Later archive addition

SQL Injections by Truncation

Bala Neerumalla

Bala Neerumalla's Black Hat USA 2006 deck on SQL truncation. Where a column is shorter than the input a form accepts, an over-long value is silently cut to length, so a crafted registration can collide with an existing account after truncation and take it over. The deck walks the technique through SQL Server sessions and covers modification as well as injection.

Record

Researcher

Bala Neerumalla

Format

Whitepaper

In the archive

• Added to the 2006 archive after the original list was published

Tags

• sqli
• injection
• mssql
• database
• mitigation
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Bala Neerumalla, first published at the original source. Preserved copies are kept so the citation survives its host.