| Title |
Connection String Parameter Pollution Attacks |
| Type |
Paper
|
| Tags |
database
SQL Server
authentication
SQL injection
|
| Abstract |
This session is about Parameter Pollution in Connection Strings Attack. Today, a lot of tools and web applications allow users to configure dynamically a connection against a Database server. This session will demonstrate the high risk in doing this insecurely. This session will show how to steal, in Microsoft Internet Information Services, the user account credential, how to get access to this web applications impersonating the connection and taking advance of the web server credentials and how to connect against internal databases servers in the DMZ without credentials. The impact of these techniques are specially dangerous in hosting companies which allow customers to connect against control panels to configure databases.
|
| Authors |
Chema Alonso
Jose Palazon
|
| Submitted |
February 13, 2010 |
| Rating |
Currently 0/5 stars (0 votes).
|
| Correlation |
| Linked to |
|
| Event |
Black Hat DC 2010
|
| Resource |
---
|
| Download |
| Source |
Blackhat-DC-2010-Alonso-Connection-String-Parameter-Pollution-wp.pdf |
| Size |
392.1 KB |
| MD5 |
59235bab2c579d004331f68595fcbe43 |
| SHA1 |
373b90fa265aa776edb19fb6e3341cff81031a64 |
top
