New Tool for SQL Injection with DNS Exfiltration

Architecture and Background

DEF CON 16 - Robert Ricks: New Tool for SQL Injection with DNS Exfiltration For years people have been warned that blind SQL injection is a problem, yet there are a multitude of vulnerable websites out there to this day. Perhaps people don't realize that these vulnerabilities are very real. The current state of the art tools are Absinthe and SQL Brute for exploiting blind SQL injection.

Vulnerability Analysis

DNS exfiltration has been proposed as a method of reaching previously unassailable blind SQL injection access points. We have created a proof-of-concept tool which can download an Oracle schema and data from its tables in an automated fashion using DNS as its exfiltration mechanism. Unlike Absinthe this tool does not require any difference between successful and unsuccessful queries to work.

Exploitation and Demonstrations

It is also much faster than current tools since it can retrieve more than one byte of information at a time and doesn't require noticeable differences in timing. Perhaps this will help people realize that their private data is exceedingly vulnerable if they have even one SQL injection access point and don't take appropriate precautions. Robert Ricks: Bob works for G2, Inc.

Remediation and Defensive Strategies

as a senior information systems engineer. He has experience in data mining, artificial intelligence and development of security and exploitation tools. For copies of the slides and additional materials please see the DEF CON 16 Archive here: