3 ms·
SQL injection isnt just an ssh tunnel to the database. If the line you've injected isnt a select and the backend never fetches it how does the injection give yo
by HDThoreaun 2y ago
SQL injection isnt just an ssh tunnel to the database. If the line you've injected isnt a select and the backend never fetches it how does the injection give you the column names?
- hot_gril 2y agoOops you're right, it's possible that you have no way to read things back.
- wglb 2y agoI've seen this done by enumerating possible table names.
- hot_gril 2y agoThat's a typical way, but the errors might alert them, and of course maybe the names aren't so easily guessed.
- hot_gril 2y agoWait, this is known as a blind SQLi, and it's not so blind. You can still use timing to get the info you need one bit at a time. This may be slow, but it's doable without triggering any DB errors, so you have time.
- HDThoreaun 2y agopeople come up with the darndest things.
- hot_gril 2y agoYeah, it's a cool trick and not obvious. I think when I said SQL injection gets you the schema, I was recalling some faint old memory from a security course without remembering why this is doable.