SQL Injection Isn't Dead: Smuggling Queries at the Protocol Level

Explore advanced SQL injection techniques in this DEF CON 32 conference talk that delves beyond traditional query syntax attacks into protocol-level vulnerabilities. Learn how attackers can exploit database wire protocols to smuggle entire SQL and NoSQL statements, even with prepared statements in place. Examine real-world case studies of vulnerable database driver libraries to understand how HTTP request smuggling principles apply to binary protocols, leading to authentication bypasses, data leakage, and remote code execution. Discover the varying levels of protection offered by different programming languages and frameworks against these attacks, and understand how smuggling vulnerabilities extend beyond databases to affect message queues, caching systems, and other binary protocols. Gain insights into future research directions and emerging attack vectors in protocol-level security.