Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Recently one of my sites is hacked. The hacker used SQL injection to compromise the security. After getting SQL access he injected code in many places in database. I cleaned up many of them. But I am still worried if it contain any hidden backdoor.

Is there any tool to determine such type of injected code.

share|improve this question
Did you find the original problem, making SQL-injection possible at first place? – martinstoeckli Mar 13 '13 at 11:44
Yes. original problem is fixed. I just want to make sure he didn't put any backdoor inside db. – Shiplu Mar 13 '13 at 11:50
BTW, I have extracted all the codes in db and now manually checking. – Shiplu Mar 13 '13 at 11:52
up vote 1 down vote accepted

I would suggest reviewing the connection settings for the DB as well as resetting any passwords and verifying any hostnames for users allowed to connect to the DB. Also, be sure that you have run down the original source of the intrusion. (If you have a query log, look for what other querys happened with the rogue queries, since SQL injection piggybacks on a valid query.)

The more complicated issue would be if you are hosting HTML content out of the DB in which case the attacker could have introduced pages that would allow for further injection, but such records would be very hard to find without doing a diff as you described. This could also apply if they did any permission elevation within the system that is running on the DB.

There may be other things worth checking, but those are the immediate things that come to mind for generic ways that a SQL DB could remain compromised.

share|improve this answer

I wouldn't trust any type of automated review - a single false negative, and the server will get popped again. Hopefully you have known-good backups from before the attack, otherwise it'll be hard to know what you can trust.

share|improve this answer
I have a sql dump of previous day. I can run a diff. But diff does not work well here. – Shiplu Mar 13 '13 at 9:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.