Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Went to SQL Injection Court

sockpuppet.org

Post reply on HN
Print view View original

431–440 of 463 posts

Re: I Went to SQL Injection Court

#431

Post by hot_gril »

HDThoreaun wrote: post #319
hot_gril wrote: post #257

Earlier quoted context omitted.

SQL injection will give you the entire schema anyway. It doesn't help if someone tells you the col names beforehand. I'm more wondering about non-SQL-injection vulns.

SQL injection isnt just an ssh tunnel to the database. If the line you've injected isnt a select and the backend never fetches it how does the injection give you the column names?

Wait, this is known as a blind SQLi, and it's not so blind. You can still use timing to get the info you need one bit at a time. This may be slow, but it's doable without triggering any DB errors, so you have time.

Re: I Went to SQL Injection Court

#432

Post by neilv »

tptacek wrote: post #429
neilv wrote: post #428

Earlier quoted context omitted.

So you can ask for the document that is the inspection report from Mel's Diner on date 11/11/2024? Can you ask for the database record from dispatching that inspection visit to Mel's Diner on 11/11/2024, even if you don't know the exact database column names and relations? If you can ask for that one dispatch database record, without knowing the schema, can you ask for the database records for all inspection visits t…

You can ask for "the inspection report from Mel's Diner on date 11/11/2024". You can also ask for "every inspection report ever done on Mel's Diner". You can suggest that they retrieve the inspection report from their database. This can be useful if staff wouldn't know where to find the document you're looking for. The FOIA clerk will hand the request off to IT, and if it's sensible, they'll probably try it. You prob…

Thanks. I might be misinterpreting, but maybe the standard for what's "research" involves not presuming that a given request can be satisfied by a database query?

So if you ask for documents in a way that sounds more complex than "every inspection report ever done on Mel's Diner", which is something they might be able to satisfy reasonably using a paper filing system or by eyeballing rows on a screen, then the request could be denied as "research"?

So then is what the petitioner in this case looking for was a database schema that would let them say, "respectfully, I think it's not research; I think it can be satisfied with the following exact SQL query"?

Re: I Went to SQL Injection Court

#433

Post by tptacek »

neilv wrote: post #432
tptacek wrote: post #429

Earlier quoted context omitted.

You can ask for "the inspection report from Mel's Diner on date 11/11/2024". You can also ask for "every inspection report ever done on Mel's Diner". You can suggest that they retrieve the inspection report from their database. This can be useful if staff wouldn't know where to find the document you're looking for. The FOIA clerk will hand the request off to IT, and if it's sensible, they'll probably try it. You prob…

Thanks. I might be misinterpreting, but maybe the standard for what's "research" involves not presuming that a given request can be satisfied by a database query? So if you ask for documents in a way that sounds more complex than "every inspection report ever done on Mel's Diner", which is something they might be able to satisfy reasonably using a paper filing system or by eyeballing rows on a screen, then the reques…

Exactly.

The public body could then say "no, we're not going to run that query or dig into that database". But then you can take them to court, and you'll probably win if the query is reasonable and simple enough.

Re: I Went to SQL Injection Court

#434

Post by HDThoreaun »

hot_gril wrote: post #431
HDThoreaun wrote: post #319

Earlier quoted context omitted.

SQL injection isnt just an ssh tunnel to the database. If the line you've injected isnt a select and the backend never fetches it how does the injection give you the column names?

Wait, this is known as a blind SQLi, and it's not so blind. You can still use timing to get the info you need one bit at a time. This may be slow, but it's doable without triggering any DB errors, so you have time.

people come up with the darndest things.

Re: I Went to SQL Injection Court

#435

Post by MBCook »

9dev wrote: post #186
chaps wrote: post #56

Earlier quoted context omitted.

Hard to say. One of my personal drivers for this lawsuit is a tip I received that said that Chicago has a list of vendors whose tickets are dropped in the back-end. When I requested that info, the city said they had no such list. I trust my source, so having schema information could help figure out the extent and if they were lying.

Earnest question: If you suspect them of lying on the issue, why would you trust them to release the full schema in response to the FOIA request, and not just omit any possibly incriminating columns?

The other answers here are great, but let’s say you’re right.

