Penetration Testing mailing list archives
RE: Oracle SQL Injection vulnerability
From: Attari Attari <c70n3 () yahoo co in>
Date: Tue, 20 Nov 2007 01:56:42 +0000 (GMT)
Hey Paul, thanks for that. But the given link doesn't work. Does anyone have an offline copy by chance? If yes, can you bother to send me? Thanks. --- Paul Melson <pmelson () gmail com> wrote:
Does that mean the site is vulnerable to SQLInjection? I tried ' OR 1=1-- and ' OR '1'='1'--but I get same error message.Yes, and as it stands, this is definitely a finding for your client regardless of whether or not you are able to exploit it. But of course, you want to exploit it both to make a credible argument to your client as well as to feel cool. I recommend Mavituna's Oracle SQL Injection Cheat Sheet:
http://ferruh.mavituna.com/makale/oracle-sql-injection-cheat-sheet/
PaulM
------------------------------------------------------------------------
This list is sponsored by: Cenzic Need to secure your web apps NOW? Cenzic finds more, "real" vulnerabilities fast. Click to try it, buy it or download a solution FREE today! http://www.cenzic.com/downloads
------------------------------------------------------------------------
Bring your gang together - do your thing. Go to http://in.promos.yahoo.com/groups ------------------------------------------------------------------------ This list is sponsored by: Cenzic Need to secure your web apps NOW? Cenzic finds more, "real" vulnerabilities fast. Click to try it, buy it or download a solution FREE today! http://www.cenzic.com/downloads ------------------------------------------------------------------------
Current thread:
- Oracle SQL Injection vulnerability Attari Attari (Nov 19)
- Re: Oracle SQL Injection vulnerability Steven Adair (Nov 19)
- Re: Oracle SQL Injection vulnerability Joxean Koret (Nov 19)
- Re: Oracle SQL Injection vulnerability Attari Attari (Nov 24)
- RE: Oracle SQL Injection vulnerability Erin Carroll (Nov 19)
- RE: Oracle SQL Injection vulnerability Paul Melson (Nov 19)
- RE: Oracle SQL Injection vulnerability Attari Attari (Nov 24)
- Re: Oracle SQL Injection vulnerability Zed Qyves (Nov 24)
- Re: Oracle SQL Injection vulnerability Attari Attari (Nov 24)
- Re: Oracle SQL Injection vulnerability Zed Qyves (Nov 24)
- Re: Oracle SQL Injection vulnerability Attari Attari (Nov 24)
- <Possible follow-ups>
- RE: Oracle SQL Injection vulnerability David Cullen (Nov 24)
- Re: RE: Oracle SQL Injection vulnerability eladexposed (Nov 25)