Penetration Testing and Network Defense

Chapter 8. Performing Database Attacks

As a general rule, the most successful man in life is the man who has the best information.

—Benjamin Disraeli

Practically every successful company in existence uses a database. Having the ability to store information about your business in some kind of logical order means that answering a question like “How many laptops do we have in stock?” does not involve going out to the store room and physically counting them or rummaging through a pile of delivery notes and purchase orders to get the answer.

Databases are everywhere. Every time you use a search engine, call Directory Assistance for a phone number, or buy clothes in a department store, you are indirectly accessing and perhaps updating data held in ...