Blind SQL Injection Automation Techniques

Architecture and Background

Cameron nummish Hotchkies,Blind SQL Injection Automation Techniques Due to improper software design and implementation practices, the number of web-based applications vulnerable to SQL injection is still alarmingly high. Yet the actual steps used to exploit these applications remain very tedious and repetitive.

Vulnerability Analysis

This presentation will focus on methods available to automate the task of exploiting blind sql injection holes. It will also feature a new tool, 'sQueaL" and explain some of the research, used in the creation of this tool as well as ideas for expansion on the tool or other uses of the core libraries developed.

Exploitation and Demonstrations

Cameron Hotchkies, aka nummish, is a member of the 0x90.org digital think-tank and head developer of the new blind injection tool, SQueaL. In his non-free time, he works as a web-application developer and has witnessed (and had to repair) great atrocities in web application design.

Remediation and Defensive Strategies

This has left him a bitter and frail shell of his former self. Some people have suggested he get out more. He is currently struggling to write code to teach him how to properly pronounce the word "about". This will be his first time speaking at DEFCON.