SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database.

learn more… | top users | synonyms

0
votes
0answers
22 views

MySQL order by clause with expression [migrated]

I am going through some starter material on SQL injections and while fuzzing, one SQL query I concocted was:SELECT * FROM users ORDER by 3 and 0; Now, shouldn't the part 3 AND 0 evaluate to 0. But ...
0
votes
0answers
25 views

How to allow INFORMATION_SCHEMA.TABLES to pass through in the query?

I'm practicing SQL injection on a test bed where 'OR' and 'AND' keywords are blacklisted. So on using Logical operators such as || and &&, I'm able to proceed however when trying the query ...
0
votes
2answers
63 views

Security issues on allowing Special characters in input field

I am building a web application, in which I am required to let user enter any character(even special characters - ~!@#$%^&*()_-+=|\{}[];:'"<,.>) in an input field. To mitigate the problems ...
1
vote
1answer
25 views

How does union select statement output vulnerable columns

How does union select statement output vulnerable columns in sql injection Consider a SQL vulnerable site. Let the number of columns in the query be 3. So the statement goes, ...
0
votes
0answers
9 views

Should I add signatures to the Netscaler Application Firewall for Exchange, Cognos, etc?

This link describes that I can use Cenzic, IBM AppScan, Qualsys, Trend Micro and Whitehat files to create an application filter for various products. I'm looking for filters that apply to commonly ...
4
votes
1answer
105 views

SQL Injection explain this query

' 1=1 GROUP BY CONCAT_WS ('~',version(), FLOOR(rand(0)*2)) having min(0) 1>> My first question is what is CONCAT function is being used for in this query 2>> And Why do we use having min(0) in ...
-5
votes
0answers
20 views

SQL tool passing value issue? [closed]

I am developing a sql injection tool in C#.The problem is i have stored aa sql payloads in an array,my site has one url entry field and sql payload button,if i enter url and click on sql payload it ...
2
votes
0answers
26 views

SQLMap on a seqential form

There is a certain form that gets posted over POST. The form has some form elements. I am doing a pen-test on the application that has this form. The form values are being stored in a certain ...
2
votes
1answer
35 views

Is it a security concern if MySQL manipulates parameter types?

This is a follow up to a question I posted on Stack Overflow but you don't need to read that question - I'm recapping the pertinent details here. I'm testing a PHP application which uses a MySQL ...
0
votes
1answer
58 views

sqlmap cannot find a dispatched vulnerability

I have a known sqli vulnerability that I'd like to try out with sqlmap in a web application; however, I don't believe sqlmap is able to figure this one out. Here's how the system works: Inject on a ...
1
vote
0answers
26 views

How to identify column types during sql injection with “union all select” construct?

Situation is following: I have identified sql injection attack vector, and have following information about target table: It has six columns. (Identified using "order by"). I can see output of 3 of ...
0
votes
1answer
61 views

Is it possible to bypass HTML character reference encoding to inject SQL in this context?

I was poking around with the "reset password" page of a website (security testing and bug hunting is allowed on it.) When you put in your email address, it uses HTML character reference encoding to ...
0
votes
1answer
75 views

How sqlmap works to get all database info

I am curious how sqlmap able to get all the info from the database? I am using burp as proxy to view all the request and response. From the response I couldn't see any information related to the ...
9
votes
9answers
2k views

Is testing for SQL injection vulnerabilities still relevant in modern web applications?

First some background: I'm an Infrastructural Engineer with 5 years of experience mainly in Virtualization and Networking. I've spent the past year doing a lot of self study about security, passed ...
43
votes
4answers
6k views

Does read-only access to the database prevent sql injection?

I have a web api that connects to my SQL Server using a read-only connection and want to allow tech savvy users of my api to enter an SQL where clause on the querystring. I basically just want to tack ...
-4
votes
1answer
91 views

How to make my PHP website vulnerable to SQL injection [duplicate]

For training purposes, I want to make a demo website vulnerable to SQL injection. I went to the .htaccess file in the server and added these 2 lines: php_flag magic_quotes_gpc Off php_flag ...
1
vote
1answer
41 views

how to separate arguments in sql query [closed]

I have this query : 'UNION ALL SELECT group_concat(username,password) from users-- and I want to separate username and password because when I execute the code it prints it all in one long string. ...
-1
votes
1answer
75 views

Cookie based sqli [closed]

I have identified a website vulnerable to sql injection via a authentication token. Does anyone know where I can find a tutorial / example of cookie based sql injection?
0
votes
2answers
98 views

“&” character in url [duplicate]

I think I found a bug in my website but don't know how dangerous it is. My website will redirect you to a warning page whenever you click on a link that is pasted in the comments section. The url ...
1
vote
0answers
31 views

Why the column fields doesn't show up on injection of column names?

I'm practicing SQL injection. I've been able to get the column names and table names on a test environment. query 1. On executing below query, I see adminId, adminUsername, adminPassword ...
0
votes
1answer
49 views

Injecting a query within a query that has an order by or group by function [closed]

Select * from Shop where Item = $item order by ProductNum desc I found this vulnerability within a website. To test if there's any vulnerabilities I inserted a single quotation after ...
0
votes
0answers
59 views

sqlmap cannot find injection vulnerability

I create a page called register.php which will take 4 parameters user, pass, email, comments. And the pass is vulnerable to sql injeciton. I have tested the vulnerability manually by filling test', ...
2
votes
2answers
127 views

After trying successful SQL injection why the result isn't getting displayed on the webpage?

Below is the PHP code I wrote that allows SQL injection with one parameter ie 'id' in this case. On trying SQL injection via putting this 2' ORDER BY 1;--' in the parameter (id field ), I get ...
0
votes
2answers
64 views

SQL Injection in a Web Service URL as a Parameter Value [closed]

Obviously SQL Injection via the payload of a message is a very common practice and therefore it is always key to cover this (I already have in my code). However I'm just wondering about how possible ...
0
votes
2answers
75 views

Would Insecure Direct References and SQL Injection be solved by using Row-Level Security and Per-User Connection Strings?

Regarding the following OWASP Vulnerabilities: Insecure Direct Object References By that I mean letting someone see /account/123/not-theirs (this could be the wrong reference I'm using above). SQL ...
3
votes
1answer
56 views

Can we join a table in this Ruby on Rails Direct Object Reference?

I am trying to inject a RoR application... I have found a nice command which will allow me to delete things unchecked...but the problem is that its not a problem its a very minor point, to make it a ...
4
votes
3answers
201 views

Demonstrating SQL injection

I want to do a demo for a login page that is vulnerable to SQL injection for training purposes. I already tried to build one using PHP and MySQL. I commented the code sanitation to make the page ...
2
votes
0answers
26 views

Understanding how openx cache was infected

I have a system that uses openx for serving banners. I have recently noticed that several cache file in /var/cache contain infected code. The code contains sql queries that create several php files in ...
3
votes
1answer
152 views

SQLMap: Testing implicit parameter URL

I'm pentesting a client's website but could not find a syntax to tell SQLMap that the variable it should test doesn't have an explicit name in the URL. I've already tried the MVC method that says to ...
9
votes
2answers
734 views

Cross site scripting when the greater than and less than signs are escaped?

If a website encodes < to &lt; and > becomes &gt;, is it still possible to perform cross site scripting? What would you enclose the script tags in? For example, on one of my sites I can ...
2
votes
1answer
106 views

Using INTO OUTFILE with INSERT

I have some free time so I'm testing various local vulnerable machines. In one particular lab machine, you first have to gain administration panel, and then use the available "insert" command and ...
2
votes
2answers
651 views

Preventing SQL Injections

So I'm pretty new to SQL so I'm not too familiar with how to prevent any SQL injections. I have 1 main form that's being used as a poll and it currently only has 1 text field. At the moment I think ...
1
vote
2answers
159 views

SQL Injection Issue Multi-line query

I am currently doing a SQL Injection attack against a website in school(that the tech created) sadly I can't point anyone to the site in question, the teacher has allowed us to gain knowledge as ...
1
vote
2answers
123 views

Breaking mysql username and password form [closed]

I have two versions of a website. The first one has no security precautions against sql injections. So if I try something like: Username: hello_world Password: ' or ' 1=1 I'll be signed in as the ...
-1
votes
1answer
71 views

Is there a way to bypass the inbuilt php functions for sqlinjection

If there is a way to bypass the built-in functions of PHP to protect against SQL injection or I should rely on some other filters rather than depending on built-in functions?
3
votes
1answer
117 views

Proving SQL Injection Vulnerability

I have recently come across what I believe to be a serious flaw in the security of a 3rd party computer program used within my company. Apologies for deliberately keeping details vague, but I hope you ...
0
votes
2answers
49 views

Which of these DBMS offers the lowest security for SQLI? [closed]

Which of these DBMS offers lowest security for SQLI? Oracle, MYSQL, SQL Server, ProstgreSQL or DB2? Why? Could you explain to me, why some are more vunerable to SQLI?
-1
votes
3answers
217 views

How to check for sql injection attack? [closed]

We do our final year project related to sql injection. For implementing sql injection attack which IDE or tool we used? bcoz netbeans and other type of IDE are more secured?
-1
votes
1answer
79 views

Blackbox testing for SQL injection

In my college, a security challenge event is going on for one whole month, Participants are expected to 'hack' into a website. The site has a login form, which accepts username and password and POSTs ...
1
vote
1answer
102 views

How to use mySQL UNION operator in sql injection, with injectable password paramiter?

Can someone give me an example of sql injection with UNION operator, that returns users and passwords, with regards to the bellow php example. I've managed to inject simple 1 or 1=1... in the pass ...
0
votes
2answers
211 views

How to perform SQL injection with real_escape_string filter in place?

can someone give me an example of mySQL injection payload, which will bypass the real_escape_string() sanitize filter in regards to the below php example. function sanitizeStrXSS51($var) { global ...
1
vote
3answers
112 views

How to organize a CTF?

In the context of an IT event, my team would organize a CTF (Capture The Flag). About the challenges (we’re working on them). I want to have some references on the types and levels of difficulty that ...
2
votes
1answer
167 views

Learning ethical SQL injection with php login form

I'm learning ethical hacking and now I'm on sql injection topic. I'm also new to SQL and php. Ok, so I have local damn vulnerable website with back-end Linux, MySQL and Apache and now trying to use ...
0
votes
2answers
60 views

SQLmap over uni wifi [closed]

I don't know if this is the right place to ask this question but I'll give it a shot! I was playing around with Kali and SQLmap. I was just scanning some sites nothing serious. When I was doing this I ...
0
votes
2answers
133 views

SQL injection at work [closed]

We have a web form that can be filled out with text fields and then they get emailed to us at work. Today we got some SQL commands it looks like in a bunch of emails. I just would like to have a bit ...
-1
votes
2answers
108 views

How to use ORM correctly to prevent SQL injection?

I read here that using ORM (like nHibernate) does not necessarily prevent SQL injection; for example, if you keep creating dynamic queries using your ORM framework you are still vulnerable. Fine, ...
0
votes
3answers
111 views

How to validate report given by a white hat hacker

I give a contract to find vulnerabilities in my site to a white hat hacker. According to him he performed several attacks on my site for 15 days and find that there is no any security threats. I am ...
1
vote
3answers
101 views

Is there an SQL injection equivalent on url-passed parameters to a servlet?

In SQL injection an attacker can craft a string that if left unchecked and executed it can complete and execute arbitrary SQL commands. Is there an equivalent to these kinds of attacks in JSP pages? ...
2
votes
1answer
110 views

Error-based SQL injection

I understand the conceptual idea behind error-based SQLi, but not the actual execution. In particular, I can't make sense of this expression: or 1 group by concat_ws(0x3a,version(),floor(rand(0)*2)) ...
5
votes
2answers
89 views

Is the separation of data from different applications via Oracle schemas considered secure?

I am evaluating the pros and cons of having different Oracle schemas vs. separate Oracle servers. Having a dedicated server for each application is really expensive and I only want to consider this if ...