Penetration Testing mailing list archives
RE: Oracle SQL Injection vulnerability
From: "David Cullen" <David.Cullen () moneyextra com>
Date: Wed, 21 Nov 2007 09:51:45 -0000
I am also not too familiar with SQL injection techniques but found the following site very useful: http://www.unixwiz.net/techtips/sql-injection.html It has straightforward steps on what each statement is testing, but be careful if they are sharing live oracle databases with the test environment you are using, as what may seem like simple requests to the db could bring the server down, especially if you have v.large data sets e.g. a statement such as (anything' OR 'x'='x )in a large data set could take a couple of days for the oracle server to work out, run this two or 3 times and the server will be running at 100% load - so if possible keep an eye on the oracle server's load whilst running these tests and kill any requests you know 'you' have made or get your DBA to check for you. Hope this helps in some way Regards Dave C -----Original Message----- From: listbounce () securityfocus com [mailto:listbounce () securityfocus com] On Behalf Of Attari Attari Sent: 19 November 2007 09:32 To: pen-test () securityfocus com Subject: Oracle SQL Injection vulnerability Hi Group, I'm doing a penetration test for a client on their web portal. When I give ' on the username field I was received with an error from the server: Unspecified error ORA-01756: quoted string not properly terminated Does that mean the site is vulnerable to SQL Injection? I tried ' OR 1=1-- and ' OR '1'='1'-- but I get same error message. Any help would be much appreciated. Clone Meet people who discuss and share your passions. Go to http://in.promos.yahoo.com/groups ------------------------------------------------------------------------ This list is sponsored by: Cenzic Need to secure your web apps NOW? Cenzic finds more, "real" vulnerabilities fast. Click to try it, buy it or download a solution FREE today! http://www.cenzic.com/downloads ------------------------------------------------------------------------ -- AWD Moneyextra and AWD Chase de Vere are trading names of AWD Moneyextra Limited, which is authorised and regulated by the Financial Services Authority (FSA). AWD Moneyextra Limited is a wholly-owned subsidiary of AWD Group plc, a member of AWD Holding AG, Europe's premier independent financial services group. Registered Office: 1 King Street, Manchester, M2 6AW. Registered in England No. 3685041. VAT Registration No. 50337 4571 Please visit our website at www.moneyextra.com ------------------------------------------------------------------------ This list is sponsored by: Cenzic Need to secure your web apps NOW? Cenzic finds more, "real" vulnerabilities fast. Click to try it, buy it or download a solution FREE today! http://www.cenzic.com/downloads ------------------------------------------------------------------------
Current thread:
- Oracle SQL Injection vulnerability Attari Attari (Nov 19)
- Re: Oracle SQL Injection vulnerability Steven Adair (Nov 19)
- Re: Oracle SQL Injection vulnerability Joxean Koret (Nov 19)
- Re: Oracle SQL Injection vulnerability Attari Attari (Nov 24)
- RE: Oracle SQL Injection vulnerability Erin Carroll (Nov 19)
- RE: Oracle SQL Injection vulnerability Paul Melson (Nov 19)
- RE: Oracle SQL Injection vulnerability Attari Attari (Nov 24)
- Re: Oracle SQL Injection vulnerability Zed Qyves (Nov 24)
- Re: Oracle SQL Injection vulnerability Attari Attari (Nov 24)
- Re: Oracle SQL Injection vulnerability Zed Qyves (Nov 24)
- Re: Oracle SQL Injection vulnerability Attari Attari (Nov 24)
- <Possible follow-ups>
- RE: Oracle SQL Injection vulnerability David Cullen (Nov 24)
- Re: RE: Oracle SQL Injection vulnerability eladexposed (Nov 25)