MySQL is an open-source relational database management system.

learn more… | top users | synonyms

0
votes
1answer
72 views

Detecting datasets that were affected by SQL injection

Assuming that I know that one of my applications was attacked by an SQL injection, how can I identify edited or selected data sets? On obvious source are webserver logs. This should allow us to ...
0
votes
0answers
19 views

sql - Select boolean strictly true [on hold]

I want to select a row Ad as boolean which is strictly true. I am using the following SQL statement. SELECT 'user' AS username, 'pass' AS password, true AS Ad FROM users LIMIT 1; However the above ...
1
vote
1answer
100 views

Using user agent & inputs for SQL injection with ModSecurity WAF

I'm trying to test a challenge website using ModSecurity as a WAF. When I put ' in the user agent I got an error from MySQL. You have an error in your SQL syntax; check the manual that corresponds ...
6
votes
1answer
219 views

SQL Injection through addslashes

I'm trying to understand how a website can be hacked through using addslashes in PHP and MySQL for educational purpose. After reading this topic and this topic, I try to understand how it can bypass ...
-1
votes
2answers
89 views

Are these queries vulnerable to injection in mysql

The queries below show SQL injection in appscans for MySQL. Is there a way to do a proof of concept or otherwise to how can they be exploited? INSERT INTO cscart_sessions (session_id, expiry) values('...
1
vote
2answers
77 views

Access MySQL via MySQL credentials, assuming no remote MySQL, FTP, or SSH access?

LAMP stack, dedicated server. I set up some MySQL users, gave them full access rights to the necessary databases, and provided the user credentials to some freelance developers. Now that the project ...
3
votes
1answer
91 views

Implementing an autologin link in an email [duplicate]

So I'm working on a PHP application called Magento and I would like to implement a link which will be sent in an email to customers that will automatically log them in. I know it is critical in terms ...
3
votes
2answers
84 views

securing unpatched websites

I have a client with a lot (read several thousand) websites in several old cms solutions that are no longer maintained. Now moving all of them to a maintained solution isn't really an option at this ...
0
votes
1answer
83 views

SQL queries using SQL Injections do not work as I think they should

I am trying to learn about SQL Injections. I have created a login form using PHP (I am quite new to PHP) as backend scripting language and MySQL as DBMS. Last day I asked a question about SQL ...
1
vote
2answers
117 views

SQL Injection not working when I think it should

I am trying to learn about PHP and SQL Injections, so I have created a login form where users introduce their username and password and click the Login button. Later in the server I get the passed ...
-1
votes
2answers
47 views

Launching SQL injection in MD5 with mysqli_real_escape_string()?

Can we exploit the MD5() and mysqli_real_escape_string() methods in this case to perform SQL injection? Here is the code snippet: $pwd = mysqli_real_escape_string($conn,MD5($_POST['pwd'])); $login = ...
1
vote
2answers
56 views

What cookie request is a suspect request?

I have this table which is containing all users' cookies: (about being login. that's actually "remember me checked") // cookies +----+---------+-------------------+------------+ | id | user_id | ...
0
votes
1answer
55 views

Adding conditions after LIMIT in MySQL

Is there any way to add any condition after LIMIT for example the OR or AND? I am wondering if we can add any query after LIMIT which returns nothing. for example the query is: SELECT * FROM table ...
-1
votes
3answers
4k views

How to hack into a remote mysql database?

(Moved from Stack Overflow as other users said it was a security question) I have a mysql database sitting on a remote server. Nothing else, ie no web site using it, no server side scripts etc, ...
1
vote
1answer
52 views

Things to do to ensure that data is secured on my virtual server [closed]

I'm not much of a server administrator but I'm maintaining a virtual server with Ubuntu OS where my website is hosted. I often use ssh, ftp and MySQL. As my website gets popular, I want to make sure ...
3
votes
3answers
672 views

If we cast a value is it still necessary to escape it with mysqli_real_escape_string()?

real_escape() is a function which needs memory for its functionality, so I was wondering if there was any necessity to do that if we've already cast it? $num = (int) $num; Can we use real_escape() ...
5
votes
1answer
89 views

PHP SQL Injection Vulnerability In UPDATE Statements

Take the following SQL query as an example: UPDATE `sqlinjection2` SET `$vote`=`$vote`+1 Our goal is to increment the vote count by more than one, in one request. We cannot access the code itself. ...
0
votes
1answer
2k views

SQLMAP unable to upload the stager file with 404 error

I can't get to upload the stager file on the OWASPbwa document root (/var/wwww/WackoPicko/users). I am not sure how to troubleshoot this error. Any help on the issue will be appreciated. Thank you. ...
4
votes
1answer
133 views

Exploiting MD5/Salt Vulnerability in this PHP form?

