Tanya Janca USES SQL injection
Tanya used SQL injection to bypass a login screen during a CTF.
Explicit Confidence 99% · Tanya Janca EP 165 Details
“I’m sure there’s gonna be some sort of SQL injection opportunity.”
“we got in.”
Exploit
exploit:sql_injection
Injection exploit used against login fields and an application database to bypass authentication, execute database queries, and retrieve records.
Injection exploit used against login fields and an application database to bypass authentication, execute database queries, and retrieve records.
“It was an SQL injection and it was on the log-in screen”
“they recognized what was happening ... trying to do SQL injection”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | AFFECTS | SQL server | Explicit | 165 |
| incoming | USES | Tanya Janca | Explicit | 165 |
| incoming | VARIANT_OF | Blind SQL injection | Derived | 165 |
Tanya Janca USES SQL injection
Tanya used SQL injection to bypass a login screen during a CTF.
Explicit Confidence 99% · Tanya Janca EP 165 Details
“I’m sure there’s gonna be some sort of SQL injection opportunity.”
“we got in.”
Blind SQL injection VARIANT_OF SQL injection
The episode presents blind SQL injection as a form of SQL injection that returns yes/no-style results rather than directly returning data.
Derived Confidence 96% · Tanya Janca EP 165 Details
“what you’re doing when you do blind SQL injection is you are asking questions”
“the only option you get back is yes or no”
SQL injection AFFECTS SQL server
The episode describes an SQL injection attack against the SQL server itself.
Explicit Confidence 96% · Tanya Janca EP 165 Details
“‘cause they attacked the SQL server itself”