Skip to content

Commit 0c7da41

Browse files
li-xin-yili-xin-yi
committed
typo
1 parent 59c63a9 commit 0c7da41

File tree

3 files changed

+17
-17
lines changed

3 files changed

+17
-17
lines changed

Diff for: ‎README.md

+8-8
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,13 @@
55
![api](https://img.shields.io/static/v1?label=API%20level&message=17&color=informational&style=flat-square)
66

77

8-
It is an android application designed to show how a SQL-injection attack works on mobile platforms. I released both source code and [apk](https://github.com/li-xin-yi/SQL-inject-demo/releases/tag/v0.0.2) file only for some purposes of teaching in college. It can not be directly used in any productive environment. I adapt [SQL Injection Attack Lab](https://seedsecuritylabs.org/Labs_16.04/PDF/Web_SQL_Injection.pdf) from [SEED project](https://seedsecuritylabs.org/) and build a similar employee management system, instead of hosting a remote MySQL database server for a *web application*, I integrate the SQLite database inside the *mobile application*. Several common SQL-injection attack can be simply explored on this app. Besides, It also provides an interface to add/update/delete employee data for an Admin account, which may be helpful to customize the instance data in a more flexible way.
8+
It is an android application designed to show how a SQL-injection attack works on mobile platforms. I released both source code and [apk](https://github.com/li-xin-yi/SQL-inject-demo/releases/tag/v0.0.3) file only for some purposes of teaching in college. It can not be directly used in any productive environment. I adapt [SQL Injection Attack Lab](https://seedsecuritylabs.org/Labs_16.04/PDF/Web_SQL_Injection.pdf) from [SEED project](https://seedsecuritylabs.org/) and build a similar employee management system, instead of hosting a remote MySQL database server for a *web application*, I integrate the SQLite database inside the *mobile application*. Several common SQL-injection attack can be simply explored on this app. Besides, It also provides an interface to add/update/delete employee data for an Admin account, which may be helpful to customize the instance data in a more flexible way.
99

1010
I have almost no knowledge about Android or Java before, neither about any UI design. So I am sorry that the code and app may look ugly and even buggy. **I will appreciate it if you give me any advice on improving it. **The project is built with Android API level 17, I have tested it on emulators of API 25 (Pixel 2) and API 30 (Pixel 3a). I don't know if it also works properly on other qualified android release version. (>=4.1)
1111

1212
More information:
1313

14-
- [APK Download](https://github.com/li-xin-yi/SQL-inject-demo/releases/download/v0.0.2/sql-inject-demo.apk)
14+
- [APK Download](https://github.com/li-xin-yi/SQL-inject-demo/releases/download/v0.0.3/sql-inject-demo.apk)
1515
- [Lab Manual](https://security-summer-labs.readthedocs.io/en/latest/lab8/readme.html)
1616
- A survey about SQL injection attack: [Detection and prevention of sql injection attack: A survey](https://www.researchgate.net/profile/Zainab-Alwan-5/publication/320108029_Detection_and_Prevention_of_SQL_Injection_Attack_A_Survey/links/59ce63840f7e9b4fd7e1b495/Detection-and-Prevention-of-SQL-Injection-Attack-A-Survey.pdf)
1717

@@ -21,12 +21,12 @@ The `employee` table in the initial database `Employee.db` on this app is:
2121

