Archive of Blind Conditional Structure Data Extraction Inference Test
-
SQL Injection Inference Attacks
Posted in SQL Injection TechniquesUnderstanding the fundamentals inference attacks. Inference technique is the pillar of blind SQL injection and it is used in many advanced attacks. It allows testing for vulnerabilities and even extract information when no data is returned to the end user. Moreover, mastering its fundamentals will...
Continue reading this entry → -
Find Table Names for SQL Injection
Posted in Gathering InformationExtracting table names to achieve SQL injection. Before building a query to extract sensitive information, the attacker must know what data he wants to extract and where it is stored in the database. This article explains how to show table names. To simplify learning, we suppose that...
Continue reading this entry → -
Find Column Names for SQL Injection
Posted in Gathering InformationExtracting column names for a given table. Once the attacker knows table names he needs to find out what the column names are in order to extract information. This article explains how this information can be found using meta data...
Continue reading this entry → -
SQL Injection Using UNION
Posted in SQL Injection TechniquesUnderstanding how to create a valid UNION-based attack to extract information. UNION-based attacks allow the tester to easily extract information from the database. Because the UNION operator can only be used if both queries have the exact same structure, the attacker must craft a SELECT statement...
Continue reading this entry →
