DEF CON 32 -Ticking SQLi - Iggy

SQL injection remains a critical and relevant web vulnerability despite being an older technique, as demonstrated by historical attacks and ongoing prevalence in security reports 2:51. The talk explores various types of SQL injection—such as inband, union-based, blind (Boolean and time-based), and out-of-band—with a focus on time-based injection, which exploits database response delays to infer sensitive data [3:50–4:47]. A real-world example shows how an attacker used a time-based payload to extract a database version by triggering a 5-second delay, ultimately earning a $5,000 bounty [16:30–17:15]. The presentation highlights how the activist group Team Goel used SQL injection in 2012 to hack institutions and leak data, emphasizing their mission to promote activism through cyber operations [19:20–21:45]. Despite being outdated in terms of tools, these techniques remain relevant due to their foundational nature and applicability to modern attacks [23:06–24:14].

The speaker concludes by recommending a free, practical resource—Paul Swigle’s "Bleach" tool—for learning SQL injection hands-on, emphasizing that understanding these concepts builds transferable skills for cybersecurity 25:01.

[Sources:

• 2:51 Briefly discusses the ongoing relevance of SQL injection in modern security landscapes.
• 3:50–4:47 Explains the mechanics of inband and union-based SQL injection with live examples.
• 16:30–17:15 Details a real-world bounty scenario using time-based SQL injection.
• 19:20–21:45 Describes Team Goel’s historical use of SQL injection for activism and data leaks.
• 23:06–24:14 Argues that foundational attack concepts remain valuable despite technological evolution.