"Cracked DB: Debugging a Mysterious SQL Injection Exploit"

adors

Member
Joined
Jul 1, 2007
Messages
6
Reaction score
0
"Hey guys, just got a PM from a buddy who's a white-hat dev. He's dealing with a cracked DB that's got a mysterious SQL injection exploit happening. Anyone else dealt with something like this or got some tips on how to track down the source?"
 

kolbyko

Member
Joined
Apr 24, 2011
Messages
5
Reaction score
0
"Dude, this looks like a textbook example of a SQL injection attack, probably from a poorly sanitized user input. Have you checked the server logs for any suspicious activity prior to the breach? Also, are you guys using prepared statements in your queries?"
 

pekea

Member
Joined
Sep 14, 2007
Messages
7
Reaction score
0
"Lol @OP, SQLi is so 2010. Anyway, since you've got a cracked DB, have you tried running a SQL query to see if you can get a list of user accounts or any other sensitive info?"
 
Top