SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database.

learn more… | top users | synonyms

0
votes
0answers
20 views

How netsparker extract SQL server version

We are using netsparker cloud version On last week when netsparker scan it detect SQL Injection Vulnerabilities. However I am surprised as the injection query throw error for casting and the scanner ...
2
votes
0answers
13 views

Find the source of a recurrent mass SQL edit on a server [migrated]

I'll try to explain my problem as clear as possible. The server of a company I support runs many websites. This server runs Windows Server 2012 with Microsoft SQL Server 2014. Almost all of the ...
0
votes
1answer
65 views

What does the below SQL injection indicate?

What is the meaning of this command in SQL ? php?que_id =-1/**/UNION/**/ ALL/**/SELECT What does /**/? indicate here?
-1
votes
1answer
43 views

why database show vulnerable column when i give a wrong parameter in query?

When we try for inject a website for find vulnerable column then sometimes we need to give a wrong value in the website parameter. Like www.vhul-web.com/index.php?id=1 union select 1,2,3 -- - Now ...
0
votes
0answers
13 views

Are sqlcmd parameters inherently at risk of SQL injection?

The command line utility sqlcmd has a feature to allow parameter substitution, from command line parameters and environment variables. https://msdn.microsoft.com/en-us/library/ms188714.aspx If an ...
4
votes
1answer
50 views

xp_cmdshell to add domain admin

Did an assessment on SQL injection the other day and the only question I didn't do was to add an domain admin. Got access to xp_cmdshell. Tried net user username password /ADD /DOMAIN but permission ...
0
votes
1answer
57 views

Exploit SQL injection in OWASP ZAP

I have done a normal scan (not fuzzing) of a website using ZAP in attack mode, and it gives me several possible injections. My question is if there is any way to try to exploit these within ZAP, ...
0
votes
1answer
26 views

How do I exploit with vunerability in special format with sqlmap?

I used ZAP proxy to determine that login was injectable with GET request as login" AND "1"="1 was injectable, but it returned the url to me in this format: ...
0
votes
1answer
34 views

How too use R0b0tPirates 500 error bypass

I had a valid injection, but could not exploit it due to 500 errors, so I looked around and found that R0b0t Pirates, a blog that specializes in tools like sqlmap, has put out a 500 error bypass, ...
1
vote
2answers
81 views

PHP security hacking question, may be more than just PHP

I have an input box for for INSERTing into the database. It is written in PHP PDO. Some one typed in: <"'> and also: ' onClick='alert(1); I'm assuming they were in two different input ...
8
votes
2answers
102 views

Response to unauthorized scan by legit company? [closed]

On Christmas day, our web service came under an apparent attack and we responded by blocking the (single) source IP. Upon later investigation, it turns out the 'attack' was actually an intense ...
0
votes
0answers
37 views

Is my code hackable or secure enough? [migrated]

I wonder if my app is injectable in the front end form, URL or in any other way. Frontend: <form id="form1" runat="server"> <asp:HyperLink ID="HyperLinkBack" runat="server" ...
3
votes
2answers
34 views

Presence of table “sqlmapoutput” in PostgreSQL database

I was pentesting a client's database and saw this one table "sqlmapoutput" in one of the user created schemas. It's a PostgreSQL DBMS. and he has no idea how it came there. There was no data in the ...
3
votes
0answers
339 views

SQL security - ACID transactions and locking to prevent financial fraud (timing attack?) [closed]

I am trying to prevent something similar to this from happening: http://hackingdistributed.com/2014/04/06/another-one-bites-the-dust-flexcoin/ Basically the financial exchange was using non-ACID ...
3
votes
1answer
161 views

SQL Injection - login bypass [closed]

Background information: SQL Injection as a school task. Login bypass. Given two input fields name and password. Confirm via solve button. Info on what I have and was able to find out: it is ...
1
vote
1answer
57 views

Can SQL test by using SqlMap tool harm a website?

