Title: Automated SQL Ownage Techniques
Presenter: Fernando Federico Russ, CoreLabs Researcher
Date and Time: March 24, 2010 at 3:30pm
Location: Sheraton Wall Centre, Vancouver, BC, Canada
Link to event: http://cansecwest.com/agenda.html
Overview:
This talk is about web application security assessment. In particular, in this talk we set to improve the assessment process for SQL injection vulnerabilities by providing the means to discard exogenous "false positive" alarms and confirm exploitable vulnerabilities.
We propose a black-box technique to detect and exploit SQL injection vulnerabilities. The exploitation provides an interface to execute arbitrary SQL code through them. Therefore, we are able to thoroughly assess the impact of the vulnerability (e.g., understand what a hacker can do).
The core of this talk is in examining the difficulties that appear while trying to expose vulnerabilities and carry out a black-box interaction to automatically construct an exploit.
