Главная
Study mode:
on
1
Introduction
2
Agenda
3
Who are we
4
Motivation
5
Circuit Injection
6
Jet Database Engine
7
Main Dish
8
Cross Database
9
MSJet
10
MS Excel
11
Summary
12
Attack Scenarios
13
Access Scenario
14
Analysis
15
Demo
16
Scenario 2 is and the second server
17
Example
18
Information
19
Web Shell
20
Core EX
21
Memory Copy
22
Destination Address Buffer
23
Page Description Object
24
Demonstration
25
Short Summary
26
Conclusion
27
Security Boundary
Description:
Explore a comprehensive Black Hat conference talk that delves into the vulnerabilities of IIS and SQL Servers within the Microsoft ecosystem. Learn about SQL injection techniques, the relationship between IIS/SQL Server and the Microsoft JET database engine, and how these can be exploited from an attacker's perspective. Discover the potential for leveraging SQL injections in ACCESS databases beyond simply viewing unexpected data. Gain insights into circuit injection, cross-database attacks, and various attack scenarios involving Access and IIS/SQL Server. Witness demonstrations of exploits, including web shell injection and memory corruption vulnerabilities. Understand the security boundaries and implications for the Microsoft infrastructure in this 36-minute presentation by security experts Qi Deng, Bo Qu, and Tao Yan.

Give Me a SQL Injection, I Shall PWN IIS and SQL Server

Black Hat
Add to list
0:00 / 0:00