SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database.

learn more… | top users | synonyms

-4
votes
0answers
22 views

SQL Injection errors & FILE permission issues

First, does this error also entail SQL Injection? Warning: mysql_num_rows() expects parameter 1 to be resource, boolean given in /home/localhost/public_html/admin/login_check.php on line 12 If so, ...
0
votes
0answers
25 views

How to protect against SQL Injection in Jaggeryjs?

I am working with Jaggeryjs now which is a server side JavaScript like Nodejs. When I tried the example mentioned in the documentation, They have provided simple example just like Statement in Java. ...
-1
votes
1answer
168 views

Does the 'Relational' Foundation of Database Theory enable 'Ashley Madison'-like attacks?

Again and again hackers use SQL injection to get information from the backend database. Is it fair to say because a relational database by its nature has all the links within the data sets (e.g., ...
0
votes
1answer
31 views

Examples of in-band signalling hacks? [closed]

In-band signalling or the mixing of control and metadata on the same channel is what allowed the early phone phreakers to obtain free calls on telecommunications systems. By sending control tones ...
-3
votes
1answer
126 views

{PHP} SQL Injection [duplicate]

Please note: this isn't a duplicate!!! Why? You can use ' but You don't know how :) I have this PHP code: <?php (...) function escape($str) { $ret = ''; for($i=0;@$str[$i];$i++) { ...
43
votes
2answers
7k views

Is this an attempted SQL injection?

Looking through error logs I found lots of requests to a web-app where the URL contains: ...
0
votes
1answer
69 views

Oracle Sql Injection Reverse Shell [closed]

I am testing for SQL Injection on a website that uses ASP code. I can successfully get all the databases and tables. Current user has DBA privileges. I wonder how can I get a reverse shell by using ...
1
vote
1answer
63 views

SQL Injection from Data Import Files

We process a lot of batch files and do an initial batch file import via the LOAD DATA LOCAL INFILE call in MySQL. Is there a tool / standard out there that can scan or help to mitigate SQL injection ...
0
votes
1answer
102 views

How to Perform SQL insert or update command using SQL injection

I have a URL http://localhost/usernfo.php?id=8 on which SQL injection can be performed. How can I perform an Update, Insert or Delete command from this link after I have got the structure of the ...
0
votes
1answer
79 views

Securing SQL injection for my PHP files [closed]

I have made a PHP forum. I used PDO, as well as SQLi. When I did a security scan of my website, it found errors, and after a long time of trying different stuff, I can't fix them. Points to whomever ...
1
vote
1answer
245 views

Why does SQL not escape/sanitize by default?

First, since there is no SQL stackexchange I am not sure where the best place to ask this question is (I debated between here and programmers.stackexchange). If this is the wrong place, please move ...
1
vote
2answers
44 views

how should I protect url parameter in JPQL query for reset password flow

I am implementing a web app with reset password flow. Here is what I've done to try to make it secure. Put in the email address in forgotten password form. Regardless of whether the customer exists, ...
2
votes
0answers
53 views

Obtaining large data sets for research: MySQL, PHP, Apache, etc

I have been looking around the web for large data sets (specifically web related log files - MySQL, PHP, Apache, and so on) that contains data of attempted intrusions/exploits. I am doing some ...
2
votes
3answers
91 views

SQL Injection - Find SQL platform

Is there any query that I can use to know which SQL platform a website is using ? ( Oracle - MySQL - MSSQL - PostgreSQL - Ingres.... )
4
votes
0answers
90 views

Sqlmap trimming output

I've decided to learn Sql/map but having an issue with Sqlmap trimming some of my output, the hash. The hash is about to be 32 characters long but I'm only getting 25 and the warning: [WARNING] ...
-2
votes
2answers
49 views

Exploiting SQL injection union base [closed]

A PHP website ends with php?id=1 and when I place a tic it prints this error: Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in ...
1
vote
0answers
15 views

Help with Error-Based SQL Injection [duplicate]

Like the guy in this thread : Error-based SQL injection I understand the idea behing SQL Error-Based Injection but not how it works on the MySQL server. or 1 group by ...
1
vote
2answers
86 views

What are the dangers of sql injection with php?

