Securing SQL Server by Peter A. Carter

Securing SQL Server by Peter A. Carter

Author:Peter A. Carter
Language: eng
Format: epub
ISBN: 9781484241615
Publisher: Apress


Tip

SQL Injection is discussed in Chapter 10.

SELECT 1 + name FROM sys.tables

Listing 6-12Forced Information Disclosure

When run against the WideWorldImporters database, the query in Listing 6-12 will return the error message shown in Figure 6-1.

Figure 6-1Forced error message

This error message has provided the attacker with the following information:There is a table in the database called Colors.

The application is leaking metadata.

The application is (probably) running through a highly privileged account.



Download



Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.