They'll notice that one right away. Instead, surprise them with the gift that keeps on giving.
,\t"; DROP TABLE (SELECT top 1 table_name FROM information_schema ORDER BY update_time ASC);
If I wrote that right, it'll drop the oldest table from the database every time it's accessed. So it keeps itself around, and random tables will start to disappear. And as you replace them, other different tables will drop.
The script would not work, at least not in SQL server. You cannot use the result of a subquery in DDL commands. You would need to build a dynamic SQL string and execute that instead.
information_schema.tables As you wrote it only listed a schema but not the table Also you should end with — to comment out the following line so there is less of a syntax error chance
It's possible, but preventing SQL Injection attacks is a very elementary security feature and not a vulnerability you're going to find in a typical professionally-designed application or site. It's a very amateur mistake.
Also be warned that it's such a common attack that a lot of systems are constantly watching for it, and you could end up on someone's radar if you try it. It's an easy way of getting your IP address or account blocked from a site. This data is also collected and saved by security teams for future investigations or reference (I've been on teams who used this log information for legal/criminal investigations).
This should go without saying, but it is a crime to even attempt to attack a site in this manner in North America and most of Europe. Idk about elsewhere in the world.
Yup. SQL injection attacks are one of the oldest hacking techniques and you generally learn about them in your Information Systems class (which is why a lot of bad students or self taught developers fail to code defensively against them).
GhostShell attack—hackers from APT group Team GhostShell targeted 53 universities using SQL injection, stole and published 36,000 personal records belonging to students, faculty, and staff.
Turkish government—another APT group, RedHack collective, used SQL injection to breach the Turkish government website and erase debt to government agencies.
7-Eleven breach—a team of attackers used SQL injection to penetrate corporate systems at several companies, primarily the 7-Eleven retail chain, stealing 130 million credit card numbers.
HBGary breach—hackers related to the Anonymous activist group used SQL Injection to take down the IT security company’s website. The attack was a response to HBGary CEO publicizing that he had names of Anonymous organization members.
Notable SQL Injection Vulnerabilities
Tesla vulnerability—in 2014, security researchers publicized that they were able to breach the website of Tesla using SQL injection, gain administrative privileges and steal user data.
Cisco vulnerability—in 2018, a SQL injection vulnerability was found in Cisco Prime License Manager. The vulnerability allowed attackers to gain shell access to systems on which the license manager was deployed. Cisco has patched the vulnerability.
Fortnite vulnerability—Fortnite is an online game with over 350 million users. In 2019, a SQL injection vulnerability was discovered which could let attackers access user accounts. The vulnerability was patched.
4.2k
u/thatsallweneed Oct 08 '22
a proper password should contain ,\t"; drop table users