SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database. Attackers take advantage of the fact that programmers often chain together SQL commands with user-provided parameters, and ...
2
votes
2answers
59 views
sanitizing input/output in php/codeigniter
I've been making some progress learning about web application security. Right now I'm trying to finalize my strategy for sanitizing input and output.
Background: Users can submit reviews to the site, ...
3
votes
1answer
57 views
Security web scanner tool for IIS/SQL Server
I'm trying to do penetration testing of our ASP.NET web-site to check for security loopholes (specifically for SQL injections). We bought a commercial web scanner tool (IBM Rational AppScan), however ...
1
vote
2answers
226 views
How do I test for SQL injection vulnerabilities on a site with input fields?
What methods are available for testing SQL injection vulnerabilities?
3
votes
3answers
114 views
Hibernate SQL Injection - Fortify 360
I am using Fortify 360 to analyze my code's security. Fortify has identified a Hibernate based delete method to perform a delete based on an object that has been passed in. My understanding of ...
2
votes
3answers
302 views
How does Facebook avoid crawling over their site?
I used Netsparker community edition and tried to find a vulnerability in my personal site. Then I thought let's try with Facebook. It didn't show a single webpage also because normally it shows ...
1
vote
3answers
142 views
Deploying vulnerable web application online
I am deploying a vulnerable web application for students (about 100) in a university, that they can test online and am collecting all the traffic for research purposes.
I am deploying this machine on ...
7
votes
2answers
270 views
Interpolique: transparently preventing SQL Injection and XSS with base64 encoding, what happened?
For the keynote at The Next HOPE a couple of years ago, Dan Kaminsky unveiled Interpolique (the talk is really fun btw). The problem he raised was how to defend against injection attacks, including ...
3
votes
2answers
45 views
Changing windows client form values at runtime
I am performing a code audit of an older VB6 application which uses dynamically constructed SQL to execute against the database. While I see this as a SQL injection point, the developer contends that ...
3
votes
2answers
268 views
Scanning DVWA with w3af - Unable to detect SQLi when security on low
I've been messing around with DVWA (Damn vulnerable web application) and w3af. I've been scanning DVWA with w3af, and have used the spiderMan proxy and http config to setup auth credentials to get ...
0
votes
2answers
111 views
How much security should I use for my web application?
My question is, for a "normal" site, what do you think is enough to secure against methods used by "script kiddies"? For example, SQL injection, XSS, and stuff like that.
Same question for password ...
4
votes
3answers
217 views
Best way to alert a website owner of a vulnerability?
recently i was browsing a site, and i noticed that at the end of the URL it said id=168, which is a common indicator that the site is vulnerable to an SQL injection attack. i did some tests and found ...
1
vote
0answers
169 views
How anonymous used UTF-16 ASCII to fool PHP escaping [closed]
Possible Duplicate:
How anonymous used UTF-16 ASCII to fool PHP escaping
(Reposted here as per request). A few months ago, anonymous took down a child pornography site using SQL-injection. ...
12
votes
5answers
797 views
How did anonymous use UTF-16 ASCII to fool PHP escaping?
A few months ago, anonymous took down a child pornography site using SQL-injection. I read in this article that anonymous claimed that "the server was using hardened PHP with escaping," but they were ...
3
votes
4answers
505 views
How is my website vulnerable for sql injections?
I am running a small website where I have published some articles.
I am also very interesed in security topics and tried sqlmap on my website. It found the database name, so my question is how it ...
3
votes
3answers
380 views
SQL Injection information
What is the meaning of SQLInjection. I am not able to understand the term.And which are the problems may occur to the system by sql injection ?
3
votes
4answers
250 views
SQL query sanitation (black list)
I have a following problem/challenge:
Web application (ASP.NET 3.5) installed on corporate LAN and operates on SQL Server DB needs to provide ability to generate custom reports.
These reports can be ...
2
votes
2answers
152 views
How can an IPS\IDS detect SQLi \ XSS (or other application layer) attacks?
I've been thinking about how an IPS works, and as far as I know it inspects the packets on the TCP\IP layer.
How can it detect attacks on higher levels without harming the user experience? How does ...
0
votes
3answers
319 views
How to exploit this SQL inection vulnerability?
I am learning SQL injection on a vulnerable Web App. I scanned it with w3af. It showed many vulnerabilities. One of them is :
SQL injection in a Microsoft SQL database was found at: ...
6
votes
2answers
119 views
Presentation on Web App Security (ACM Student Chapter)
I am a member of the local ACM student chapter in my university and as part of our activities I am scheduled to give a talk on current issues on Web Application Security (and possibly secure coding ...
10
votes
2answers
503 views
Multibyte character exploits - PHP/MySQL
Could someone please point me to a link with some information on multibyte character exploits for MySQL? A friend brought them to my attention, but I've not been able to find much information on the ...
6
votes
1answer
213 views
Do I have to make any more check if I use prepared statements for integers?
I am currently using PDO with prepared statements for some integer values (see PDO::PARAM_INT). That means I call PDO like this:
$stmt = $conn->prepare("SELECT `lastMove` FROM ".GAMES_TABLE.
...
9
votes
3answers
532 views
SQL injection with AND 1=1
Please explain the meaning of "AND 1 = 1" in a SQL injection attack. It's from an exercise in my university.
E.g.
select * from user where id = 'smith'' AND 1=1;-- and birthdate = 1970;
or
...
3
votes
2answers
423 views
Does mysql_escape_string have any security vulnerabilities if all tables using Latin1 encoding?
