This session describes some special ways to perform (B)SQLI attacks. This talk was delivered at Shmoocon 2k9 by Palako and Chema Alonso

1. (Re) Playing with (Blind) SQL Injection José Palazón “Palako” Mobile Security at Yahoo! Chema Alonso Informatica64 Microsoft MVP Enterprise Security

2. Spain (…not only bulls…)

3. SQL Injection attacks http://www.phrack.org/issues.html?id=8&issue=54 A long time ago, in a galaxy far, far away…

5. Serialized SQL Injection

10. Demo: Serialized SQL Injection

11. Arithmetic Blind SQL Injection

21. Remote File Downloading using Blind SQL Injection techniques

29. Demo RFD

30. Time-based Blind SQL Injection using heavy queries

32. Exploit for Solar Empire Web Game

35. Yes, we can!

37. The heavy condition first Condition2 (100 sec) Condition1 (10 sec) Condition2 & condition1 Response Time TRUE FALSE FALSE 110 sec TRUE TRUE TRUE 110 sec FALSE Not evaluated FALSE 100 sec

38. The light condition first Condition1 (10 sec) Condition2 (100 sec) Condition1 & condition2 Response Time TRUE FALSE FALSE 110 sec TRUE TRUE TRUE 110 sec FALSE Not evaluated FALSE 10 sec

52. Demo: Marathon Tool

53. Prevention: Don´t forget Bobby Tables! SANITIZE YOUR QUERIES!