4 ms·
The real problem here is SQL injection... Not sleep
by js4ever 8y ago
The real problem here is SQL injection... Not sleep
- erazor42 8y agoAgree, if you are vulnerable to this attack, you are probably vulnerable to a good old ' or '1'; drop databases :D
- wongarsu 8y agoYes, but an attacker is more likely to try SLEEP(10) than DROP DATABASES, because the attacker usually wants your data (and your server, but the data is a bonus). So if disabling sleep makes a few bots miss an actual vulnerability, it's a good step for defense in depth.
- cottenio 8y agoCorrect. It's more valuable, especially when trying to exfiltrate data or when trying to inject XSS opportunities. Plus, realistically, SLEEP allows you to scan for thousands of different test cases in a quick period and measure the hang time to figure out which vector worked.
- QuinnWilton 8y agoThis is especially true when you realize that timing attacks don't even need SLEEP in the first place. You just need to hang the database for a measurable amount of time, like this injection will do: AND 1 IN (SELECT BENCHMARK(SOME_MULTIPLIER*15000000,MD5(CHAR(97))))--