Re: [PEN-TEST] Hacking SQL queries ...

"Aurobindo Sundaram (+1 512 918 1390)" a écrit :
>
> I have to audit a bit of code that does the following
>
> SELECT Name FROM Users WHERE Name LIKE '%input%' ORDER BY Name

Bad, so bad ...

Check r.f.p.'s PacketStorm hack
(http://www.wiretrip.net/rfp/p/doc.asp?id=42&iface=7)

The Perl module DBI doesn't allow several queries in one line.
So you can just insert some fields in the "where"
But with MS-SQL, all is possible (delete table, mail results, ...)

Nicob
Received on Feb 08 2001