X-Original-To: pgsql-sql-postgresql.org@localhost.postgresql.org Received: from localhost (av.hub.org [200.46.204.144]) by postgresql.org (Postfix) with ESMTP id 3C3F19DCD6F for ; Mon, 13 Mar 2006 16:51:39 -0400 (AST) Received: from postgresql.org ([200.46.204.71]) by localhost (av.hub.org [200.46.204.144]) (amavisd-new, port 10024) with ESMTP id 60226-04 for ; Mon, 13 Mar 2006 16:51:40 -0400 (AST) X-Greylist: from auto-whitelisted by SQLgrey- Received: from peufeu.com (boutiquenumerique.com [82.67.9.10]) by postgresql.org (Postfix) with ESMTP id 587799DC98D for ; Mon, 13 Mar 2006 16:51:34 -0400 (AST) Received: (qmail 14059 invoked from network); 13 Mar 2006 21:51:43 +0100 Received: from boutiquenumerique.com (HELO apollo13) (82.67.9.10) by boutiquenumerique.com with SMTP; 13 Mar 2006 21:51:43 +0100 Date: Mon, 13 Mar 2006 21:51:42 +0100 To: "Rod Taylor" Subject: Re: Permission to Select References: <441540AA.3090202@bankir.ru> <1142260392.857.49.camel@home> <20060313144617.GG8274@surnet.cl> <1142262651.857.77.camel@home> Cc: pgsql-sql@postgresql.org From: PFC Content-Type: text/plain; format=flowed; delsp=yes; charset=utf-8 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-ID: In-Reply-To: <1142262651.857.77.camel@home> User-Agent: Opera M2/8.51 (Linux, build 1462) X-Virus-Scanned: by amavisd-new at hub.org X-Spam-Status: No, score=0.108 required=5 tests=[AWL=0.108] X-Spam-Score: 0.108 X-Spam-Level: X-Archive-Number: 200603/197 X-Sequence-Number: 24543 > What information can be retrieved from a structure by being able to > update all rows? Write a plpgsql function snoop(x) which inserts x into a table 'log' created by you, and also returns x. UPDATE users SET password=snoop(password). Read log table. Done. If you have WHERE rights on a table, you can guess any column content pretty quick. Just do a binary search. Some time ago I had a friend whose website had some SQL injection holes, and he said "so what ? who cares ? I have magicquotes" (lol), so I coded a python script which injected a "password BETWEEN x AND y" (using CHR() to avoid quotes) and narrowed the search. It took about 1 minute to get the password (which turned out to be md5 that resisted a few seconds to dictionary attack using whatever evil hax0rz tool).