WebApp Sec mailing list archives
Re: Oracle SQL Injection
From: Tim <tim-security () sentinelchicken org>
Date: Tue, 11 Jul 2006 22:31:12 -0400
Thanks for the reply Tim. Yes I have read these articles and also the PeteFinnigan.com site. They are both very good resources but although they allude to being able to perform UPDATES etc I couldn't see a good example. As for the SUBSELECT suggestion, I did think about that one myself however I didn't know you can embed UPDATES or DELETES within a SUBSELECT. Could you please provide some sample syntax on this.
Hmm, perhaps you're right, I don't see anything indicating you can use an update/delete/insert in a subquery. I'm no Oracle expert and I don't have a system to test on right now. Can you call built-in stored procedures from your point of injection? Maybe some of them will be of use to you. good luck, tim ------------------------------------------------------------------------- Sponsored by: Watchfire Cross-Site Scripting (XSS) is one of the most common application-level attacks that hackers use to sneak into web applications today. This whitepaper will discuss how traditional CSS attacks are performed, how to secure your site against these attacks and check if your site is protected. Cross-Site Scripting Explained - Download this whitepaper today! https://www.watchfire.com/securearea/whitepapers.aspx?id=701500000008Vmr --------------------------------------------------------------------------
Current thread:
- Oracle SQL Injection Mark Keegan (Jul 11)
- Re: Oracle SQL Injection Tim (Jul 11)
- Re: Oracle SQL Injection Cesar (Jul 11)
- Re: Oracle SQL Injection Andrew van der Stock (Jul 11)
- RE: Oracle SQL Injection Mark Keegan (Jul 12)
- Re: Oracle SQL Injection Tim (Jul 12)
- RE: Oracle SQL Injection Mark Keegan (Jul 12)
- RE: Oracle SQL Injection Integrigy (Jul 12)
- Re: Oracle SQL Injection Tim (Jul 11)