Archive of MySQL SLEEP Table Size Time Based
-
Estimating MySQL Table Size using SQL Injection
Posted in Blind SQL InjectionInjecting short time delays in WHERE clause. In some cases, the attacker might want to have a rough idea about the number of records in a table. This is not a crucial piece of information, however it could be helpful to know how much time will be...
Continue reading this entry → -
Time-Based Blind SQL Injection Attacks
Posted in Blind SQL InjectionPerform tests by injecting time delays. Time-based techniques are often used to achieve tests when there is no other way to retrieve information from the database server. This kind of attack injects a SQL segment which contains specific DBMS function or heavy query that generates a...
Continue reading this entry → -
Extracting Information from Custom Errors
Posted in AnomaliesUnderstanding information provided by application errors. Software developers often use error handling and validation mechanisms to prevent the application from crashing when an unexpected event occurs. In those situations custom errors are habitually returned to the user to indicate that something wrong happened (without providing full...
Continue reading this entry → -
Detecting SQL Injection Vulnerabilities from HTTP Errors
Posted in AnomaliesUnderstanding HTTP errors generated by SQL injection attacks. While testing for SQL injection vulnerabilities or attempting to take over a query, the attacker may face different HTTP status codes. Those responses may indicate that the SQL injection partially worked and therefore give precious hints to the tester. This...
Continue reading this entry →
