3 ms·
Maybe I'm ignorant, but if the account the app is using doesn't have access to the information_schema how do you do this?
by default-kramer 2y ago
Maybe I'm ignorant, but if the account the app is using doesn't have access to the information_schema how do you do this?
- kmoser 2y agoNot just that, but perhaps the app is smart enough to lock you out the second it detects an attempt to gather the schema, e.g. by logging and automatically responding to a query that displays the schema. Then you have to look for other ways in (another IP, etc.). But if you know the schema in advance, you have a better chance of a one-shot injection that accomplishes your malicious goal. In other words, advance knowledge of the schema may make it easier to act maliciously.
- lcnPylGDnU4H9OF 2y agoI don’t think that’s a very common setup but perhaps I’m just exposing my own ignorance. Just consider the popularity of ORMs. They explicitly load the schema into the application in many cases.