SQL Injection Wiki
sqlwiki.netspi.com
SQL Injection Wiki
1–10 of 38 posts
Re: SQL Injection Wiki
#2The only successful SQL injection attack I've encountered in the wild was interesting, because the injection point had no visible output. But by injecting timing calls (eg "SLEEP()") and appropriate conditionals, the attacker was able to extract a few bits of information each request. Their script executed some tens of thousands of requests, and they managed to extract all the table names, and start to extract data from our "users" table.
In retrospect such an attack is obvious, and presumably tools like metasploit make them trivial to execute. But previously I'd had the idea that SQL injection was usually "literal raw data output".
Re: SQL Injection Wiki
#3The only successful SQL injection attack I've encountered in the wild was interesting, because the injection point had no visible output. But by injecting timing calls (eg "SLEEP()") and appropriate conditionals, the attacker was able to extract a few bits of information each request. Their script executed some tens of thousands of requests, and they managed to extract all the table names, and start to extract data f…
You should take a look at https://sqlmap.org : this tool runs SQL attacks with « raw data output » as you say, but also without outputs (Blind SQL injections).
Re: SQL Injection Wiki
#4The only successful SQL injection attack I've encountered in the wild was interesting, because the injection point had no visible output. But by injecting timing calls (eg "SLEEP()") and appropriate conditionals, the attacker was able to extract a few bits of information each request. Their script executed some tens of thousands of requests, and they managed to extract all the table names, and start to extract data f…
[deleted]
Re: SQL Injection Wiki
#5The only successful SQL injection attack I've encountered in the wild was interesting, because the injection point had no visible output. But by injecting timing calls (eg "SLEEP()") and appropriate conditionals, the attacker was able to extract a few bits of information each request. Their script executed some tens of thousands of requests, and they managed to extract all the table names, and start to extract data f…
How did you notice something was amiss?
Re: SQL Injection Wiki
#6The only successful SQL injection attack I've encountered in the wild was interesting, because the injection point had no visible output. But by injecting timing calls (eg "SLEEP()") and appropriate conditionals, the attacker was able to extract a few bits of information each request. Their script executed some tens of thousands of requests, and they managed to extract all the table names, and start to extract data f…
You should take a look at https://sqlmap.org : this tool runs SQL attacks with « raw data output » as you say, but also without outputs (Blind SQL injections).
SQLmap is a great tool for automated scanning and exploiting of SQLi vulnerabilities. Like everything though, it can miss the occasional exploit, where someone with the expertise might be better suited, but generally speaking it’s an awesome place to start.
It also has sane defaults, which means scriptkiddies chancing their luck with it should be easily spotted in your access.log, or depending on your environment a WAF/IDS/IPS should block/detect quickly.
Re: SQL Injection Wiki
#7Universities and managers must do a little bit of torture, spanking and ruler on the knuckles every time they see a student or a new dev not parameterize a query. It must become a reflex like watching for cars before crossing a street.
Re: SQL Injection Wiki
#8The only successful SQL injection attack I've encountered in the wild was interesting, because the injection point had no visible output. But by injecting timing calls (eg "SLEEP()") and appropriate conditionals, the attacker was able to extract a few bits of information each request. Their script executed some tens of thousands of requests, and they managed to extract all the table names, and start to extract data f…
Another frequent type of blind SQL injection is when the server gives an error or a slightly different output on some queries. The server code may for example travel down a different path if the query doesn't output any results and then shows an error. Even if the error doesn't show the contents of the query, it can also be used to slowly extract data through generated yes/no questions.
In one case I managed a successful blind attack for a client because their server showed an English site for valid queries returning the right results, and a German one for unexpected queries.
Re: SQL Injection Wiki
#9Universities and managers must do a little bit of torture, spanking and ruler on the knuckles every time they see a student or a new dev not parameterize a query. It must become a reflex like watching for cars before crossing a street.
Some weeks ago an experience developer said to me: "Parameterize a query? Since years i don't care about it, because ORMs like Doctrine or Sequelize take care of that"... So it's not only students or new devs who should watch out, because even ORMs can open up SQL injections.
Re: SQL Injection Wiki
#10It seems that PostgreSQL is missing from this cheat sheet. Does anyone know why?