full-disclosure - Re: Deep Blind SQL Injection Whitepaper

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 19 Aug 2008 19:09:32 +0100
From: "Ferruh Mavituna" <ferruh@...ituna.com>
To: "David Litchfield" <davidl@...software.com>
Cc: Full Disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: Deep Blind SQL Injection Whitepaper

Hi David,

I'm aware of the other methods which mostly explained on your paper.
Footnote 2 which clears up the definition "completely blind" was supposed to
be "*No error is displayed and no indicators are visible in the response*"
instead of "*No error is displayed and no indicators are visible in the
response that an error occurred*".

Hopefully will update the paper soon, thanks for pointing it out.

Cheers,

2008/8/19 David Litchfield <davidl@...software.com>

> Hi Ferruh,
>
>  This is a short whitepaper about a new way to exploit Blind SQL
>> Injections.
>>
>
> I just had a read of your paper. You open with: "If the injection point is
> completely blind then the only way to extract data is using time based
> attacks like WAITFOR DELAY, BENCHMARK etc." This is not the case. You can
> use other non-time based (and therefore faster) methods to infer the value
> of data. See "Data-mining with SQL Injection and Inference" -
> http://www.ngssoftware.com/papers/sqlinference.pdf
>
> Cheers,
> David
>
>
>
> --
> E-MAIL DISCLAIMER
>
> The information contained in this email and any subsequent
> correspondence is private, is solely for the intended recipient(s) and
> may contain confidential or privileged information. For those other than
> the intended recipient(s), any disclosure, copying, distribution, or any
> other action taken, or omitted to be taken, in reliance on such
> information is prohibited and may be unlawful. If you are not the
> intended recipient and have received this message in error, please
> inform the sender and delete this mail and any attachments.
>
> The views expressed in this email do not necessarily reflect NGS policy.
> NGS accepts no liability or responsibility for any onward transmission
> or use of emails and attachments having left the NGS domain.
>
> NGS and NGSSoftware are trading names of Next Generation Security
> Software Ltd. Registered office address: 52 Throwley Way, Sutton, SM1
> 4BF with Company Number 04225835 and VAT Number 783096402
>



-- 
Ferruh Mavituna
http://ferruh.mavituna.com

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/