[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-571615-105":53,"doc-detail-571615-en":126},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":119,"head_meta":121,"extra_data":123,"updated_unix":125},105,"en","sql-injection-introduction-architecture-typical-attackers-tools-sql-basics","SQL Injection - Introduction - Architecture - Typical Attackers - Tools - SQL Basics","","SQL injection material outlining an end-to-end security perspective: fundamentals of SQL, then core SQL injection basics and how attacks manifest in real system flows. The content contrasts “ivory tower” security architecture with practical deployments, defines business and security rule enforcement points, and highlights how reporting and data-link scenarios change risk. It classifies common attacker types, explains their motives and typical behavior patterns, and emphasizes differing detection approaches.",{"@graph":63,"@context":118},[64,80,101],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":11,"@type":70,"position":76},"https://docshare.wps.com/template/presentations/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/sql-injection-introduction-architecture-typical-attackers-tools-sql-basics/571615/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/sql-injection-introduction-architecture-typical-attackers-tools-sql-basics/571615.png","ImageObject",442,249,{"name":88,"@type":89},"Blitz","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-19","2026-10-13",true,{"@type":98,"interactionType":99,"userInteractionCount":9},"InteractionCounter",{"@type":100},"ViewAction",{"@type":102,"mainEntity":103},"FAQPage",[104,110,114],{"name":105,"@type":106,"acceptedAnswer":107},"What security architecture is presented as the “ivory tower solution”?","Question",{"text":108,"@type":109},"The “ivory tower solution” assumes clients access a database only via an application server, with no direct database access, and that security and business rules are enforced in the application server.","Answer",{"name":111,"@type":106,"acceptedAnswer":112},"How does the document describe the “real world” final solution?",{"text":113,"@type":109},"It describes a setup where all or many clients access the database while security and business rules are enforced in the first application server, acknowledging more complex connectivity than the ivory tower approach.",{"name":115,"@type":106,"acceptedAnswer":116},"What characterizes the “Curious DBA or employee” attacker type?",{"text":117,"@type":109},"This type seeks private or sensitive information and often uses mostly SELECT statements, leaving few/no traces without auditing, making it difficult to spot.","https://schema.org",{"og:url":78,"og:type":120,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":122,"canonical":78},"index,follow",{"doc_id":124,"site_id":56},571615,1792403697,{"code":4,"msg":5,"data":127},{"doc_id":124,"user_id":128,"nickname":88,"user_avatar":129,"doc_module":9,"category_id":8,"category_name":11,"doc_title":59,"doc_description":61,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":9,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":135,"language":136,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":61,"update_tm":140,"read_time":141},24464137899374,"https://us-avatar.wpscdn.com/davatar_3d24733baf745e90a7e4bdd5f77d97b2","SQL Injection  \nBochum  \nAlexander Kornbrust 10-Nov-2009  \nRed-Database-Security GmbH  1  \nTable of Content  \nIntroduction  Architecture  \n Typical Attackers  \n Tools  \n SQL Basics  \n SQL Injection Basics  \nRed-Database-Security GmbH  2  \nArchitecture  \nArchitecture  \nRed-Database-Security GmbH  3  \nThe ivory tower solution  \nSecurity and Business Rules  \nClassic solution:  \n• Clients accessing a database via application server  \n• No direct access to the database  \n• Security and business rules are enforced in the application server  \nRed-Database-Security GmbH  4  \nThe ivory tower solution  \nin the real world  \nFinal solution  \nS&B rules  \nAnother project  \nWe need a reporting solution  \nNew project  \nYou have nice data, we will use it  \nWe just do a database link  \nYet another  \nproject  \nSome people must connect with TOAD  \n• Complex architecture  \n• All types of clients are accessing the database  \n• Security and business rules only enforced in the first application server  \nRed-Database-Security GmbH  5  \nScenario – 130 Databases  \nInternet  \nRed-Database-Security GmbH  \nFirewall  \n6  \nDBA 1  \nDBA 2  \nDBA n  \nServer  \nServer  \nEndusers  \nAttacker  \nAttackers  \nRed-Database-Security GmbH  7  \nIntroduction – Simplified Company Environment  \nProd  \nDev  \nStaging  \nCloned DB  \nEnduser  \nDBA  \nDeveloper  \nBackup  \nRed-Database-Security GmbH  8  \nClassification Attackers  \nThere are different types of attackers and we need different approaches to catch theses guys because they are leaving different tracks in the system  \nThe following types of attackers are common (list not complete):  \n• Curious DBA or Employee  \n• DBA covering its own faults  \n• Criminal employee  \n• Leaving employee  \n• External hacker  \n• Intelligence agency  \nRed-Database-Security GmbH  9  \nClassification Attackers – Curious DBA or Employee   \nType: Curious DBA or employee  \nScenario: Interested in private/sensitive information.  \nSamples:  \n• Looking up for salary of colleagues, private numbers, emails, account status of politician,    \n• Supporting private investigators (PI)  \nKnown incidents: Miles & More (Employee was looking up what politicians  \nIdentification: Mostly select statements, Few/No traces without audit, Difficult to spot  \nRed-Database-Security GmbH  10","cbCaijwPaQSPDzOf","https://ap.wps.com/l/cbCaijwPaQSPDzOf","pdf",6413383,138,"English","# Introduction\n## Architecture\n## Typical Attackers\n## Tools\n## SQL Basics\n## SQL Injection Basics\n# Classification Attackers\n## Curious DBA or Employee","[{\"question\":\"What security architecture is presented as the “ivory tower solution”?\",\"answer\":\"The “ivory tower solution” assumes clients access a database only via an application server, with no direct database access, and that security and business rules are enforced in the application server.\"},{\"question\":\"How does the document describe the “real world” final solution?\",\"answer\":\"It describes a setup where all or many clients access the database while security and business rules are enforced in the first application server, acknowledging more complex connectivity than the ivory tower approach.\"},{\"question\":\"What characterizes the “Curious DBA or employee” attacker type?\",\"answer\":\"This type seeks private or sensitive information and often uses mostly SELECT statements, leaving few/no traces without auditing, making it difficult to spot.\"}]","SQL Injection - Introduction - Architecture - Typical Attackers - Tools - SQL Basics | PDF",1791922740,48]