WebApp Sec mailing list archives
RE: SQL Injection and MSSQL
From: "Mutallip Ablimit" <mutax () insi co jp>
Date: Mon, 28 Jun 2004 10:19:11 +0900
Hi Felipe, Just google for the white paper named "SQL Injection Signatures Evasion". Think you will find it helpful. Regards, Mutallip Ablimit --- mutax () insi co jp -----Original Message----- From: lipe! [mailto:lipe () brturbo com] Sent: Saturday, June 26, 2004 7:14 PM To: webappsec () securityfocus com Subject: SQL Injection and MSSQL Hi all, With filters like "if the parameter has substring 'SELECT'" a malicious user can mask the 'select' from a request in ASP? I mean something like (that i know witch works in MySQL) "concat(char(1,2,3,4),char(5,6,7))"? MS SQL Server has anyway to mascarade the querys, like some unicode feature or string functions? I just need to know if theres anyway that i can put a select in a query without typing explicit "select". If there, why? Many thanks! ------------------------------------------------------------ Felipe Santos Andrade <lipe () brturbo com> Desenvolvedor TI/WEB Framework .NET -----------------------------------------------------------
Current thread:
- SQL Injection and MSSQL lipe! (Jun 26)
- RE: SQL Injection and MSSQL Mutallip Ablimit (Jun 28)
- <Possible follow-ups>
- RE: SQL Injection and MSSQL Amichai Shulman (Jun 28)