Yes, yes, the breach got pulled very early by the powers that be, but per the earlier point, cache is your friend. The latter is quite easy to reconstruct because the entire schema was dumped along with the breach. What we need to make this whole thing resemble a real attack is a little bit of classic ASP wiring and a database. That shouldnвЂ™t be too hard to reproduce, howвЂ™s this look?ДЇorgive me if I donвЂ™t go so far as to recreate the broken images! LetвЂ™s move on to the other thing we know about the attack, and thatвЂ™s what the back end database looks like. The affected site has been well and truly pulled by now, but of course nothing is ever really gone on the internet, it just goes to Google cache heaven: ThatвЂ™s one thing that was great about classic ASP вЂ“ it was dead easy to create a simple site! For added realism IвЂ™ll create a local host entry for and even add a self-signed cert so we can hit it via HTTPS. (Yes, I know itвЂ™s still supported but seriously folks, it was built for another era and just isnвЂ™t resilient to todayвЂ™s web risks)ДЄnyway, to reproduce this risk IвЂ™m going to create a very simple classic ASP site that looks just like the one above. If youвЂ™re running this platform today to host anything of any value whatsoever on the web, youвЂ™ve got rocks in your head. You could forgive someone for persevering with classic ASP a decade ago, perhaps even 5 years ago, but today? I donвЂ™t think so. But I digress.Д¬lassic ASP was replaced almost 12 years ago to the day with the platform that remains MicrosoftвЂ™s framework of choice for building web sites today вЂ“ ASP.NET. This is not classic like, say, a Ferrari 250 GTO which has grown increasingly desirable with age, rather itвЂ™s вЂњclassicвЂќ like CitroГ«n 2CV it was kinda cool at the time but youвЂ™d be damned if you want a mate seeing you in one today. No, not ASP.NET, go back further вЂ“ classic ASP. The first thing that should hit savvy readers in the image above is that this is an ASP web site. A long time ago in a language far, far away

Clearly we need a bit of a refresher on the risk and what better way to do it than to reconstruct the Bell system that was breached then, well, breach it again. Now you would think вЂ“ quite reasonably вЂ“ that SQLi would be becoming a thing of the past what with all the awareness and Top 10 stuff let alone the emergence of tools like object relational mappers that make it almost impossible to screw this up, but here we are. The usual fanfare quickly followed вЂ“ announcements by the attackers, silence by the impacted company (at least for the first day), outrage by affected customers and the new normal for public breaches: I got the data loaded into Have I been pwned? and searchable as soon as IвЂ™d verified it. It was pretty self-evident from the original info leaked by the attackers that SQL injection had played a prominent role in the breach, but now we have some pretty conclusive evidence of it as well:

Yes, yes, itвЂ™s happened again вЂ“ OWASPвЂ™s number one risk in the Top 10 has featured prominently in a high-profile attack this time resulting in the leak of over 40,000 records from Bell in Canada. This content is now available in the Pluralsight course 'Ethical Hacking: SQL Injection'

Best sql injection tool 2014