Defcon Post-Mortem

by Ben Toews

Scott Behrens and I just got back from speaking about our new tool, BBQSQL, at Defcon. This was the first time speaking at Defcon for both of us and it proved to be one of the most intimidating and rewarding speaking engagements either of us have done.

To give a brief recap, BBQSQL is a Blind SQL Injection Exploitation tool. It is designed for speed and versatility – things that many of the currently available tools lack. To achieve versatility, we ask the user to input a lot of details about how she would like to perform the attack. To achieve speed, we use gevent for massive concurrency and attempt to use various algorithms to speed up the guessing of character values.

We also focused on writing clean code with detailed comments and thorough documentation, so you can hopefully learn everything you need to know from the github page. If you are feeling adventurous, go ahead and fork the project and we will gladly accept any pull requests. Similarly, if you run into problems or think of an awesome feature, submit an issue and we will try to be as responsive as possible.

If you want to check out our slides, you can find them here.

2 thoughts on “Defcon Post-Mortem

  1. I get this error when i try to install?

    root@bt:~/Downloads/Neohapsis-bbqsql-e15ee90# python setup.py install
    Traceback (most recent call last):
    File “setup.py”, line 4, in
    import bbqsql
    File “/root/Downloads/Neohapsis-bbqsql-e15ee90/bbqsql/__init__.py”, line 30, in
    from lib import *
    File “/root/Downloads/Neohapsis-bbqsql-e15ee90/bbqsql/lib/__init__.py”, line 1, in
    import api
    File “/root/Downloads/Neohapsis-bbqsql-e15ee90/bbqsql/lib/api.py”, line 2, in
    from .pretty_print import PrettyTable
    File “/root/Downloads/Neohapsis-bbqsql-e15ee90/bbqsql/lib/pretty_print.py”, line 7, in
    import gevent
    ImportError: No module named gevent
    root@bt:~/Downloads/Neohapsis-bbqsql-e15ee90#

    • Yeah. The project depends on gevent. It easier if you just install the whole thing with pip

      “sudo pip install bbqsql”

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s