Questions about this topic? Sign up to ask in the talk tab.
Difference between revisions of "SQL injection/Blind/Extraction"
From NetSec
| Line 1: | Line 1: | ||
== Blind extraction == | == Blind extraction == | ||
| − | '''There are | + | '''There are two types of blind SQL extraction attacks:''' |
| − | * | + | * Partial-blind: Pre-computation based |
| − | * | + | * Full-blind: Timing based |
| − | '''The only things that | + | |
| + | '''The only things that these methods have in common is:''' | ||
* <u>These attacks</u> are all limited in some fashion because of environment and latency or dataset, respectively. | * <u>These attacks</u> are all limited in some fashion because of environment and latency or dataset, respectively. | ||
| − | * <u> | + | * <u>Successful exploitation</u> requires automation [[programming]]. |
Revision as of 18:48, 20 November 2012
Blind extraction
There are two types of blind SQL extraction attacks:
- Partial-blind: Pre-computation based
- Full-blind: Timing based
The only things that these methods have in common is:
- These attacks are all limited in some fashion because of environment and latency or dataset, respectively.
- Successful exploitation requires automation programming.