I made an SQL-injectable web-app build to with PHP to get a better understanding of what is going on and automated it all with sqlmap. The relevant code is the following: mysqli_query($conn, SELECT ...
0
votes
3answers
55 views

Should I be worried about SQL Injection for Internal Web Apps?

I've been working a lot lately with writing report generating forms at work. The reports sometimes require input provided by a drop-down list and sometimes require data to be entered by key. My ...
1
vote
2answers
196 views

can anybody explain error based sql injection attacks

I practice about error based sql injection but there isn't any good reference for it .. for example :) : mysql> select count(*),floor(rand()*2) as a from users group by a; ERROR 1062 (23000): ...
0
votes
0answers
27 views

How does a SQL injection working how to stop it [duplicate]

Recently I have been doing hackthissite.org and you have to use SQL injections quite a bit. I understand how to do them, but not how they work. I was wondering if anyone knew what the internal error ...
-1
votes
1answer
50 views

Is it possible to perform second order SQL injection with email addresses?

Let's imagine a website which allows users to Sign up and login only with their email address. Is it possible to perform a second order SQL injection in that case?
0
votes
1answer
77 views

SQL injection with a URL separated with dashes

I have have used sqlmap for a long time now. I have come across a this url pattern. http://www.example.com/parameter-somethingid01-anotherthingid023 Where parameter is expendable meaning it doesn't ...
1
vote
4answers
257 views

Why is a password accompanied by a username deemed 'safer'?

While browsing this community I notice that some people say that the main advantage of usernames accompanied by passwords is as they take more tries to be brute forced, however I don't think that is ...
0
votes
2answers
82 views

SQL Injection Attack - Permissions Defenses

SQL injection attacks work by the attacker putting valid SQL into the text that goes back from the page to the server; something like "Delete * from tblAccounts where 1=1" What I cannot understand is ...
0
votes
2answers
331 views

What makes an Android application vulnerable to SQL Injection?

Definition of SQL Injection SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution ...
0
votes
0answers
41 views

How to allow INFORMATION_SCHEMA.TABLES to pass through in the query?

I'm practicing SQL injection on a test bed where 'OR' and 'AND' keywords are blacklisted. So on using Logical operators such as || and &&, I'm able to proceed however when trying the query ...
1
vote
2answers
256 views

Security issues on allowing Special characters in input field

I am building a web application, in which I am required to let user enter any character(even special characters - ~!@#$%^&*()_-+=|\{}[];:'"<,.>) in an input field. To mitigate the problems ...
1
vote
1answer
60 views

How does union select statement output vulnerable columns

How does union select statement output vulnerable columns in sql injection Consider a SQL vulnerable site. Let the number of columns in the query be 3. So the statement goes, ...
0
votes
0answers
40 views

Should I add signatures to the Netscaler Application Firewall for Exchange, Cognos, etc?

This link describes that I can use Cenzic, IBM AppScan, Qualsys, Trend Micro and Whitehat files to create an application filter for various products. I'm looking for filters that apply to commonly ...
5
votes
1answer
167 views

SQL Injection explain this query

' 1=1 GROUP BY CONCAT_WS ('~',version(), FLOOR(rand(0)*2)) having min(0) 1>> My first question is what is CONCAT function is being used for in this query 2>> And Why do we use having min(0) in ...
3
votes
1answer
63 views

SQLMap on a seqential form

There is a certain form that gets posted over POST. The form has some form elements. I am doing a pen-test on the application that has this form. The form values are being stored in a certain ...
2
votes
1answer
45 views

Is it a security concern if MySQL manipulates parameter types?

This is a follow up to a question I posted on Stack Overflow but you don't need to read that question - I'm recapping the pertinent details here. I'm testing a PHP application which uses a MySQL ...
0
votes
1answer
88 views

sqlmap cannot find a dispatched vulnerability

I have a known sqli vulnerability that I'd like to try out with sqlmap in a web application; however, I don't believe sqlmap is able to figure this one out. Here's how the system works: Inject on a ...
1
vote
0answers
112 views

How to identify column types during sql injection with “union all select” construct?

