Hi David, I'm aware of the other methods which mostly explained on your paper. Footnote 2 which clears up the definition "completely blind" was supposed to be "*No error is displayed and no indicators are visible in the response*" instead of "*No error is displayed and no indicators are visible in the response that an error occurred*".
Hopefully will update the paper soon, thanks for pointing it out. Cheers, 2008/8/19 David Litchfield <[EMAIL PROTECTED]> > Hi Ferruh, > > This is a short whitepaper about a new way to exploit Blind SQL >> Injections. >> > > I just had a read of your paper. You open with: "If the injection point is > completely blind then the only way to extract data is using time based > attacks like WAITFOR DELAY, BENCHMARK etc." This is not the case. You can > use other non-time based (and therefore faster) methods to infer the value > of data. See "Data-mining with SQL Injection and Inference" - > http://www.ngssoftware.com/papers/sqlinference.pdf > > Cheers, > David > > > > -- > E-MAIL DISCLAIMER > > The information contained in this email and any subsequent > correspondence is private, is solely for the intended recipient(s) and > may contain confidential or privileged information. For those other than > the intended recipient(s), any disclosure, copying, distribution, or any > other action taken, or omitted to be taken, in reliance on such > information is prohibited and may be unlawful. If you are not the > intended recipient and have received this message in error, please > inform the sender and delete this mail and any attachments. > > The views expressed in this email do not necessarily reflect NGS policy. > NGS accepts no liability or responsibility for any onward transmission > or use of emails and attachments having left the NGS domain. > > NGS and NGSSoftware are trading names of Next Generation Security > Software Ltd. Registered office address: 52 Throwley Way, Sutton, SM1 > 4BF with Company Number 04225835 and VAT Number 783096402 > -- Ferruh Mavituna http://ferruh.mavituna.com
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