I've been practicing security-related subjects and this challenge has befuddled me. Note: I can't access any PHP source code, nor can I edit it. I'm only able to view it. The following is given: I ...
43
votes
1answer
5k views

I have the ability to run arbitrary Python code on the 'apache' user. What damage can I do?

So, due to bad programming on the part of one of my former colleagues, one of our internal web apps allows the user to upload and run an arbitrary Python file. This recently came to light via an ...
-1
votes
1answer
124 views

How does one securely create a MySQL database and user via the command line?

I'm making an app whose functionality includes creating a database and its user. This is accomplished like so: mysql -e "grant all on database.* to 'user'@'localhost' identified by '$PW';" $PW is ...
0
votes
0answers
16 views

MySQL 5.1 patch

In my case, MySQL 5.1 is running on Cent OS 6.7 MySQL 5.1 being the oldest version of database, can someone help with the medium of getting latest patches for the same? Up gradation to the higher ...
2
votes
2answers
148 views

PHP security hacking question, may be more than just PHP

I have an input box for for INSERTing into the database. It is written in PHP PDO. Some one typed in: <"'> and also: ' onClick='alert(1); I'm assuming they were in two different input ...
0
votes
0answers
76 views

What does this injected query achieve?

On this very good link you can see some SQL injection expressions for MySQL. Quick Detection Error Based SQLi For integer inputs: (select 1 and row(1,1)>(select count(*),concat(...
2
votes
2answers
101 views

Opening remote MySQL database to office IP address at default MySQL port risks?

I read a few questions regarding this topic that were pretty informative, but still wanted to pose my particular case. My company wants to put our data in the MySQL tables we have through our web ...
1
vote
1answer
46 views

SQLi with comment filter: dumping the database

The following SQLi (MySQL) filter is from SQLi-Labs: ... $reg = "/#/" $reg1 ="/--/" $replace ="" $id=preg_replace($reg,$replace,$id); $id=preg_replace($reg1,$replace,$id); .... $sql = "SELECT *...
5
votes
2answers
370 views

SQL Injection query error with backslash

I have a sql injection vulnerable site which works well if i input query like this qq' -- // or qq' -- ; . But when i inject without slash or semi-colon it throws following error "You have an error in ...
6
votes
2answers
276 views

What's the best way to test for SQL Injection vulnerabilities? Manual or SQLMap?

As part of my job I test for web application vulnerabilities regularly. When it comes to SQL Injection, my methodology is to start by manually browsing the website and spidering it, then, sending the ...
1
vote
1answer
51 views

In a User Roles table is it better to identify users with an ID or username?

I want to create a user roles SQL table which stores information about users permissions and roles (Such as Admin, Worker, User) I need 2 columns in the table one which identifies which user it is ...
4
votes
4answers
320 views

MySQL user passwords in PHP

How do I prevent exposing MySQL usernames and passwords in PHP code when establishing a connection?
0
votes
1answer
45 views

mySQL into outfile strange behaviour

I have sql-injection with file_priv=Y (root user) but I can only create file in /tmp and /var/tmp directories even when i have 777 permissions to destination folder - mysql server just won't create ...
6
votes
0answers
51 views

Why would I use at-rest encryption over a DB's key-based encryption?

Goal I want to store encrypted data in a database. Constraints Application-level encryption (encrypting before sending to the DB) is not a reasonable option for my use case. The DB providers I'm ...
5
votes
1answer
7k views

Understanding Boolean Based SQL Injection

I am trying to understand the concept of Boolean Based Blind SQL Injection. I have gone through OWASP Guide To SQLi to understand it. However I am confused with how exactly does it work. Below id ...
0
votes
1answer
78 views

MySQL database (non-SSL) connections secured via origin/destination IPs, how unsafe are they?

