This document discusses techniques for SQL injection attacks, including gathering information, grabbing passwords, creating database accounts, interacting with the operating system, evading intrusion detection systems, and input validation circumvention. It explains that SQL injection targets vulnerable web applications rather than servers or operating systems by tricking queries and commands entered through webpages.

1. Sql Injection Paper
By zeroday.
zeroday [ at ] blacksecurity.org
1.Introduction.
2.Testing for vulnerabilities.
3.Gathering Information.
4.Data types.
5.Grabbing Passwords.
6.Create DB accounts.
7.MySQL OS Interaction.
8.Server name and config.
9.Retrieving VNC password from registry.
10.IDS Signature Evasion.
11.mySQL Input Validation Circumvention using Char().
12.IDS Signature Evasion using comments.
13.Strings without quotes.
1. When a box only has port 80 open, it's almost certain the admin will
patch his server,
The best thing to turn to is web attacks. Sql Injection is one of the
most common web attacks.
You attack the web application, ( ASP, JSP, PHP, CGI..etc) rather than
the webserver
or the services running on the OS.
Sql injection is a way to trick using a qurey or command as a input via
webpages,
most websites take parameters from the user like username and passwrod
or even