3 ms·
I went for some "security training" with a grayhat once for a company I was developing for. He showed me his SQL injection script that exfiltrated the remote DB
by qingcharles 3y ago
I went for some "security training" with a grayhat once for a company I was developing for. He showed me his SQL injection script that exfiltrated the remote DB by using pauses in the SQL query depending on each letter of the table names/col names/etc. He had a script that would just keep firing blind queries through a textarea and recording the delay before the page returned.
- derwiki 3y agoBlind SQL injection is what I’ve heard this called, if anyone wants to read more. I used this concept to exfiltrate sensitive material from our database using PgHero’s analyze feature for an in-house incident response workshop once.
- qingcharles 3y agoThank you, I never knew if it had a name. https://owasp.org/www-community/attacks/Blind_SQL_Injection https://owasp.org/www-community/attacks/Blind_SQL_Injection
- uticus 3y agoI'm struggling to understand. I can understand how a timing attack would reveal enough details to differentiate between data being touched (but not expected to be returned). But I can't understand how this would cause SQL injection... do you mean it's a way to perform unauthorized queries, or do you mean data-altering statements could also be executed?
- qingcharles 3y agoSibling poster knew the name for it: https://owasp.org/www-community/attacks/Blind_SQL_Injection https://owasp.org/www-community/attacks/Blind_SQL_Injection