From SQL injection to shell: PostgreSQL edition

Posted by snyff on Sunday December 09, 2012 @04:31AM
from the pentesterlab.com dept.

( 4 comments | 30 points | on HN )

Re:From SQL injection to shell: PostgreSQL edition by ibotty on Sunday December 09, 2012 @06:17AM (#4894461)

be sure to read the prequel if you haven't done anything like that before: https://www.pentesterlab.com/from_sqli_to_shell.html

[ Parent | on HN ]

Re:From SQL injection to shell: PostgreSQL edition by herge on Sunday December 09, 2012 @12:41PM (#4895268)

If I use sql parameters in my queries, am I still vulnerable to SQL injection? What about using a (sane) ORM?

Basically, is it only php apps that hand-build queries that are vulnerable to SQL injection?

[ Parent | on HN ]

Re:From SQL injection to shell: PostgreSQL edition by jasonlotito on Sunday December 09, 2012 @12:55PM (#4895323)

Any app that hand-builds queries. PHP has nothing to do with this. Just happens to be the vehicle. The problem is simply insecure patterns.

[ Parent | on HN ]

Re:From SQL injection to shell: PostgreSQL edition by dschiptsov on Sunday December 09, 2012 @06:52AM (#4894517)

What if I have no PHP?)

[ Parent | on HN ]