SQLSnoop Attack Exploits Database System Views to Intercept Plaintext Passwords Before Hashing

Summary

This article details a SQL injection attack technique called "SQLSnoop" that exploits database system views (Oracle's v$sql and PostgreSQL's pg_stat_activity) to capture plaintext passwords even when they are hashed within SQL queries. The attack requires VIEW SERVER STATE permission and works by injecting a loop with DBMS_LOCK.SLEEP to monitor active SQL statements containing password hashing functions like STANDARD_HASH, allowing attackers to intercept the plaintext password before it gets hashed. The article discusses mitigation strategies including revoking unnecessary permissions and restricting access to system views.

Source

bskySQLSnoop Attack Exploits Database System Views to Intercept Plaintext Passwords Before Hashingundercodetesting.com