421–430 of 463 posts
Earlier quoted context omitted.
SQL injection isnt just an ssh tunnel to the database. If the line you've injected isnt a select and the backend never fetches it how does the injection give you the column names?
I've seen this done by enumerating possible table names.
Earlier quoted context omitted.
I don't understand the argument that knowing the column names doesn't help an attacker? Especially in a database that doesn't allow wildcards, doesn't it make things much easier if you know you can do '); SELECT col FROM logins, as opposed to having to guess the column name? And I don't think I disagree with the court on schema vs. file layouts either. It's not the file layout, but it's analogous: it tells you how th…
You can always `SELECT table_name, column_name, data_type FROM information_schema.columns`, which is part of the SQL standard. https://www.postgresql.org/docs/current/infoschema-columns.h... Plus, generally if you have SQL injection, you have multiple tries. You're not going to be locked out after one shot. And there's only so many combinations of `SELECT {id,userid,user_id,uid} FROM {user,users,login,logins,customer…
Earlier quoted context omitted.
The article describes why. 2 different db engines (or even instances) can use different file layouts for the same schema. In many was sql is all about divorcing the schema from the files.
There's a solid chance that the schema gives away what DBMS is being used. But even if it didn't, I'd still call it a file layout in this context.
Interesting takeaways from me: All that pompous sounding legalese can still be ambiguous! I feel less bad for not understanding contracts that have 100 word compound sentences. Legal people can't keep up with our tech jargon but they have their own jargon including "predicate" lol. So same logical thinking, different jargon framework. Question: why do they want the schema not the data?
Because once you have the schema you can issue FOIA requests that include queries for them to run.
Once the information is released, can anyone can make FOIA requests using the schema?
Earlier quoted context omitted.
That would be against the separation of powers doctrine inherent in all Western democracies. The job of the legislature is to write the law. The job of the judiciary is to interpret the law. Besides, when the law is ambiguous, it's very often because the legislature themselves weren't sure what they intended, and/or because the legislature had deeply divided views and arrived at ambiguous wording as a compromise, and…
I don't see how it could break separation of powers, especially if a legislator could provide minutes and/or a paper trail of discussions and revisions pointing the intent in a certain direction. You know, like evidence. The legislature surely has intent while writing the law, otherwise what would be the point in trying to interpret it, and the whole thing being litigated is the authors intent. I don't think the sepa…
Second, interpreting the law is a full-time job, and our legislators are already not doing the jobs they have. If we asked them to not do a second job on top of the one they're already in dereliction of, nothing would get done. Well, twice as much nothing would get done, if that makes sense. So, you need someone with the full-time job of interpreting the law, and it might as well be that judicial branch.
Third, legislation is often a compromise. If you go back and try to interpret what it was that people said during the debate which produced the language at issue, you'd have to decide whose voices carried the most weight, which seems very, very tricky. It's why legislation is written down in the first place: a single source of truth. Even if ambiguous, it's still less ambiguous than a transcript of extemporaneous debate.
Earlier quoted context omitted.
Which is why in the ordinary course of a pentest you'd use the SQL injection vulnerability to recover the information in the schema .
Is there not any SQLi vulnerability in practice that doesn't allow such an information recovery? That is, is the schema-recovery step so foolproof that it can always be performed on any target form? GP is suggesting that this may be difficult, depending on the kind of signal that gets returned from the form.
It's hard to imagine a case where you can't even get info based on timing. But it requires more effort and knowledge to exploit this.
> [...] where the only way to get at the underlying data is to FOIA a database query. Can you request the desired information using natural language, based on your guesses of what information they store?
Probably not, because then you'd be asking them to go do research. You FOIA for specific documents and records.
Can you ask for the database record from dispatching that inspection visit to Mel's Diner on 11/11/2024, even if you don't know the exact database column names and relations?
If you can ask for that one dispatch database record, without knowing the schema, can you ask for the database records for all inspection visits to all locations in Smallville in 2024? (Or does the complexity of that database query constitute "research"?)
Earlier quoted context omitted.
Probably not, because then you'd be asking them to go do research. You FOIA for specific documents and records.
So you can ask for the document that is the inspection report from Mel's Diner on date 11/11/2024? Can you ask for the database record from dispatching that inspection visit to Mel's Diner on 11/11/2024, even if you don't know the exact database column names and relations? If you can ask for that one dispatch database record, without knowing the schema, can you ask for the database records for all inspection visits t…
You can suggest that they retrieve the inspection report from their database. This can be useful if staff wouldn't know where to find the document you're looking for. The FOIA clerk will hand the request off to IT, and if it's sensible, they'll probably try it.
You probably (these are all humans, so no definites) can't literally use public body staff as a proxy to a database shell; for instance, they're not going to let you do a lot of interactive stuff. You're either going to produce the data that you're looking for --- which you'll need to describe in prose --- or get nothing.
Earlier quoted context omitted.
Because once you have the schema you can issue FOIA requests that include queries for them to run.
Is the schema considered private information or just information not required to be released via FOIA? ie: Can't some nice employee leak this information or is it legally protected? Once the information is released, can anyone can make FOIA requests using the schema?
It's not legally protected. An employee could leak it. A public body can voluntarily reveal documents that are exempt from FOIA (absent some other Illinois law prohibiting disclosure). A public body can disclose source code, for instance, despite it being explicitly exempt in the statute. "This data is exempt" is an affirmative defense that the public body has to raise.