|Main Archive Page > Month Archives > full-disclosure-uk archives|
-----BEGIN PGP SIGNED MESSAGE-----
Ferruh Mavituna wrote:
| This is a short whitepaper about a new way to exploit Blind SQL
| It's implemented in BSQL Hacker (
| http://labs.portcullis.co.uk/application/bsql-hacker/ ).
| *It is possible gather information from a target server with a 66%
| in the number of requests made of the server (compared to normal Blind SQL
| Injection), requiring two rather than six requests to retrieve each char.
[Already responded off-list, but for the benefit of those interested in the various options for outbound channels in sql injection here's a summary:]
The approach proposed is interesting as it reduces the number of requests required to extract a byte, however it will probably increase the total time required to extract a byte as compared with a bit-by-bit approach. (Of course, in certain circumstances it's possible to extract a byte in a single request if the database query or cgi doesn't timeout, by waiting for the ordinal value of the character in question.)
The half byte technique (nibble technique?) could be a good thing, since it would stand a greater chance of flying under threshold-based monitors than a bit-by-bit approach, but would also decrease the speed of the attack.
For those interested in timing (errors/dns) as an outbound channel, we wrote a paper last year along with a PoC tool. Both are accessible at http://www.sensepost.com/research/squeeza/ We decided on the bit-by-bit approach as we tended to be less prone to falling asleep while waiting for output as compared to other timing strategies we attempted...
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
-----END PGP SIGNATURE-----