Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Would anyone be able to post a link to an article which explains how to do a Remote Post SQL Injection and how to prevent anything bad happening. Or even just explain on here.

Any help would be great.

share|improve this question

3 Answers 3

up vote 2 down vote accepted

Remote SQL injection is usually a product of poor programming and bad database configuration.

  1. Unescaped characters.
  2. No input validations.
  3. Setting a vague limit in the number of character field.

You check for the metasploit framework and you can learn lots of things from there:

http://www.offensive-security.com/metasploit-unleashed/SQL_Pwnage

Try to read also this post. It should give you a good overview.

http://shiflett.org/articles/sql-injection

share|improve this answer
    
Great stuff thanks :) –  OliverBS Jun 18 '12 at 9:58

I'd also recommend checking out DVWA (Damn Vulnerable Web App), I find practicing things helps you understand better. There's loads with the Security Stack Exchange forums on how to learn about security vulnerabilities and exploits so I won't repeat myself here, simply do a search "DVWA site:security.stackexchange.com".

Here's some links to videos on SQLi in DVWA - http://www.hackyeah.com/2010/05/hack-yeah-sql-injection-walkthrough-dvwa/ and http://securitytube-tools.net/index.php?title=DVWA.

There's a couple of cheatsheets that you should read -

  1. Rsnake's - sadly he no longer blogs but his stuff is excellent
  2. OWASP - they also have their Webgoat app, which you should look into.

I'd strongly encourage you to practice (in a safe, legal environment...e.g. your own lab) what the above links talk about as it'll help you understand quicker.

share|improve this answer

Do you mean POST as HTTP Method?

You may use sqlmap as testing tool to validate whether your application has SQL injection vulnerabilities or not.

First, find the dynamic part of your application. Enter the dynamic URL as part of sqlmap option.

Second, find the form part of your application which takes user input. Add --forms to your sqlmap option.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.