Please start any new threads on our new site at https://forums.sqlteam.com. We've got lots of great SQL Server experts to answer whatever question you can come up with.

 All Forums
 Site Related Forums
 The Yak Corral
 Sql injection demo

Author  Topic 

spirit1
Cybernetic Yak Master

11752 Posts

Posted - 2006-05-12 : 17:02:17
a nice video showing how to hack sites that don't
use parametrized statements:

http://www.rockyh.net/AssemblyHijacking/AssemblyHijacking.html

Go with the flow & have fun! Else fight the flow
Blog thingie: [URL="http://weblogs.sqlteam.com/mladenp"]

MichaelP
Jedi Yak

2489 Posts

Posted - 2006-05-12 : 17:53:45
Wow, really great vid! Thanks for the link!

Michael

<Yoda>Use the Search page you must. Find the answer you will. Cursors, path to the Dark Side they are. Avoid them, you must. Use Order By NewID() to get a random record you will.</Yoda>

Opinions expressed in this post are not necessarily those of TeleVox Software, inc. All information is provided "AS IS" with no warranties and confers no rights.
Go to Top of Page

spirit1
Cybernetic Yak Master

11752 Posts

Posted - 2006-05-12 : 18:27:08
i was most amazed by using delay...
have to admit it never even crossed my mind to do that.

Go with the flow & have fun! Else fight the flow
Blog thingie: [URL="http://weblogs.sqlteam.com/mladenp"]
Go to Top of Page

jen
Master Smack Fu Yak Hacker

4110 Posts

Posted - 2006-05-13 : 04:25:55
that was a great post!

--------------------
keeping it simple...
Go to Top of Page

mcrowley
Aged Yak Warrior

771 Posts

Posted - 2006-05-16 : 16:10:18
It must be SQL Injection week somewhere:
http://thedailywtf.com/forums/thread/73098.aspx
Go to Top of Page

rockmoose
SQL Natt Alfen

3279 Posts

Posted - 2006-05-16 : 16:24:50
Funny, informative and scary.
The first thing I thought though was;
who tf creates a textbox with arbitrarily long search input in the first place, and just let sqlserver execute the input.
and who tf let applications login as sysadmin role?
Does this really happen ??

__________________
of course it does

rockmoose
Go to Top of Page

elwoos
Master Smack Fu Yak Hacker

2052 Posts

Posted - 2006-05-17 : 03:45:36
I like this one [url]http://thedailywtf.com/forums/thread/72894.aspx[/url]

steve

-----------

Oh, so they have internet on computers now!
Go to Top of Page
   

- Advertisement -