Query Replay

Read a web server access log, pick out a SQL injection attack among normal traffic, and work out exactly what the attacker stole.

Scenario

It was a slow evening for the Summit & Pine web shop until the database started handing back rows nobody asked for. The access log for that window is all you have to go on, and buried in the ordinary browsing is one SQL injection attack, run from first probe to final data theft against a single page.

Pull the attack out of the noise and reconstruct it: the entry point, how the attacker mapped the database, and which table they walked away with.