I am just learning about SQL injection attack, and I want to test this by using sqlmap on my own website.However I wonder if the attack can cause any harm on my website's services during the attack? ...
5
votes
1answer
80 views

sqlmap HTTP 405 error on a vulnerable POST parameter

For academical purposes I need to explode a blind sql injection on a form paramater which is sent using the POST method. The form is very simple, it just has an input text box where to introduce the ...
16
votes
3answers
2k views

How to defeat doubling up apostrophes to create SQLi attack?

I know some developers double up apostrophes to mitigate SQLi. (This is when the input is ' so it becomes '') Is there a way to beat this? This is on MS SQl Server.
3
votes
0answers
61 views

Plugin for integrating SQLMAP and BURP SUITE

I am trying to do SQL Injection using the SQLMAP Burp Plugin which I downloaded from http://code.google.com/p/gason/downloads/list. I have followed the steps for windows provided in ...
2
votes
0answers
61 views

Bypass an escape function - SQL injection (Educational Purpose) [duplicate]

I am trying to simulate an SQL injection on a VM Apache server. The query I send is being converted into the part of a parameter's value i.e an escape function is restricting me. For example if I ...
1
vote
2answers
76 views

Blind SQL injection: Can you execute a hex string as part of the query?

Sorry in advance if this is a noobish question, but I can't seem to find the right phrasing to get the answer on google or here--I'm pretty new to SQL and am working on a SQLi challenge that is a ...
1
vote
0answers
35 views

How to tell sqlmap to resume an exploit from results-*.csv file?

How to notify SQLMap to resume an exploit from results-*.csv file? Example: ~/.sqlmap/output/results-xxxxxxxxxx.csv Target URL,Place,Parameter,Techniques ...
-1
votes
1answer
38 views

Is this PHP script secure? [closed]

I'm trying to create a secure website. Can someone let me know if this is susceptible to SQL injection? If it is, could you provide me with an exmaple of a statement that would work for injection? ...
2
votes
1answer
95 views

sql injection: single quote vs double quote

Can someone explain me why this code: $sql='select * from admin where user_name="$user" and password="$pass" ' ; $re = mysql_query($sql); is not vulnerable (payload: "or 1=1-- ) while this ...
-4
votes
1answer
86 views

SQLi : Can I extract a mysql data without knowing column's name?

Here's the vulnerability code: <?php $filtered = "/information|schema|_/i"; #... blahblah $query = "SELECT * FROM user WHERE id='$id' AND pw='$pw';"; // exist hidden column ...
2
votes
1answer
50 views

SOP for SQL Injection Attack

What should (or) how an Incident Handler do (or) follow when an SQL injection attack is reported? Initial Response Analysis Action Aiming to make a procedure guide to follow for myself and my ...
3
votes
1answer
271 views

Google crawling and SQL injection

recently my logs shows attack signatures from ...
2
votes
2answers
97 views

Is it possible to do anything against a website with SQL injection that returns 400?

So today at my job I notified a senior programmer that I found an SQL injection at our website. However, when I make an SQL injection, the page just returns 400, so I can't really see any errors or ...
2
votes
2answers
226 views

SQLMap: How to dump tables that begin with a specific letter?

I would like to know the command of SQLMap, which permits me to retreive just tables that begin with a special letter. Example with letter "T": sqlmap.py -u www.website -D database -T tables (...)
4
votes
1answer
112 views

Database table name prefixes and security by obscurity

One of the most common pieces of advice with respect to securing WordPress, Magento, and other widely-used pieces of software is to add a prefix to database table names or change the default prefix. ...
1
vote
0answers
62 views

Double Query injection

I'm trying to learn about "Double Query Injections", but in the tutorials they write following the command but without any explanation: (select * from (select count(*), concat(0x3a,0x3a,(select ...
1
vote
1answer
104 views

Why does error-based SQL injection works only with certan fields?

I'm currently investigating the latest vulnerability affecting Joomla CMS. You can find here a description of the vulnerability, however my question is merely on error-based SQL injections and is ...
5
votes
1answer
156 views

SQLmap injection not working, manually it works fine

I have built a vulnerable web application to demonstrate SQL injection. I want to show both manual injection and automated injection. The injection requires a) the user to be logged in (session ...
5
votes
2answers
147 views

SQL Injection query error with backslash

I have a sql injection vulnerable site which works well if i input query like this qq' -- // or qq' -- ; . But when i inject without slash or semi-colon it throws following error "You have an error in ...
3
votes
1answer
190 views

SQLMAP and DBMS credentials, how do you use them?

for educational purposes and in order to develop a test for students, i try to "hack" a website developped by a friend : http://www.websitetohack.com.index.php?id=5 When i launch SQLMAP, it finds a ...
1
vote
1answer
213 views

How we can Update table via sqlmap?

How we can update a table via sqlmap ? The injection is like this : mysite.com/?menu=-8' UNION ALL SELECT ...
0
votes
1answer
60 views

SQL Injection via table name?

Is it possible to perform SQL injection on a query where the name of the table is passed in as an argument? The user doesn't enter the table name themselves, but it can be inferred through element ...
1
vote
2answers
97 views

Injection/SQL Injection Attacks in Layman Terms

I'm having trouble figuring out what SQL injection attacks are, or in more general terms, what injection attacks are. Most explanations out there on the internets are kinda hard to understand. Could ...
2
votes
0answers
86 views

Is MySQL CONCAT with PDO enough to protect LIKEs from SQL injection?

I'm developing a user-facing, public-accessible website where the user can input an arbitrary, hostile search term. After that, the app must do something conceptually like this against a MySQL db ...
3
votes
1answer
78 views

PL/SQL injection and data exfil

During a pen test I stumbled upon the following error while fuzzing a few parameters: *HTTP Status 500 - org.springframework.jdbc.BadSqlGrammarException: PreparedStatementCallback; bad SQL grammar ...
0
votes
1answer
46 views

Why does the SQL Injection technique INTO OUTFILE sometimes not work? [closed]

Why does the SQL Injection technique INTO OUTFILE sometimes not work? http://example.com/file.php?id=1 union select 1,"<?php system($_REQUEST['cmd'])?>",3,4 INTO OUTFILE " ...
-1
votes
2answers
153 views

Is SQL injection still possible after filtering?

I am just reviewing a script I want to use for my website. The author filters all user entered data ($_POST and $_GET) with this function: function XSSCheck($value) { return preg_replace( ...
0
votes
0answers
90 views

Insert Command in SQLMap causes Error

I have tried testing SQL injection using SQLMap using the below query sqlmap -u http://localhost/abc.php?id=1 -D datab --sql-shell When i drop into the SQL shell the following command select * from ...
1
vote
1answer
214 views

SQLMAP : Unable to dump any data

I am working on a black box web application pentesting project for a client and while testing found an error-based SQL injection. I went on to exploit it using SQLMAP, I retrieved the Database names, ...
0
votes
0answers
33 views

How to protect against SQL Injection in Jaggeryjs?

I am working with Jaggeryjs now which is a server side JavaScript like Nodejs. When I tried the example mentioned in the documentation, They have provided simple example just like Statement in Java. ...
-1
votes
1answer
207 views

Does the 'Relational' Foundation of Database Theory enable 'Ashley Madison'-like attacks?

Again and again hackers use SQL injection to get information from the backend database. Is it fair to say because a relational database by its nature has all the links within the data sets (e.g., ...
0
votes
1answer
54 views

Examples of in-band signalling hacks? [closed]

In-band signalling or the mixing of control and metadata on the same channel is what allowed the early phone phreakers to obtain free calls on telecommunications systems. By sending control tones ...
-3
votes
1answer
154 views

{PHP} SQL Injection [duplicate]

Please note: this isn't a duplicate!!! Why? You can use ' but You don't know how :) I have this PHP code: <?php (...) function escape($str) { $ret = ''; for($i=0;@$str[$i];$i++) { ...
43
votes
2answers
7k views

Is this an attempted SQL injection?

Looking through error logs I found lots of requests to a web-app where the URL contains: ...
0
votes
1answer
255 views

Oracle Sql Injection Reverse Shell [closed]

I am testing for SQL Injection on a website that uses ASP code. I can successfully get all the databases and tables. Current user has DBA privileges. I wonder how can I get a reverse shell by using ...