Jakub Pruzinec

A cybersecurity researcher at Nanyang Technological University, Singapore.

[Jakub Pruzinec @offbyfour]

Thrilled to announce the release of Hakuin - a blazing fast framework for Blind SQL Injection optimization and automation.

https://t.co/qegDINviVe

Hakuin made it to this year's @wootsecurity and @HITBSecConf.

#HITB2023HKT, #woot23

Special thanks to @capstone_engine.

[Jakub Pruzinec @offbyfour]

We'll be presenting our talk on temporary email addresses at #BHMEA24 on the 26th of November. Looking forward!

CC: @k4kTuSS @capstone_engine

[Jakub Pruzinec @offbyfour]

Hakuin, a blazing fast Blind SQL Injection framework, made it to BlackHat Middle East & Africa this year! Come check out my two sessions (14 Nov 3pm, 15 Nov 5pm) at the arsenal track.

Hakuin: https://t.co/qegDINviVe

#BHMEA #BHMEA23

[Jakub Pruzinec @offbyfour]

@clintgibler Thanks for the shout-out. BTW the framework is actively developed and new features are added!

[Jakub Pruzinec @offbyfour]

@ron190jsql My point here is that if you deduplicate the "users_sex" column then you'll get "male" & "female" but there is no way you can tell which users are male/female (without additional requests). Same goes for "product_category". I like the feature tho, will probably do it as well.

[Jakub Pruzinec @offbyfour]

@ron190jsql You can have parallelism on bit/character/column level and achieve the same performance.

One advantage I see with bit-extraction is that it can be easily combined with single-request-multiple-bits extraction (see "Blind sql injection attacks optimization" by Ruben Ventura).

[Jakub Pruzinec @offbyfour]

@ron190jsql Hey, thx for finding time to read our paper, I'll try to address your comments.

[Jakub Pruzinec @offbyfour]

Just presented our paper "Hakuin: Optimizing Blind SQL Injection with Probabilistic Language Models" at @wootsecurity. Thanks everyone for making WOOT23 a great experience!

Paper: https://t.co/tScJ0qfOFK
Slides: https://t.co/hNgJlecKu2

cc: @capstone_engine

[USENIX WOOT Conference on Offensive Technologies @wootsecurity]

Session 4: Web & Network Security!

"Scripted Henchmen: Leveraging XS-Leaks for Cross-Site Vulnerability Detection"

"Hakuin: Optimizing Blind SQL Injection with Probabilistic Language Models"

"Towards Simultaneous Attacks on Multiple Cellular Networks"