<div dir="ltr">If the local news were to parade one engaging cat burglar in the shadows to tell the "behind the scenes" stories, then we'd all enjoy it as entertainment and move on. It would be absurd to assume that he speaks for, or even has knowledge of, how every other criminal practices their art outside of the small group he runs with. Obviously, given the risks involved, those of greater skill aren't going to associate or collaborate with those of lesser skill.<div style>
<br></div><div style>The article is interesting and entertaining as far as it provides one perspective that many of us don't often consider, but it should hardly be considered authoritative or definitive on the state of the art. </div>
<div class="gmail_extra"><br>- nathan</div><div class="gmail_extra"><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Jul 4, 2013 at 4:47 AM, antisnatchor <span dir="ltr"><<a href="mailto:antisnatchor@gmail.com" target="_blank">antisnatchor@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">Well actually I disagree
with that article.<br>
<br>
There have been multiple occasions of people hacking stuff with SQLmap
for example,<br>
without even using a random UA, and many of those cases were time or
boolean blind SQLi.<br>
<br>
Also the statement "it's hard to use", I'm not sure I agree with that
either. It's hard to use<br>
if you retrieve bit-by-bit manually, but who does that?<br>
<br>
Cheers<br>
antisnatchor<br>
<br>
<blockquote style="border:0px none" type="cite">
<div style="margin-left:40px"><hr style="border:none 0;border-top:1px dotted #b5b5b5;min-height:1px;margin:0"><br></div>
<table style="padding-top:5px">
<tbody><tr><td style="padding-top:4px" valign="top"><img src="cid:part1.04040409.01010100@gmail.com" name="13fc3a3adb9ad043_compose-unknown-contact.jpg" height="25px" width="25px"></td><td style="padding-left:5px" valign="top">
<a href="mailto:lcamtuf@coredump.cx" style="color:#2057ef!important;text-decoration:none!important" target="_blank">Michal Zalewski</a><br><font color="#888888">July 3, 2013 5:59 PM</font></td></tr></tbody>
</table>
<div style="color:#888888;margin-left:35px"><div class="im"><br><div><br>The entire series is, ahem,
interesting, for reasons that I will leave<br>open to readers'
interpretation:<br><br><a href="http://blog.whitehatsec.com/interview-with-a-blackhat-part-1/" target="_blank">http://blog.whitehatsec.com/interview-with-a-blackhat-part-1/</a><br><br>/mz<br>_______________________________________________<br>
Dailydave
mailing list<br><a href="mailto:Dailydave@lists.immunityinc.com" target="_blank">Dailydave@lists.immunityinc.com</a><br><a href="https://lists.immunityinc.com/mailman/listinfo/dailydave" target="_blank">https://lists.immunityinc.com/mailman/listinfo/dailydave</a><br>
</div></div><hr style="border:none 0;border-top:1px dotted #b5b5b5;min-height:1px;margin:15px 0 0 0"><br></div>
<table style="padding-top:5px">
<tbody><tr><td style="padding-top:4px" valign="top"><img src="cid:part1.04040409.01010100@gmail.com" name="13fc3a3adb9ad043_compose-unknown-contact.jpg" height="25px" width="25px"></td><td style="padding-left:5px" valign="top">
<a href="mailto:dave@immunityinc.com" style="color:#2057ef!important;text-decoration:none!important" target="_blank">Dave Aitel</a><br><font color="#888888">July 3, 2013 4:07 PM</font></td></tr></tbody>
</table>
<div style="color:#888888;margin-left:35px"><div><div class="h5"><br>
So I've now watched all of the Covert Affairs seasons, and I have to
say, the writers got better as it went on and the show got a
grittier, more disillusioned feel. More like Homeland, and less like
Archer.<br>
<br>
But it's fantasy, of course. One of the characters (Auggie) is a
blind operative and he occasionally gets sent out on missions where
he runs about in strange cities and fights people and does other
various spy things that are fairly hard to do when you're blind.
They make it seem as plausible as, for example, the 5 foot, 100
pound Piper Perabo beating up various thugs (one per episode at
least - she's quite violent). <br>
<br>
<img name="13fc3a3adb9ad043_image.jpg" src="cid:part3.05030008.08030902@gmail.com" alt="Auggie is blind" height="169" width="300"> (Note how in this obviously fantasy CIA
picture
there is no tweed, nor khakis!)<br>
<br>
In this blog, RSnake and some random blackhat go into a few things:<br>
<a href="http://blog.whitehatsec.com/blind-sql-injection-what-is-it-good-for/" target="_blank">http://blog.whitehatsec.com/blind-sql-injection-what-is-it-good-for/</a><br>
<br>
One thing they point out is that one of the random BlackHats that
they're friends with does not really use Blind SQLi to penetrate
machines, and he doesn't know anyone who does. "Because it's
annoying". Tru dat.<br>
<br>
"""<br>
<span style="text-indent:0px;letter-spacing:normal;font-variant:normal;text-align:start;font-style:normal;display:inline!important;font-weight:normal;float:none;line-height:24px;color:rgb(68,68,68);text-transform:none;font-size:14px;white-space:normal;font-family:'Open Sans',Helvetica,Arial,sans-serif;word-spacing:0px">Internally at WhiteHat we’ve had the long-standing
belief that blind SQL injection is rarely if ever actually used in
attacks. We hear a lot about blind SQL injection at conferences,
in papers and while talking with researchers, but we just don’t
hear about it being used. Sure, there may be one piece of
anecdotal evidence somewhere, but as a general class of attack it
doesn’t seem to be a favorite of attackers. The reason being? It’s
hard to use.</span><br>
"""<br>
<br>
I love that paragraph for so many reasons. Regardless, Immunity's
consulting arm uses only Blind SQLi for our penetration tests, both
for finding vulnerabilities, and for exploiting them. <br>
<br>
-dave<br>
[1] Miguel's talk: <a href="https://lists.immunityinc.com/pipermail/dailydave/2013-January/000299.html" target="_blank">https://lists.immunityinc.com/pipermail/dailydave/2013-January/000299.html</a>
</div></div><div class="im"><div>_______________________________________________<br>Dailydave
mailing list<br><a href="mailto:Dailydave@lists.immunityinc.com" target="_blank">Dailydave@lists.immunityinc.com</a><br><a href="https://lists.immunityinc.com/mailman/listinfo/dailydave" target="_blank">https://lists.immunityinc.com/mailman/listinfo/dailydave</a><br>
</div></div></div>
</blockquote>
</div><br>_______________________________________________<br>
Dailydave mailing list<br>
<a href="mailto:Dailydave@lists.immunityinc.com">Dailydave@lists.immunityinc.com</a><br>
<a href="https://lists.immunityinc.com/mailman/listinfo/dailydave" target="_blank">https://lists.immunityinc.com/mailman/listinfo/dailydave</a><br>
<br></blockquote></div><br></div></div>