New Techniques in SQLi Obfuscation: SQL Never Before Used in SQLi

Presented at DEF CON 20 (2012), July 27, 2012, 4:30 p.m. (20 minutes).

SQLi remains a popular sport in the security arms-race. However, after analysis of hundreds of thousands of real world SQLi attacks, output from SQLi scanners, published reports, analysis of WAF source code, and database vendor documentation, both SQLi attackers and defenders have missed a few opportunities. This talk will iterate through the dark corners of SQL for use in new obfuscated attacks, and show why they are problematic for regular-expression based WAFs. This will point the way for new directions in SQLi research for both offense and defense.

Presenters:

• Nick Galbreath
  Nick Galbreath is a director of engineering at Etsy, overseeing groups handling fraud, security, authentication and internal tools. Over the last 18 years, Nick has held leadership positions in number of social and e-commerce companies, including Right Media, UPromise, Friendster, and Open Market, and has consulted for many more. He is the author of "Cryptography for Internet and Database Applications" (Wiley), and was awarded a number of patents in the area of social networking. He holds a master's degree in mathematics from Boston University. Twitter: @ngalbreath http://client9.com https://github.com/client9

Links:

• https://defcon.org/html/defcon-20/dc-20-speakers.html#Galbreath
• https://infocon.org/cons/DEF CON/DEF CON 20/DEF CON 20 video and slides/DEF CON 20 - Nick Galbreath - New Techniques in SQLi Obfuscation SQL never before used in SQLi - Video and Slides.mp4 (Video and Slides)
• https://www.youtube.com/watch?v=L19EKHtW8TY

Similar Presentations:

• Black Hat USA 2012 / libinjection: A C library for SQLi detection and generation through lexical analysis of real world attacks
• AppSec USA 2017 / Advanced SQL Injection Exploitation (1-day)