Talk:Testing for SQL Server

Revision as of 19:30, 21 November 2006 by Icesurfer (Talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

I think that the timing attack described by Daniel Bleichenbacher is too much of a different nature to be used as an example for the WAITFOR-based injection... Moreover, we should probably change the terminology from "timing attack" to "inferenced attacks" which is the original term used by David Litchfield and is a more general term, encompassing other similar techniques based on error codes and parameter splitting (see his paper in the references) ...what do you guys think ?