing/automation.
    – Sam Woods
    Dec 14, 2012 at 20:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.