Exploit
exploit:blind_sql_injection
SQL-injection variant that infers database information through true-or-false results or errors rather than directly returning data.
SQL-injection variant that infers database information through true-or-false results or errors rather than directly returning data.
“I went to Defcon and I did a workshop called Blind SQL Injection”
“the only option you get back is yes or no”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | VARIANT_OF | SQL injection | Derived | 165 |
| outgoing | LEADS_TO | Data exfiltration | Derived | 165 |
Blind SQL injection VARIANT_OF SQL injection
The episode presents blind SQL injection as a form of SQL injection that returns yes/no-style results rather than directly returning data.
Derived Confidence 96% · Tanya Janca EP 165 Details
“what you’re doing when you do blind SQL injection is you are asking questions”
“the only option you get back is yes or no”
Blind SQL injection LEADS_TO Data exfiltration
The episode explains that blind SQL injection enabled the attacker to infer and exfiltrate the database contents.
Derived Confidence 94% · Tanya Janca EP 165 Details
“So, they did exfiltrate our data, and that is what happened”
“you can know for sure that it’s true”