|
GilaMonster
Flowing Fount of Yak Knowledge
South Africa
4507 Posts |
 Posted - 05/14/2008 : 08:03:58
|
Byapti, I disagree with you on one point - "Both store procedure and PreparedStatement are precompiled and
hence impossible to penetrate."
Stored procedures are not impossible to penetrate, and precompilation has nothing to do with it. It's parameterisation that's the key point. See this example
ALTER PROCEDURE Vulnerable @TableToQuery VARCHAR(500)
AS
DECLARE @sSQL VARCHAR(2000)
SET @sSQL = 'SELECT * FROM ' + @TableToQuery
PRINT @sSQL
EXEC (@sSQL)
GO
EXEC Vulnerable 'sys.tables; drop table Users -- '
Regardng the discovery of schemas, error messages are nice to have, but not essential. Any screen that shows a list of data and is vulnerable to injection can be used to determine the schema. It just takes a lot more patience if the error messages aren't shown.
--
Gail Shaw |
Edited by - GilaMonster on 05/14/2008 08:05:28 |
 |
|
SQL Keeps gatting hacked
