SQL Injection in Header

SQL injection remains one of the most critical vulnerabilities in web applications. Attackers can exploit this flaw to manipulate database queries, leading to unauthorized data access or system compromise. In this article, we explore SQL injection via the `X-Forwarded-For` header—a less common but dangerous attack vector.

How SQL Injection via `X-Forwarded-For` Works

The `X-Forwarded-For` (XFF) header is used to identify the originating IP address of a client connecting to a web server through a proxy or load balancer. If an application logs this header without proper sanitization, an attacker can inject malicious SQL code.

Example Attack Scenario:

1. A web application logs the `X-Forwarded-For` header in a database.

2. The attacker sends a crafted request:

GET / HTTP/1.1 
Host: example.com 
X-Forwarded-For: ' OR '1'='1'; -- 

3. If unsanitized, this input could break the SQL query, leading to unauthorized access.

You Should Know: Preventing & Exploiting XFF-Based SQL Injection

1. Exploitation with SQLMap

Use SQLMap to test for SQLi in headers:

sqlmap -u "http://example.com" --headers="X-Forwarded-For: " --level=5 --risk=3 

2. Manual Testing with cURL

Check if the application is vulnerable:

curl -H "X-Forwarded-For: ' OR 1=1 --" http://example.com 

3. Secure Coding Practices (Mitigation)

• Use Prepared Statements (Parameterized Queries)

  Python (SQLite example) 
  cursor.execute("SELECT  FROM logs WHERE ip = ?", (xff_header,)) 
  

• Input Sanitization

  $xff = mysqli_real_escape_string($conn, $_SERVER['HTTP_X_FORWARDED_FOR']); 
  

• Web Application Firewall (WAF) Rules

  location / { 
  set $xff $http_x_forwarded_for; 
  if ($xff ~ "([';]+|--|union|select)") { 
  return 403; 
  } 
  } 
  

4. Logging & Monitoring

Ensure logs are sanitized:

 Linux command to filter malicious XFF entries 
grep -E "([';]|--|union|select)" /var/log/nginx/access.log 

What Undercode Say

SQL injection via headers like `X-Forwarded-For` demonstrates the importance of input validation across all HTTP request components. Developers must:
– Validate & sanitize all headers before processing.
– Use ORMs or prepared statements to avoid direct query concatenation.
– Deploy WAFs to block suspicious patterns.
– Monitor logs for unusual activity.

Relevant Commands & Tools:

 Check for SQLi vulnerabilities 
nikto -h http://example.com -Tuning 7

Test headers with Burp Suite 
burpsuite

Secure MySQL configurations 
mysql_secure_installation

Analyze logs in real-time 
tail -f /var/log/apache2/access.log | grep -i "x-forwarded-for" 

Expected Output:

A secure web application that:

• Blocks malicious `X-Forwarded-For` payloads.
• Logs only sanitized IP addresses.
• Uses parameterized queries for database interactions.

Related Course Links:

1. Advanced SQL Injection
2. Web App Penetration Testing
3. Ethical Hacking Masterclass

References:

Reported By: Zlatanh Sql – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

Join Our Cyber World:

💬 Whatsapp | 💬 Telegram