SQL Smuggling

[douglen () hotmail com]

After our corporate website reshuffling, I thought that now would be a good time to send this here too...
We released a research paper a few months ago, regarding a sub-class of SQL Injection that has not received attention 
till now. The crux is that when it comes to SQLi, protection and detection do not typically take the architecture into 
account; this can allow smuggling attacks which are not blocked or discovered.

The paper can be found at:
http://www.ComsecGlobal.com/framework/Upload/SQL_Smuggling.pdf 

> From the paper:
"This paper will present a new class of attack, called SQL Smuggling. SQL Smuggling is a sub-class of SQL Injection 
attacks that rely on differences between contextual interpretation performed by the application platform and the 
database server.  While numerous instances of SQL Smuggling are commonly known, it has yet to be examined as a discrete 
class of attacks, with a common root cause. The root cause in fact has not yet been thoroughly investigated; this 
research is a result of a new smuggling technique, presented in this paper. It is fair to assume that further study of 
this commonality will likely lead to additional findings in this area. 

SQL Smuggling attacks can effectively bypass standard protective mechanisms and succeed in injecting malicious SQL to 
the database, in spite of these protective mechanisms. This paper explores several situations wherein these protective 
mechanisms are not as effective as assumed, and thus may be bypassed by malicious attackers. This in effect allows an 
attacker to succeed in "smuggling" his SQL Injection attack through the applicative protections, and attack the 
database despite those protections.  "

Of course, I'm looking forward to hearing about other instances of this...

Cheers,
AviD