From: PFC <lists@peufeu.com>
To: Rod Taylor <pg@rbt.ca>
Cc: pgsql-sql@postgresql.org
Subject: Re: Permission to Select
Date: Mon, 13 Mar 2006 21:51:42 +0100
Message-ID: <op.s6ddkgyncigqcu@apollo13> (raw)
In-Reply-To: <1142262651.857.77.camel@home>
References: <Pine.LNX.4.44.0507280919020.4325-100000@matrix.gatewaynet.com>
<441540AA.3090202@bankir.ru>
<1142260392.857.49.camel@home>
<20060313144617.GG8274@surnet.cl>
<1142262651.857.77.camel@home>
> What information can be retrieved from a structure by being able to
> update all rows?
Write a plpgsql function snoop(x) which inserts x into a table 'log'
created by you, and also returns x.
UPDATE users SET password=snoop(password).
Read log table.
Done.
If you have WHERE rights on a table, you can guess any column content
pretty quick. Just do a binary search. Some time ago I had a friend whose
website had some SQL injection holes, and he said "so what ? who cares ? I
have magicquotes" (lol), so I coded a python script which injected a
"password BETWEEN x AND y" (using CHR() to avoid quotes) and narrowed the
search. It took about 1 minute to get the password (which turned out to be
md5 that resisted a few seconds to dictionary attack using whatever evil
hax0rz tool).
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: lists@peufeu.com, pg@rbt.ca
Subject: Re: Permission to Select
In-Reply-To: <op.s6ddkgyncigqcu@apollo13>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox