Fast SQL blind injections in high latency networks
- Resource Type
- Conference
- Authors
- Focardi, Riccardo; Luccio, Flaminia L.; Squarcina, Marco
- Source
- 2012 IEEE First AESS European Conference on Satellite Telecommunications (ESTEL) Satellite Telecommunications (ESTEL), 2012 IEEE First AESS European Conference on. :1-6 Oct, 2012
- Subject
- Aerospace
Communication, Networking and Broadcast Technologies
Components, Circuits, Devices and Systems
Computing and Processing
Fields, Waves and Electromagnetics
Signal Processing and Analysis
Transportation
Databases
Standards
Probabilistic logic
Dictionaries
Particle separators
Probability distribution
Electronic mail
- Language
- ISSN
- 2375-8546
2375-8554
SQL injections are probably the most common vulnerability in Internet applications. They allow for injecting user selected input in database queries, getting access to sensitive data. Blind SQL Injections have the characteristic of never returning data directly. Instead, they give a 1-bit information about the success of the query. Queries can be iterated so to dump a whole database but this typically requires a long time. In the case of high latency networks this might become too long and more likely noticed by system administrators. We improve standard Blind SQL Injection techniques by considering probability-based and dictionary-based searches and by parallelising the queries. We show that these improvements make the attack much faster and effective even in high-latency networks.