Look Who it Was Random video

DEF CON 17 - Summit Siddharth - The Making of the Second SQL Injection Worm

549 views · Published 16 November 2013 · 20:20 · Indexed 25 October 2026

Channel: DEFCONConference · 2013 · Science & Technology

Watch on YouTube

The Making of the second SQL injection Worm
Sumit Siddharth IT Security Consultant

The "turbo" talk will focus on exploiting SQL injections in web applications with oracle back-end. Mostly exploiting Oracle sql injections in web applications is considered to be restricted to extraction of data only. Oracle database does not offer hacker friendly functionalities such as openrowset or xp_cmdshell for privilege escalation and O.S code execution. Further, as web API do not support execution of multiple query in single statement, the exploitation is further restricted. The Talk will highlight attack vector to achieve privilege escalation (from Scott to SYS) and O.S code execution by exploiting Oracle SQL injections in web applications. Further, there will be demo of how a worm could target an Oracle back-end just as it targeted the SQL server applications.

Sumit "sid" Siddharth works as a senior IT security consultant for Portcullis Computer Security in the UK. He has been a speaker at many security conferences including Troopers, OWASP Appsec and IT Underground. He also runs the popular IT security blog www.notsosecure.com.

For copies of the slides and additional materials please see the DEF CON 17 Archive here: https://defcon.org/html/links/dc-archives/dc-17-archive.html

More from this channel