Please create an account to participate in the Slashdot moderation system


Forgot your password?
Databases Security

Capturing the Flag, SQLi-Style 24

CowboyRobot writes "Penetration tester and long-time security professional Sumit 'Sid' Siddharth has developed a real-world SQL injection sandbox simulator, and invites the public for a capture the flag event later this month. 'The only way you can understand the true impact of vulnerabilities is by practicing exploitation. Even vulnerability identification goes hand-in-hand with exploitation,' says Siddharth. 'Sometimes identifying the vulnerability is really difficult, and it's only when you know advanced exploitation techniques that you can do so. We've also put together some really nice examples where identifying the vulnerability is really difficult, and we've asked people to find the needle in the haystack because that's how websites get compromised at the end of the day,'"
This discussion has been archived. No new comments can be posted.

Capturing the Flag, SQLi-Style

Comments Filter:
  • Real world SQL injection usually ends badly. The last SQL injection that actually worked in real life was The Empire Strikes Back. So yes. I agree. SQL injection is usually a disaster.
  • Either his site is being SQLi'd to death or he is being /.'d no worky. Maybe he can come back and monetize this CTF to include: "How to run a webserver while being visitedDoS'd"

  • by Anonymous Coward
  • They are offering a free 30-day trial as long as you give them payment information. This is the same as all of the "Free Credit Reports" that require you to sign up with a credit card and cancel at the end of the free trial.
  • While I do write some stored procedures, everything in the application is done through a data access layer like EntityFramework (we're a visual studio shop). Now, XSS attacks, escalation of privileges, and any number of other web based attacks are still a big deal. But SQL injection is the least of my worries. Is this different elsewhere?

    • While I think that object relational mappers are great for simple CRUD operations, I find they really start to break down once you want to do a somewhat complex queries. They can get the job done, but the biggest problem I have with them is the readability of the resulting code. SQL is much more readable than the equivalent for more complex queries.
    • Srsly. I type my SQL in through a keyboard. My handwriting and OCR do not play nicely together.

      obligatory []
  • by Anonymous Coward

    First task: Bypass the SQLi Lab authentication and use the site without registration. :-)

  • It's a trap! Don't do it...this is a honeypot set up by government organizations to catch criminals and bring them up on hacking related charges! [] -- Lord, I hope the sarcasm comes through.
  • You can get plenty of free SQLi trainings and labs at sites like enigmagroup and hackthissite. OWASP has good training VM images available as well, This is a commercial lab where you have to pay to take the class and get access to the labs.

The unfacts, did we have them, are too imprecisely few to warrant our certitude.