Situation is following: I have identified sql injection attack vector, and have following information about target table: It has six columns. (Identified using "order by"). I can see output of 3 of ...
0
votes
1answer
128 views

Is it possible to bypass HTML character reference encoding to inject SQL in this context?

I was poking around with the "reset password" page of a website (security testing and bug hunting is allowed on it.) When you put in your email address, it uses HTML character reference encoding to ...
0
votes
1answer
451 views

How sqlmap works to get all database info

I am curious how sqlmap able to get all the info from the database? I am using burp as proxy to view all the request and response. From the response I couldn't see any information related to the ...
9
votes
9answers
2k views

Is testing for SQL injection vulnerabilities still relevant in modern web applications?

First some background: I'm an Infrastructural Engineer with 5 years of experience mainly in Virtualization and Networking. I've spent the past year doing a lot of self study about security, passed ...
43
votes
4answers
6k views

Does read-only access to the database prevent sql injection?

I have a web api that connects to my SQL Server using a read-only connection and want to allow tech savvy users of my api to enter an SQL where clause on the querystring. I basically just want to tack ...
-5
votes
1answer
261 views

How to make my PHP website vulnerable to SQL injection [duplicate]

For training purposes, I want to make a demo website vulnerable to SQL injection. I went to the .htaccess file in the server and added these 2 lines: php_flag magic_quotes_gpc Off php_flag ...
1
vote
1answer
67 views

how to separate arguments in sql query [closed]

I have this query : 'UNION ALL SELECT group_concat(username,password) from users-- and I want to separate username and password because when I execute the code it prints it all in one long string. ...
-1
votes
1answer
186 views

Cookie based sqli [closed]

I have identified a website vulnerable to sql injection via a authentication token. Does anyone know where I can find a tutorial / example of cookie based sql injection?
0
votes
2answers
116 views

“&” character in url [duplicate]

I think I found a bug in my website but don't know how dangerous it is. My website will redirect you to a warning page whenever you click on a link that is pasted in the comments section. The url ...
1
vote
0answers
38 views

Why the column fields doesn't show up on injection of column names?

I'm practicing SQL injection. I've been able to get the column names and table names on a test environment. query 1. On executing below query, I see adminId, adminUsername, adminPassword ...
0
votes
1answer
61 views

Injecting a query within a query that has an order by or group by function [closed]

Select * from Shop where Item = $item order by ProductNum desc I found this vulnerability within a website. To test if there's any vulnerabilities I inserted a single quotation after ...
0
votes
0answers
124 views

sqlmap cannot find injection vulnerability

I create a page called register.php which will take 4 parameters user, pass, email, comments. And the pass is vulnerable to sql injeciton. I have tested the vulnerability manually by filling test', ...
2
votes
2answers
191 views

After trying successful SQL injection why the result isn't getting displayed on the webpage?

Below is the PHP code I wrote that allows SQL injection with one parameter ie 'id' in this case. On trying SQL injection via putting this 2' ORDER BY 1;--' in the parameter (id field ), I get ...
0
votes
2answers
172 views

SQL Injection in a Web Service URL as a Parameter Value [closed]

Obviously SQL Injection via the payload of a message is a very common practice and therefore it is always key to cover this (I already have in my code). However I'm just wondering about how possible ...
0
votes
2answers
111 views

Would Insecure Direct References and SQL Injection be solved by using Row-Level Security and Per-User Connection Strings?

Regarding the following OWASP Vulnerabilities: Insecure Direct Object References By that I mean letting someone see /account/123/not-theirs (this could be the wrong reference I'm using above). SQL ...
3
votes
1answer
80 views

Can we join a table in this Ruby on Rails Direct Object Reference?

I am trying to inject a RoR application... I have found a nice command which will allow me to delete things unchecked...but the problem is that its not a problem its a very minor point, to make it a ...