From: David Cullen (David.Cullen@moneyextra.com)
Date: Wed Nov 21 2007 - 04:51:45 EST
I am also not too familiar with SQL injection techniques but found the
following site very useful:
http://www.unixwiz.net/techtips/sql-injection.html
It has straightforward steps on what each statement is testing, but be
careful if they are sharing live oracle databases with the test
environment you are using, as what may seem like simple requests to the
db could bring the server down, especially if you have v.large data sets
e.g. a statement such as (anything' OR 'x'='x )in a large data set could
take a couple of days for the oracle server to work out, run this two or
3 times and the server will be running at 100% load - so if possible
keep an eye on the oracle server's load whilst running these tests and
kill any requests you know 'you' have made or get your DBA to check for
you.
Hope this helps in some way
Regards
Dave C
-----Original Message-----
From: listbounce@securityfocus.com [mailto:listbounce@securityfocus.com]
On Behalf Of Attari Attari
Sent: 19 November 2007 09:32
To: pen-test@securityfocus.com
Subject: Oracle SQL Injection vulnerability
Hi Group,
I'm doing a penetration test for a client on their web
portal. When I give ' on the username field I was
received with an error from the server:
Unspecified error
ORA-01756: quoted string not properly terminated
Does that mean the site is vulnerable to SQL
Injection? I tried ' OR 1=1-- and ' OR '1'='1'-- but I
get same error message.
Any help would be much appreciated.
Clone
Meet people who discuss and share your passions. Go to
http://in.promos.yahoo.com/groups
------------------------------------------------------------------------
This list is sponsored by: Cenzic
Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!
http://www.cenzic.com/downloads
------------------------------------------------------------------------
-- AWD Moneyextra and AWD Chase de Vere are trading names of AWD Moneyextra Limited, which is authorised and regulated by the Financial Services Authority (FSA). AWD Moneyextra Limited is a wholly-owned subsidiary of AWD Group plc, a member of AWD Holding AG, Europe's premier independent financial services group. Registered Office: 1 King Street, Manchester, M2 6AW. Registered in England No. 3685041. VAT Registration No. 50337 4571 Please visit our website at www.moneyextra.com ------------------------------------------------------------------------ This list is sponsored by: Cenzic Need to secure your web apps NOW? Cenzic finds more, "real" vulnerabilities fast. Click to try it, buy it or download a solution FREE today! http://www.cenzic.com/downloads ------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:58:13 EDT