2222
ID | Name | Password | SSN | Salary | Nickname | Phone | Email | Address | Birthday
2323
---|---|---|---|---|---|---|---|---|---|
24-
99999 | Admin | admin | 43254314 | 400000 | Ad | (403)220-1191 | [email protected] | Gryffindor House | 1990-03-05
25-
10000 | Alice | alice | 10211002 | 20000 | Ali | (400)210-2112 | [email protected] | Gryffindor House | 2000-09-20
26-
20000 | Boby | boby | 10213352 | 50000 | Bob | (404)789-2313 | [email protected] | Hufflepuff House | 2000-04-20
27-
30000 | Ryan | ryan | 32193525 | 90000| Ryanny | (210)096-3287 | [email protected] | Ravenclaw House | 2000-04-10
28-
40000 | Samy | samy | 32111111 | 40000 | Sam | (450)218-8876 | [email protected] | Slytherin House | 2000-01-11
29-
50000 | Ted | ted | 24343244 | 110000 | Teddy | (208)222-8712 | [email protected] | Azkaban | 2000-11-03
24+
99999 | Admin | admin | 43254314 | 400000 | Admin | (403) 220-1191 | [email protected] | Gryffindor House | 1990-03-05
25+
10000 | Alice | alice | 10211002 | 20000 | Alice | (400)210-2112 | [email protected] | Gryffindor House | 2000-09-20
26+
20000 | Bobby | bobby | 10213352 | 50000 | Bob | (404) 789-2313 | [email protected] | Hufflepuff House | 2000-04-20
27+
30000 | Ryan | ryan | 32193525 | 90000| Ryanny | (210) 096-3287 | [email protected] | Ravenclaw House | 2000-04-10
28+
40000 | Sammy | sammy | 32111111 | 40000 | Sam | (450) 218-8876 | [email protected] | Slytherin House | 2000-01-11
29+
50000 | Ted | ted | 24343244 | 110000 | Teddy | (208) 222-8712 | [email protected] | Azkaban | 2000-11-03
3030

3131
Anytime you want to recover the data as above, press "RESET" button on the login screen.
3232

Diff for: ‎app/src/main/java/com/example/sql_inject_demo/DBHandler.java

+8-8
Original file line numberDiff line numberDiff line change
@@ -36,17 +36,17 @@ public void onCreate(SQLiteDatabase db) {
3636
+ "BIRTHDAY DATE, PRIMARY KEY(ID, NAME))";
3737
db.execSQL(SQL_CREATE_TABLE);
3838
addHandler(db,new Employee(99999, "Admin", "admin", "43254314",
39-
"Ad", "(403)220-1191", "[email protected]", "Gryffindor House", 400000, "1990-03-05"));
39+
"Admin", "(403) 220-1191", "[email protected]", "Gryffindor House", 400000, "1990-03-05"));
4040
addHandler(db, new Employee(10000, "Alice", "alice", "10211002",
41-
"Ali", "(400)210-2112", "[email protected]", "Gryffindor House", 20000, "2000-09-20"));
42-
addHandler(db, new Employee(20000, "Boby", "boby", "10213352",
43-
"Bob", "(404)789-2313", "[email protected]", "Hufflepuff House", 50000, "2000-04-20"));
41+
"Alice", "(400) 210-2112", "[email protected]", "Gryffindor House", 20000, "2000-09-20"));
42+
addHandler(db, new Employee(20000, "Bobby", "bobby", "10213352",
43+
"Bob", "(404) 789-2313", "[email protected]", "Hufflepuff House", 50000, "2000-04-20"));
4444
addHandler(db, new Employee(30000, "Ryan", "ryan", "32193525",
45-
"Ryanny", "(210)096-3287", "[email protected]", "Ravenclaw House", 90000, "2000-04-10"));
46-
addHandler(db, new Employee(40000, "Samy", "samy", "32111111",
47-
"Sam", "(450)218-8876", "[email protected]", "Slytherin House", 40000, "2000-01-11"));
45+
"Ryanny", "(210) 096-3287", "[email protected]", "Ravenclaw House", 90000, "2000-04-10"));
46+
addHandler(db, new Employee(40000, "Sammy", "sammy", "32111111",
47+
"Sam", "(450) 218-8876", "[email protected]", "Slytherin House", 40000, "2000-01-11"));
4848
addHandler(db, new Employee(50000, "Ted", "ted", "24343244",
49-
"Teddy", "(208)222-8712", "[email protected]", "Azkaban", 110000, "2000-11-3"));
49+
"Teddy", "(208) 222-8712", "[email protected]", "Azkaban", 110000, "2000-11-03"));
5050
}
5151

5252
@Override

Diff for: ‎app/src/main/res/layout/activity_result.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -264,7 +264,7 @@
264264
android:layout_height="wrap_content"
265265
android:layout_marginStart="50dp"
266266
android:layout_marginEnd="50dp"
267-
android:layout_marginTop="0dp"
267+
android:layout_marginTop="20dp"
268268
android:onClick="partialUpdateProfile"
269269
android:text="Update" />
270270
</TableRow>

0 commit comments

Comments
 (0)