Advanced SQL Injection
Joseph McCray explores advanced sql injection at DEF CON 17, examining sql-injection and practical defenses.
Summary
Architecture and Background
Advanced SQL Injection Joseph McCray Founder of Learn Security Online SQL Injection is a vulnerability that is often missed by web application security scanners, and it's a vulnerability that is often rated as NOT exploitable by security testers when it actually can be exploited.
Vulnerability Analysis
Advanced SQL Injection is a presentation geared toward showing security professionals advanced exploitation techniques for situations when you must prove to the customer the extent of compromise that is possible.
Exploitation and Demonstrations
The key areas are: * IDS Evasion, Web Application Firewall Bypass * Privilege Escalation * Re-Enabling stored procedures * Obtaining an interactive command-shell * Data Exfiltration via DNS Joseph McCray has 8 years of experience in the security industry with a diverse background that includes network and web application penetration testing, forensics, training, and regulatory compliance.
Remediation and Defensive Strategies
Joe is a frequent presenter at security conferences, and has taught the CISSP, CEH, CHFI, and Web Application Security at Johns Hopkins University (JHU), University of Maryland Baltimore College (UMBC), and several other technical training centers across the country. For copies of the slides and additional materials please see the DEF CON 17 Archive here:
Related talks
Main Stage·39 min
Chris Gates · Mario Ceballos
Chris Gates and Mario Ceballos explores breaking the unbreakable oracle with metasploit at DEF CON 17, examining sql-injection and practical defenses.
Main Stage·38 min
Paul Gerste
Technique for bypassing prepared statements and database query validation by smuggling queries across database wire protocols.
Main Stage·35 min
Vangelis Stykas
Vangelis Stykas demonstrates how typical web application flaws in abandoned malware C2 infrastructure allow researchers to compromise admin panels and identify threat actors.