I have heard that the PHP function mysql_escape_string has security vulnerabilities related to mult-byte characters. Are there any vulnerabilities if all tables are using Latin1 encoding?
2
votes
4answers
483 views
Is replacing all apostrophes with two apostrophes sufficient to prevent SQL-injection on MSSQL?
I'm working in a web site that doesn't use parameters on SQL queries.
All the queries are adhoc and the way they are doing the input validation seems good to me, I'm not able to break it to do SQL ...
4
votes
2answers
174 views
Is it possible to test for Postgres BlindSQL injection using pg_sleep() in a WHERE clause?
In mysql, I am familiar with using the following payloads to test for blindsql when the WHERE clause is vulnerable (all payload examples from fuzzdb):
1 or sleep(TIME)#
" or sleep(TIME)#
' or ...
8
votes
4answers
572 views
Levraging a shell from SQL injection
As I understand it, SQL injection should only allow for the manipulation and retrivial of data, nothing more. Assuming no passwords are obtained, how can simple SQL injection be used to leverage a ...
5
votes
3answers
2k views
How to patch against RefRef's DOS attack
Overview
Anonomous claimed responsibility today for the Denial of Service attack against wikileaks. They are using a new software called RefRef. It seems to exploit Mysql using the server's ...
8
votes
2answers
260 views
What are the SQL-injections issues of parameterized queries?
I've written some code to generate an SQL query in ASP classic. I'm not sure if it's secure or not:
Set adoCon = Server.CreateObject("ADODB.Connection")
adoCon.Open "Provider=Microsoft.Jet.OLEDB.4.0; ...
1
vote
2answers
572 views
Testing clean urls with sqlmap
Is it possible to test for SQL injection vulnerabilities with using sqlmap with a url that is using mod rewrite (or something like it) to make the urls clean?
I know how to test my sites that have ...
2
votes
1answer
183 views
How to evade a signature to detect “xp_cmdshell” for SQLi?
What methods can be used to bypass a signature which detects "xp_cmdshell"?
5
votes
1answer
202 views
SQL Injection on URL, not on parameters
Should WAF or any protecting method, block SQLi done on URLs?(eg GET /test/url'or 1=1--)
4
votes
1answer
1k views
Testing SQL injection using sqlmap
I'm just started using sqlmap ( http://sqlmap.sourceforge.net ) to test for possible sql injection attacks.
I got a website which is vulnerable:
C:\Python27>python xxx\sqlmap\sqlmap.py -u ...
8
votes
3answers
390 views
Suggestion setting up a SQL injection honeypot
I just stumbled on a website vulnerable to an SQL injection attack by mistake ( http://stackoverflow.com/questions/6181248/is-this-site-vulnerable-to-an-sql-injection-attack ).
That made me curious ...
8
votes
5answers
502 views
SQL Injection in a Non-Web Application
Does someone know of a good example of a SQL Injection vulnerability that isn't in a web application? What is the user input for this attack? I am looking for a real vulnerability, not speculation. ...
33
votes
6answers
2k views
SQL injection — but why isn't escape quotes safe anymore?
I haven't seen this question asked, and feel it's a valuable bit of information to have, especially because this is a huge source of mystery and confusion.
Raw SQL
When you're writing SQL -- for ...
6
votes
4answers
868 views
xp_cmdshell: should it ever be used?
Can 'xp_cmdshell' ever be used safely within a stored proc and are there any situations for which there really is no other option? In other words, should it's useage within a stored proc always be ...
3
votes
2answers
268 views
I'm Trying to Find how to Exploit my SQL Code
I'm trying to find a way to exploit my stored procedure to test for security problems, I have specifically been testing for SQL truncation-based injection, but I did not succeed so far; I don't think ...
5
votes
2answers
487 views
Demonstrating SQL injection on the following
I've got lines in my php/mysql code which look like this:
...
$sqlquery = "SELECT price FROM products WHERE 1=1 AND id=".$_POST['id'];
...
... query is executed
...
echo $price;
As a ...
-1
votes
3answers
808 views
SQL injection for a username/password form?
This is how user validation happens on my site:
if(!empty($_POST['username']) && !empty($_POST['password']))
{
$query = "SELECT * FROM users WHERE username='".$_POST['username']."' ...
0
votes
1answer
213 views
Is this enough to tackle script / malicious code insertion in GET, POST requests?
I've got legacy PHP code which attempts to prevent script / SQL injection with the following:
if (!empty($_POST)) {
reset($_POST);
while (list($k,$v)=each($_POST)) {
...
12
votes
7answers
540 views
How would you exploit this vulnerability in order to cause max damage
I've found a whole lot of SQL injection exploits in some systems I maintain. I know how to prevent the injection, but I would like to demonstrate to my CEO and CTO how dangerous it is if we don't have ...
10
votes
7answers
537 views
SQL Injection Prevention
SQL Injection is always a hot topic particularly when it comes to web security.
In this regard I am interested in what are the steps that should always be taken to prevent SQL Injection within any web ...
13
votes
2answers
597 views
Does an ORM framework such as hibernate completely mitigate SQL injection?
I know that to prevent (prevent all or most?) SQL injection attacks that you should use parametrized queries. I've been using hibernate for a while instead of hand writing my sql statements. Are there ...
10
votes
4answers
586 views
Does stored procedure prevent SQL Injection in postgreSQL
Is it true that Stored procedure will prevent databases to be injected? I did a little research and I found out that SQL-Server, Oracle and MySQL are not safe against SQL injection if we only use ...
