Timeline for Blind SQL Injection on Amazon RDS
Current License: CC BY-SA 4.0
7 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 20, 2018 at 16:04 | comment | added | Michael - sqlbot |
In RDS/MySQL, the value of @@hostname is especially meaningless because there is an undocumented static NAT translation layer between the AWS customer's network and the RDS-managed network, so the private IP you see there has no actual relevance, even if you were inside their network by some other mechanism. It isn't even the internal address the client machines are connecting to. If it's actually an Aurora/MySQL instance (SELECT @@AURORA_VERSION), you could try invoking a Lambda function in your account, and use your CloudTrail to see which principal was denied access. Maybe useful.
|
|
| Oct 18, 2018 at 20:30 | comment | added | HashHazard | Will be tough. If you had console you could see any public endpoints that may be attached to the RDS instance. By default they are only accessible using the RFC 1918 schema. | |
| Oct 18, 2018 at 17:22 | comment | added | Rob Gates | @HashHazard part of a pentest | |
| Oct 18, 2018 at 16:05 | comment | added | HashHazard | Is this your own account or part of a pentest? IOW, do you have console access to the AWS environment? | |
| Oct 18, 2018 at 12:57 | answer | added | NASAhorse | timeline score: 0 | |
| Oct 18, 2018 at 12:47 | answer | added | gowenfawr | timeline score: 1 | |
| Oct 18, 2018 at 12:28 | history | asked | Rob Gates | CC BY-SA 4.0 |