Robert Ricks: New Tool for SQL Injection with DNS Exfiltration

For years people have been warned that blind SQL injection is a problem, yet there are a multitude of vulnerable websites out there to this day. Perhaps people don't realize that these vulnerabilities are very real. The current state of the art tools are Absinthe and SQL Brute for exploiting blind SQL injection. DNS exfiltration has been proposed as a method of reaching previously unassailable blind SQL injection access points. We have created a proof-of-concept tool which can download an Oracle schema and data from its tables in an automated fashion using DNS as its exfiltration mechanism. Unlike Absinthe this tool does not require any difference between successful and unsuccessful queries to work. It is also much faster than current tools since it can retrieve more than one byte of information at a time and doesn't require noticeable differences in timing. Perhaps this will help people realize that their private data is exceedingly vulnerable if they have even one SQL injection access point and don't take appropriate precautions. Robert Ricks: Bob works for G2, Inc. as a senior information systems engineer. He has experience in data mining, artificial intelligence and development of security and exploitation tools.