News for hackers. Stuff that matters.

A comment on Popping a shell on the Oculus developer portal. Parent comment

Re:Popping a shell on the Oculus developer portal by andypants on Monday September 01, 2014 @10:18AM (#8252929)
> It's very clever - a variation on timing failed login/password attempts.

Can you explain? To me it just looks like a way to prove the exploit exists without revealing any actual injections.

[ Parent | on HN ]
Re:Popping a shell on the Oculus developer portal by 1c4050b09 on Monday September 01, 2014 @10:40AM (#8253046)
It's a pretty common technique for exploiting Blind SQLi. You can use this as the one of the Branches in a SELECT IF to be able to determine the value of something in the DB.

https://www.owasp.org/index.php/Blind_SQL_Injection#Time-bas...

[ Parent | on HN ]