If you release a whole DB of data you’re going to have a hard time covering something you removed up in such a way that it’s not noticeable. Gaps in keys, suspiciously missing data for certain queries, etc.

Even if you do that perfectly, there are other data sources to compare to. If the city said it issued 2500 parking tickets and made $7500 in January on some financial report and the DB disagrees you have proof something is going on.

Or you could crowd source people’s parking tickets to compare to the DB to see if everything matches. What happens if one doesn’t? If one’s missing but the person had the proof they paid it?

It could still prove useful.

Re: I Went to SQL Injection Court

#436

Post by IshKebab »

dataflow wrote: post #354
IshKebab wrote: post #339

Earlier quoted context omitted.

There are trivial ways around all of those. `LIMIT 1`, `SELECT .. FROM information_schema...`, etc.

> There are trivial ways around all of those. `LIMIT 1` LIMIT 1 limits row count. The issue here was columns. Like a giant blob someone might've stored in there. > `SELECT .. FROM information_schema...` no such table: information_schema.columns > etc. https://news.ycombinator.com/item?id=43181799

> no such table: information_schema.columns

Oh I guess I will try the other very small number of options that it could be.

> LIMIT 1 limits row count. The issue here was columns. Like a giant blob someone might've stored in there.

Come on, this is pure nonsense.

Re: I Went to SQL Injection Court

#437

Post by IshKebab »

dataflow wrote: post #353
IshKebab wrote: post #340

Earlier quoted context omitted.

Right but the case that is being imagined here is a site that perfectly sanitises * but somehow still allows SQL injection? I don't think so.

> Right but the case that is being imagined here is a site that perfectly sanitises * but somehow still allows SQL injection? I don't think so. It could literally just reject anything with asterisks. It doesn't even need to do anything perfectly, it just needs to do it enough to produce hurdles for you. Like blowing through the number of attempts you realistically have remaining.

You vastly underestimate the creativity of people that bypass imperfect sanitisers.

Re: I Went to SQL Injection Court

#438

Post by bdangubic »

IshKebab wrote: post #437
dataflow wrote: post #353

Earlier quoted context omitted.

> Right but the case that is being imagined here is a site that perfectly sanitises * but somehow still allows SQL injection? I don't think so. It could literally just reject anything with asterisks. It doesn't even need to do anything perfectly, it just needs to do it enough to produce hurdles for you. Like blowing through the number of attempts you realistically have remaining.

You vastly underestimate the creativity of people that bypass imperfect sanitisers.

vastly is a big understatement :)

Re: I Went to SQL Injection Court

#439

Post by wglb »

dataflow wrote: post #353
IshKebab wrote: post #340

Earlier quoted context omitted.

Right but the case that is being imagined here is a site that perfectly sanitises * but somehow still allows SQL injection? I don't think so.

> Right but the case that is being imagined here is a site that perfectly sanitises * but somehow still allows SQL injection? I don't think so. It could literally just reject anything with asterisks. It doesn't even need to do anything perfectly, it just needs to do it enough to produce hurdles for you. Like blowing through the number of attempts you realistically have remaining.

Hurdles mean nothing to a determined penetration tester. Unless you have watched one in action, or tried an exercise yourself against a hard target, it is likely to surprise you how little "hurdles" mean.

Re: I Went to SQL Injection Court

#440

Post by billtoth »

shagie wrote: post #197
skissane wrote: post #90

Earlier quoted context omitted.

I’ve often thought we’d get more sensible results in court cases on computer-related issues if we had specialised courts where the judges were required to have a relevant degree (computer science, software engineering, computer engineering, information systems, etc). But I doubt it is going to happen any time soon.

It happens from time to time. https://www.theverge.com/2017/10/19/16503076/oracle-vs-googl... ( https://news.ycombinator.com/item?id=15834800 42 comments) > These days, he often looks for some kind of STEM background for the IP desk. It’s not necessary, but it helps. Bill Toth, the IP clerk during Oracle v. Google, didn’t have a STEM background, but he told me that the judge had specifically asked him to take a compu…

I'm the referenced Bill Toth. Just thought I'd mention the funny fact that in private practice I've actually argued about the significance of database schema (less for security reasons, more for analyzing the outputs of the database).
Post reply on HN