SQL Injection Isn't Dead: Smuggling Queries at the Protocol Level

No ratings

Presented at hack.lu 2024 by

Paul Gerste

media.defcon.orgwww.youtube.com

SQL injections seem to be a solved problem; databases have built-in support for prepared statements, leaving no room for injections. In this session, we will go a level deeper: instead of attacking the query syntax, we will explore smuggling attacks against database wire protocols, through which remote, unauthenticated attackers can inject entire (No)SQL statements into an application's database connection.