I am testing an Amazon RDS MySQL solution: the database is provided by Amazon RDS but the application logic (php scripts) that accesses the data is hosted in another, different (non-amazon) server. ...
1
vote
1answer
64 views

Amazon RDS MySQL SSL connection, is the password sent in clear?

I am testing Amazon RDS MySQL and I want to connect to MySQL instance using SSL. It works pretty well, but there is something that is not clear to me: reading the FAQs (https://aws.amazon.com/rds/faqs/...
0
votes
1answer
37 views

Getting Operating System Username using MySQL SQLi

Suppose I have a website which has SQL injection vulnerability and I got the database schema etc. Is there any means by which I can get the operating system username or the SSH username? Asking from ...
0
votes
1answer
148 views

Dumping custom query via SQL injection when output is in the die() function?

On my localhost I have a PHP link like this abc.com/index.php?q=XYZ where XYZ is a base64encoded parameter that I have verified is injectable. When I try abc.com/index.php?q=XYZ' it returns You ...
0
votes
0answers
65 views

MySQL SQL Injection - Get User Password

I've used SQLMAP to check for SQL injection. I've managed to retrieve the name of just one database (dbInfo) However, using SQLMAP I can't enumerate anything else - where it is tables within the DB ...
39
votes
2answers
32k views

Where to store a key for encryption?

I am looking for a way to store a key used for password encryption. I am using a MySQL database which would store a user name and a password encrypted with AES_ENCRYPT(str,key_str). Where can I safely ...
6
votes
3answers
611 views

Making database code open source

I am building a web app. It is currently not open source, but I am considering making it open source, so that others can fix bugs, improve it, so that others are not suspicious of my motives (fun to ...
1
vote
0answers
17 views

Create a non root user for MySQL with minimal right as using root is not secure [closed]

General rule for root MySQL user is from infosec point of view: "Do not use root for any web application for MySQL connection, Select, Update, or Delete queries. Instead of create and use another ...
3
votes
1answer
65 views

Should I use random usernames for a MySQL database? [duplicate]

I have a script that accesses a MySQL database - clearly a strong, random password and a username unique to the script with no more privileges than it needs are all sensible norms here. However, is ...
2
votes
1answer
114 views

Sqlmap, how to move forward? [duplicate]

So, I'm using Sqlmap for a while now to test the security for my company (we're too small to have IT guy and I'm the closest they got for now), I already managed to access the database remotely and ...
1
vote
2answers
147 views

Is my code using mysqli_real_escape_string and quotes100% safe against SQL Injection?

My code is: SELECT * FROM tlb_members WHERE username="{mysqli_real_escape_string($_GET['test'])}" I'm searching and some people said using quotes in SQL statements is safe. Is this true?
5
votes
3answers
200 views

Securely storing an encryption key on AWS

Regardless of the format of encryption, what is the best way to store an encryption key on an AWS EC2 server? I am storing encrypted information in a MySQL database and my cryptography key is stored ...
3
votes
1answer
98 views

Why is this SQL Injection attempt failing on DVWA?

I'm practicing SQL injection on DVWA (non-blind) with the lowest security settings. I want to list the tables in the current database. To do that, I attempt to enter 0'; show tables;-- in the User ID ...
6
votes
2answers
199 views

Securing MySQL server from remote connection

I need to open the port for my MySQL server to the outside and from what I read, the default configuration is not secure nor encrypted. For that I have a few solutions in mind with their reason but I'...
1
vote
1answer
115 views

what is the best way to know if the entered decryption key is correct?

I was searching for a way to store the encryption key of AES_ENCRYPT and found a good answer here: where to store a key for encryption However, now I am trying to use "Type in the encryption key when ...
-2
votes
1answer
114 views

Whats the most secure way to send user data from client to server? [closed]

I know there are probably many existing answers to this question but so far I couldn't find a simple detailed answer. On the android app there is two buttons, sign in with facebook and sign in with ...
4
votes
1answer
2k views

Website Login Security (Secure enough?)

I'm making a bigger site for the first time so security really matters, unlike for my really-bad boards with maybe 10 users. So I wanted to ask if the way I'm doing it is secure enough for a semi-big ...