← Back to context

Comment by jstanley

2 months ago

You can craft valid queries that don't reference any table or column name.

Right, and that's what you use to find the vulnerability. But imagine you've found the vulnerability and now you want to use it to update all of your parking tickets as paid. Without the schema, this is going to be quite tricky and will generate a lot of failed SQL. With the schema, you might be able to do it on your first try.

  • Which is why in the ordinary course of a pentest you'd use the SQL injection vulnerability to recover the information in the schema.

    • Is there not any SQLi vulnerability in practice that doesn't allow such an information recovery? That is, is the schema-recovery step so foolproof that it can always be performed on any target form? GP is suggesting that this may be difficult, depending on the kind of signal that gets returned from the form.

      2 replies →