SecDocs Feed for author Chema Alonso

[Slides] LDAP Injection & Blind LDAP Injection

Thu, 26 Jan 2012 22:42:29 +0100

Authors: Chema Alonso José Parada
Tags: authentication
Event: Black Hat EU 2008

[Paper] LDAP Injection & Blind LDAP Injection

Thu, 26 Jan 2012 22:41:55 +0100

Authors: Chema Alonso José Parada
Tags: authentication
Event: Black Hat EU 2008

[Paper] Connection String Parameter Attacks

Tue, 11 Jan 2011 06:08:52 +0100

Authors: Chema Alonso Jose Palazon
Tags: database web application
Event: DEFCON 18

[Slides] Connection String Parameter Attacks

Tue, 11 Jan 2011 06:08:27 +0100

Authors: Chema Alonso Jose Palazon
Tags: database web application
Event: DEFCON 18

[Video] Connection String Parameter Attacks

Tue, 11 Jan 2011 06:07:43 +0100

Authors: Chema Alonso Jose Palazon
Tags: database web application
Event: DEFCON 18

[Video] Connection String Parameter Attacks

Tue, 11 Jan 2011 05:59:46 +0100

Authors: Chema Alonso Jose Palazon
Tags: database web application
Event: DEFCON 18

[Video] FOCA2: The FOCA Strikes Back

Tue, 11 Jan 2011 05:47:40 +0100

Authors: Chema Alonso Jose Palazon
Tags: network privacy
Event: DEFCON 18

[Audio] FOCA2: The FOCA Strikes Back

Tue, 11 Jan 2011 05:38:28 +0100

Authors: Chema Alonso Jose Palazon
Tags: network privacy
Event: DEFCON 18

[Video] Tactical Fingerprinting Using Metadata, Hidden Info and Lost Data

Mon, 22 Feb 2010 06:15:17 +0100

Authors: Chema Alonso Jose Palazon
Tags: forensic privacy Office
Event: DEFCON 17

[Audio] Tactical Fingerprinting Using Metadata, Hidden Info and Lost Data

Mon, 22 Feb 2010 06:15:14 +0100

Authors: Chema Alonso Jose Palazon
Tags: forensic privacy Office
Event: DEFCON 17

[Paper] Tactical Fingerprinting Using Metadata, Hidden Info and Lost Data

Mon, 22 Feb 2010 06:15:12 +0100

Authors: Chema Alonso Jose Palazon
Tags: forensic privacy Office
Event: DEFCON 17

[Slides] Tactical Fingerprinting Using Metadata, Hidden Info and Lost Data

Mon, 22 Feb 2010 06:15:11 +0100

Authors: Chema Alonso Jose Palazon
Tags: forensic privacy Office
Event: DEFCON 17

[Slides] How easy SQL Injection bugs defeat the most famous Web vulnerability scanners

Wed, 17 Feb 2010 12:14:00 +0100

Authors: Chema Alonso José Parada
Tags: SQL injection
Event: Confidence 2009 Warszawa

[Slides] Connection String Parameter Pollution Attacks

Sat, 13 Feb 2010 06:10:58 +0100

Authors: Chema Alonso Jose Palazon
Tags: database SQL Server authentication SQL injection
Event: Black Hat DC 2010
Abstract: This session is about Parameter Pollution in Connection Strings Attack. Today, a lot of tools and web applications allow users to configure dynamically a connection against a Database server. This session will demonstrate the high risk in doing this insecurely. This session will show how to steal, in Microsoft Internet Information Services, the user account credential, how to get access to this web applications impersonating the connection and taking advance of the web server credentials and how to connect against internal databases servers in the DMZ without credentials. The impact of these techniques are specially dangerous in hosting companies which allow customers to connect against control panels to configure databases.

[Paper] Connection String Parameter Pollution Attacks

Sat, 13 Feb 2010 06:10:55 +0100

[Audio] Time-Based Blind SQL Injection using heavy queries: A practical approach for MS SQL Server, MS Access, Oracle and MySQL databases and Marathon Tool

Sat, 31 Oct 2009 13:58:26 +0100

Authors: Chema Alonso José Parada
Tags: SQL injection
Event: DEFCON 16

[Video] Time-Based Blind SQL Injection using heavy queries: A practical approach for MS SQL Server, MS Access, Oracle and MySQL databases and Marathon Tool

Sat, 07 Mar 2009 23:24:00 +0100

Authors: José Parada Chema Alonso
Tags: SQL injection
Event: DEFCON 16

[Paper] Time-Based Blind SQL Injection using heavy queries: A practical approach for MS SQL Server, MS Access, Oracle and MySQL databases and Marathon Tool

Sat, 07 Mar 2009 23:21:00 +0100

Authors: José Parada Chema Alonso
Tags: SQL injection
Event: DEFCON 16

[Slides] Time-Based Blind SQL Injection using heavy queries: A practical approach for MS SQL Server, MS Access, Oracle and MySQL databases and Marathon Tool

Sat, 07 Mar 2009 23:08:00 +0100

Authors: José Parada Chema Alonso
Tags: SQL injection
Event: DEFCON 16