Blind SQL Injection - Revision history

Shivang Desai at 10:22, 26 August 2013

2013-08-26T10:22:19Z

2013-08-26T10:21:26Z

2013-07-19T04:33:21Z

‎References

2013-07-19T04:32:55Z

‎Time-based: Change sqlmap URL

2013-02-27T03:15:50Z

Updated description, examples, corrected spelling errors

2012-04-29T14:25:13Z

2012-04-29T14:12:23Z

2009-09-13T12:30:13Z

2009-09-13T12:29:41Z

2009-04-07T23:35:18Z

@@ Line 148: / Line 148: @@
 * [http://sqlmap.org/ sqlmap, automatic SQL injection tool] in Python
 * [https://code.google.com/p/bsqlbf-v2/ bsqlbf, a blind SQL injection tool] in Perl
-* [http://sqlmap.org/ open source SQL injection tool]
 [[Category:Injection]]
 [[Category: Attack]]

@@ Line 148: / Line 148: @@
 * [http://sqlmap.org/ sqlmap, automatic SQL injection tool] in Python
 * [https://code.google.com/p/bsqlbf-v2/ bsqlbf, a blind SQL injection tool] in Perl
+* [http://sqlmap.org/ open source SQL injection tool]
 [[Category:Injection]]
 [[Category: Attack]]

@@ Line 146: / Line 146: @@
 * [http://www.securiteam.com/tools/5IP0L20I0E.html SQLBrute - Multi Threaded Blind SQL Injection Bruteforcer] in Python
 * [[:Category:OWASP_SQLiX_Project|SQLiX - SQL Injection Scanner]] in Perl
-* [http://sqlmap.sourceforge.net sqlmap, automatic SQL injection tool] in Python
+* [http://sqlmap.org/ sqlmap, automatic SQL injection tool] in Python
 * [https://code.google.com/p/bsqlbf-v2/ bsqlbf, a blind SQL injection tool] in Perl

@@ Line 93: / Line 93: @@
 * PostgreSQL - pg_sleep()
-Conducting Blind_SQL_Injection attacks manually is very time consuming, but there are a lot of tools which automate this process. One of them is SQLMap (http://sqlmap.sourceforge.net/) partly developed within OWASP grant program. On the other hand, tools of this kind are very sensitive to even small deviations from the rule. This includes:
+Conducting Blind_SQL_Injection attacks manually is very time consuming, but there are a lot of tools which automate this process. One of them is SQLMap (http://sqlmap.org/) partly developed within OWASP grant program. On the other hand, tools of this kind are very sensitive to even small deviations from the rule. This includes:
 * scanning other website clusters, where clocks are not ideally synchronized,

@@ Line 145: / Line 145: @@
 * [[:Category:OWASP_SQLiX_Project|SQLiX - SQL Injection Scanner]] in Perl
 * [http://sqlmap.sourceforge.net sqlmap, automatic SQL injection tool] in Python
-* [http://www.514.es/2006/12/inyeccion_de_codigo_bsqlbf12th.html bsqlbf, a blind SQL injection tool] in Perl
+* [https://code.google.com/p/bsqlbf-v2/ bsqlbf, a blind SQL injection tool] in Perl
 [[Category:Injection]]
 [[Category: Attack]]

@@ Line 131: / Line 131: @@
 '''Online Resources'''
-* [http://www.ngssoftware.com/papers/more_advanced_sql_injection.pdf more Advanced SQL Injection] - by NGS
+* [http://www.nccgroup.com/Libraries/Document_Downloads/more__Advanced_SQL_Injection.sflb.ashx more Advanced SQL Injection] - by NGS
 * [http://www.blackhat.com/presentations/bh-usa-04/bh-us-04-hotchkies/bh-us-04-hotchkies.pdf Blind SQL Injection Automation Techniques] - Black Hat Pdf
 * [http://seclists.org/lists/bugtraq/2005/Feb/0288.html Blind Sql-Injection in MySQL Databases]
 * [http://www.cgisecurity.com/questions/blindsql.shtml Cgisecurity.com: What is Blind SQL Injection?]
-* [http://www.securitydocs.com/library/2651 Blind SQL Injection]
+* Kevin Spett from SPI Dynamics: http://www.net-security.org/dl/articles/Blind_SQLInjection.pdf
-* http://www.spidynamics.com/whitepapers/Blind_SQLInjection.pdf
+* http://www.imperva.com/resources/whitepapers.asp?t=ADC
-* http://www.imperva.com/application_defense_center/white_papers/blind_sql_server_injection.html
+* [https://www.owasp.org/images/7/74/Advanced_SQL_Injection.ppt Advanced SQL Injection]
 '''Tools'''

@@ Line 103: / Line 103: @@
 * PostgreSQL - pg_sleep()
-Conducting Blind_SQL_Injection attacks manually is very time consuming, but there are a lot of tools which automate this process. One of them is SQLMap (http://sqlmap.sourceforge.net/) developed within OWASP grant program. On the other hand, tools of this kind are very sensitive to even small deviations from the rule. This includes:
+Conducting Blind_SQL_Injection attacks manually is very time consuming, but there are a lot of tools which automate this process. One of them is SQLMap (http://sqlmap.sourceforge.net/) partly developed within OWASP grant program. On the other hand, tools of this kind are very sensitive to even small deviations from the rule. This includes:
 * scanning othe WWW cluster, where clocks are not ideally synchronized,
 * WWW services where argument acquiring method was changed, e.g.  from /index.php?ID=10 to /ID,10

@@ Line 4: / Line 4: @@
 __NOTOC__
 <br>
 Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''