Among them, the one that is particularly overlooked and can lead to fatal consequences is the publication of the "administrator page". If an administrator page intended for internal use is identified from the outside by OSINT (Public Information Gathering) and is subjected to a SQL injection attack, the company's core data is instantly compromised.

In this blog, we will provide a detailed analysis of the sequence of attack flows, from identifying admin pages using OSINT to controlling systems with advanced SQL injection attacks, based on the latest threat trends. We will then propose practical and powerful countermeasures for corporate security personnel.

---

Threat Overview: It All Starts with "Search"

The publication of the admin page itself implies a critical vulnerability. When access paths that handle critical corporate information are exposed to the outside world, they are easy targets for attackers. Attackers use search engines and threat intelligence platforms such as Google, Shodan, and Criminal IP to search for keywords such as "admin" and "manager" to easily identify the URL of the admin page.

The admin page thus identified becomes the attacker's primary target. Brute force attacks are launched to attempt to take over accounts, as well as the most frequently attempted SQL injection attacks. For example, if the login form is poorly validated, an attacker can inject a malicious SQL statement to bypass authentication and gain administrative privileges.

Attacks in recent years have evolved further, combining various techniques to evade security solutions such as WAFs (Web Application Firewalls) and IPS (Intrusion Prevention Systems), making them more sophisticated and stealthy.

---

Attack flow: from reconnaissance to power seizure

OSINT-based SQL injection attacks proceed in the following step-by-step scenario:

1. Identifying the Admin Page with OSINT

• Advanced search: Use Google Dorking queries such as "inurl:admin" and "intitle:"admin page" to identify admin pages published to search engines.
• Leveraging public information: Accidentally uploaded .git/config to code repositories such as GitHub, . env, database.yml file to discover database connection information and the path to the admin page.
• URL Guessing: Attempt direct access by combining commonly used directory names such as /admin, /manager, /test, /backup, etc.

2. SQL injection and WAF/IPS bypass

• SQL injection: Injects SQL injection payloads into all populable points, such as login forms and search fields on identified admin pages, in an attempt to evade authentication.
• Security Evasion: Combine advanced evasion techniques such as double encoding and parameter contamination described below to avoid simple pattern-based detection.

3. Authorization and Additional Malicious Actions

• Obtaining an Admin Session: After successfully evading authentication, the attacker obtains an admin session and an authentication token, pretending to be a legitimate administrator.
• Ensuring Continuous Control: Uploading a web shell ensures continuous access to the server, causing significant damage, such as leaking sensitive information in the database or altering system settings.

---

Top attack techniques: Creative approaches to disable security solutions

Here are some of the key SQL injection variants used by attackers to evade security devices such as WAFs:

1. Double Encoding

Encode the attack statement such as 'OR '1'='1' and convert it to %27%20OR%20%271%27=%271. Further double encode to %2527%2520OR... It will be in the form of. If the WAF decodes only once, this payload reaches the backend server, where it is finally decoded and the attack is successful.

2. HTTP Parameter Contamination/Fragmentation (HPP/HPF)

?user=admin&id=' OR '1'='1 attack? user=admin&id=' and &id=OR '1'='1. Each parameter does not show any malicious patterns and bypasses the WAF. The values are then combined on the backend to complete the attack statement.

3. DBMS-specific comment syntax

In MySQL, /! ... / format comments are recognized as valid code only for a certain version or higher. For example, /! UNION SELECT/ is treated as a comment in other DBMS and WAFs, but is executed as a valid command in MySQL. This avoids detection.

4. Replacing Logical Operators and Functions

Use || instead of OR, && instead of AND, or insert control characters like %0a (newline) and %09 (tab) instead of whitespace to disrupt signature-based detection.

---

How to detect: Find lurking threats

Passive defense is not enough to detect a clever attack. Here's how to check your system from an attacker's perspective and detect threats.

• Conduct regular OSINTs: Utilize Google Dorking, Shodan, and Criminal IPs to regularly check your admin page and sensitive information for external exposure.
• Web server and WAF log analysis: Continuously monitor and analyze suspicious logs, such as unusual access attempts to admin pages, repeated login failures, and requests containing SQL reserved words or special characters.
• Optimize security solutions: Apply custom rules to detect advanced evasion techniques such as double encoding and parameter manipulation in WAFs and IPS, keeping signatures up to date.

---

Countermeasures: Building a Multi-Layered Defense Strategy

1. Blocking Access Sources (Network Control)

• VPN and designated IP access: As a general rule, the admin page must not be exposed to the outside world. Give you strong control at the network level by allowing access only through a VPN (Virtual Private Network) or only allowing access to specific IP ranges you trust.
• Multi-Factor Authentication (MFA): In addition to ID/PW authentication, we introduce additional authentication methods such as OTP (One-Time Password) and biometric authentication to minimize the risk of account takeover.

2. Eliminating Vulnerabilities (Secure Coding and Configuration)

• Use Prepared Statements: To ensure that user input does not alter the structure of the SQL query, all database queries must be implemented in a parameterized query method. This fundamentally solves the SQL injection vulnerability.
• Validate input values (whitelist): Apply whitelist-based validation logic that defines the allowed data types, lengths, and formats (e.g., numbers, email addresses) for user input values and rejects all inputs beyond this threshold.
• Prevent search engine exposure: Use the X-Robots-Tag HTTP header or HTML tags to prevent search engines from crawling your admin page or showing it in search results.

3. Continuous Security Enhancements (Operations and Auditing)

• URL obfuscation (auxiliary measure): Adding an unpredictable string to a URL, such as /manager-a9b1c8d2e, can delay an attacker's initial access, but it should be used in conjunction with strong authentication and access controls.
• Regular Penetration Testing and Vulnerability Diagnosis: Conduct penetration testing based on real-world attack scenarios by external security experts to proactively identify and eliminate potential threats.

---

Conclusion: Return to the basics and build a robust defense system

The admin page exposed by OSINT is the easiest target for attackers, and when combined with advanced SQL injection evasion techniques, the impact is beyond imagination. The best countermeasure against this threat is to "stick to the basics" rather than a novelty technology.

Based on the principle of "don't expose what shouldn't be exposed in the first place", strong network access controls and multi-factor authentication should be implemented, and secure coding should be used to increase the security resistance of applications. In addition to this, continuous monitoring and regular audits can help you create a robust defense posture that is flexible and responsive to the changing threat landscape.

It's time to examine your external attack surface now and make sure that basic security principles are properly followed.

So far, Colorkrew Security's Jaeho Yoon has delivered it. Thank you very much.