Technique
technique:sql_injection
Also: SQL injection attack, SQL injection attacks, SQL injections, SQL-injection, SQLi
Technique used against planetvtech.com to exploit weak code and gain access to the underlying database.
Technique used against planetvtech.com to exploit weak code and gain access to the underlying database.
“found it was vulnerable to SQL injection”
“It takes advantage of weak code and tries to exploit the underlying database.”
Web-application attack technique used against the legacy Tiscali website and database.
“there was a SQL injection done on the website that was formerly part of the Tiscali network.”
“the attacker used SQL injection.”
Web application attack technique used by Manfred as an analogy for recurring integer-overflow flaws in games.
“It’s akin to having SQL injection in a website.”
An attack technique that exploits unsanitized user input to issue SQL commands to a database.
“This is known as SQL injection”
“he was able to get right in”
Technique described as being used to enter a Pakistani government website and extract database contents.
“used SQL injection to get in, took all the stuff from the database”
Technique used to access databases through vulnerable police-department websites.
“He found the website was vulnerable to SQL injections”
“the same SQL injection vulnerability”
Web attack technique identified by FC as a flaw used during internet-based bank assessments.
“a lot of SQL injection”
Technique that ETA members practiced during their early hacking activities.
“learning SQL injections and cross-site scripting and phishing”
Technique MLT used to compromise and deface his school’s website.
“I SQL-injected the school’s website and defaced it.”
Web attack technique tested during the hospital penetration assessment.
“or SQL injection attacks”
Injection technique used to manipulate Marketwire’s database queries and access unreleased press releases.
“the website was vulnerable to SQL injection attacks”
“390 SQL injections later”
Injection technique used to compromise e-commerce and data-broker websites and retrieve database information.
“that website, it got a SQL injection vulnerability”
“First; SQL injection.”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| incoming | INITIAL_ACCESS_VIA | VTech Kids’ Toy Hacking case | Derived | 2 |
| incoming | INVOLVES | TalkTalk October 2015 cyber-attack | Explicit | 4 |
| incoming | ASSOCIATED_WITH | Manfred | Explicit | 8 |
| incoming | USES | Tom | Explicit | 33 |
| incoming | INITIAL_ACCESS_VIA | RockYou | Explicit | 33 |
| incoming | USES | Indian hacker community | Explicit | 51 |
| incoming | USES | Cygenta | Explicit | 66 |
| incoming | USES | Electronik Tribulation Army | Explicit | 70 |
| incoming | USES | Ed Skoudis | Derived | 121 |
| incoming | INVOLVES | Newswire hacking and insider-trading scheme | Explicit | 123 |
VTech Kids’ Toy Hacking case INITIAL_ACCESS_VIA SQL injection
The hacker initially gained access by exploiting SQL injection in planetvtech.com.
Derived Confidence 98% · Jack Rhysider EP 2 Details
“he found it was vulnerable to SQL injection”
“this hacker ran a script against planetvtech.com which attempted to exploit SQL. To his surprise, it worked. He had shell access to the website.”
TalkTalk October 2015 cyber-attack INVOLVES SQL injection
The attack involved SQL injection against a website formerly part of the Tiscali network.
Explicit Confidence 99% · Jack Rhysider EP 4 Details
“there was a SQL injection done on the website that was formerly part of the Tiscali network”
Manfred ASSOCIATED_WITH SQL injection
Manfred compared the prevalence of integer-overflow bugs in games to SQL injection in websites; he did not claim to use SQL injection.
Explicit Confidence 95% · Manfred EP 8 Details
“It’s akin to having SQL injection in a website.”
Tom USES SQL injection
Tom used SQL injection through website login fields to query databases and obtain user data.
Explicit Confidence 99% · Jack Rhysider EP 33 Details
“he could issue SQL commands and query the database [00:10:00] right through the username field of the login page”
RockYou INITIAL_ACCESS_VIA SQL injection
The RockYou breach began through a SQL injection vulnerability in rockyou.com.
Explicit Confidence 99% · Jack Rhysider EP 33 Details
“rockyou.com was vulnerable to SQL injection”
Indian hacker community USES SQL injection
The first Indian hacker Jack describes used SQL injection to enter a Pakistani government website.
Explicit Confidence 95% · Jack Rhysider EP 51 Details
“used SQL injection to get in”
Cygenta USES SQL injection
FC says SQL injection is among the techniques used to get into banks over the internet.
Explicit Confidence 94% · FC EP 66 Details
“a lot of SQL injection”
Electronik Tribulation Army USES SQL injection
Ghost Exodus says ETA initially practiced SQL injections.
Explicit Confidence 98% · Jack Rhysider EP 70 Details
“learning SQL injections”
Ed Skoudis USES SQL injection
Jack says Ed's team tested websites for SQL injection vulnerabilities.
Derived Confidence 94% · Jack Rhysider EP 121 Details
“or SQL injection attacks”
Newswire hacking and insider-trading scheme INVOLVES SQL injection
The hackers used SQL injection attacks to penetrate newswire systems.
Explicit Confidence 99% · Paul Fishman EP 123 Details
“using a variety of hacking techniques and tactics including brute force attacks, SQL injection attacks, and phishing”