SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database.

learn more… | top users | synonyms

2
votes
0answers
53 views

What tools on unix can scan sql dumps for malware? [closed]

I'm attempting to check for malware, spam and any kind of injection/exploitation on a sql dump that has been provided and was wondering what kind of tools are there already in place to help with this? ...
1
vote
1answer
119 views

SQL truncation vulnerability

I came to know the SQL truncation vulnerability that I wasn't aware of. It is my understanding that this vulnerability is based on the fact that MySQL truncates the value of an "insert query" whether ...
2
votes
1answer
121 views

Understanding Boolean Based SQL Injection

I am trying to understand the concept of Boolean Based Blind SQL Injection. I have gone through OWASP Guide To SQLi to understand it. However I am confused with how exactly does it work. Below id ...
0
votes
1answer
129 views

SQL injection is possible but selected queries not working

I'm black-box testing an application which uses java spring framework and MySQL in the back-end. When I insert a single quote (') in a text box field, the server returns a HTTP status code 500 ...
0
votes
0answers
49 views

Which enterprise-class DBMS allow forbiddance of (No)SQL comments?

This question could be renamed "Would forbidding SQL comments inside transactions prevent some SQL injections?", but I'd like to know if some DBMS allow this first. The goal is to reduce the attack ...
0
votes
1answer
49 views

Where do I put the request data?

Now, I understand this might not be the right place to post about Acunetix but I'm searching my site for any exploits and a couple of SQL Injection exploits have shown up on a /Profile page, how would ...
4
votes
2answers
91 views

SQL abstraction layer : A preventive mechanism for SQLi?

While performing a pentest for a Java based application I came across an SQL (actually HQL) error by simply putting a single quote in one of the request parameters and breaking the syntax of the ...
0
votes
3answers
85 views

What is blind injection and how to simulate the issue?

What is blind SQL injection, and how does it differ from normal SQL injection? How can I simulate an issue of blind injection?
0
votes
1answer
135 views

Why is it a bad idea to escape HTML before escaping SQL? [duplicate]

From the security perspective (and not usability as it's discussed here http://stackoverflow.com/questions/3648430/is-it-a-bad-idea-to-escape-html-before-inserting-into-a-database-instead-of-upon), ...
0
votes
1answer
48 views

Attacks to jump from SQL server to Web server, without direct network access?

Considering that I have a structure like the following, allowing only the TCP and UDP ports for SQL to be accessed. Specifically no traffic initiated from SQL is allowed to reach SECURE. SECURE-> ...
7
votes
3answers
700 views

What would the potential abuses be for an HTTP API that accepted raw SQL?

I was wondering what some of the potential abuses could be for an HTTP API that accepted SQL queries and output results sets. The fact that this is the canonical definition of SQL injection is not ...
0
votes
2answers
75 views

Leading injection

Are there known exploits where a query of the form: select foo from bar where id = 6 can be turned into: select * from select foo from bar where id = random stuff It's clear that a badly formed ...
0
votes
2answers
71 views

how to null out a insert statement?

I am doing a SQLi-Quiz. Below is the orignal statement. insert into users(name,pass) values('bob', [injection point here]) The statement is heavily filterd because the website which supplys the ...
15
votes
3answers
744 views

Protecting Health Care Database

I am doing a minor project on information security in which i am implementing techniques listed below to protect a HEALTH CARE database. Preventing SQL Injection (using prepared ...
0
votes
1answer
106 views

Some queries regarding SQL injection

[I'm not really sure if I should be posting this on SO or here. I think my questions might be answered if I have had a good experience with MySQL. But, I don't. So probably, most of you will ...
4
votes
2answers
138 views

2000 Sets of Personal Information

So the story goes like this.. I recently rediscovered an old website i used to go on quite often but i couldn't remember my login. The site is poorly made and hasn't been updated in about 5 years, so ...
0
votes
1answer
72 views

How to use a Blind SQL-i keyword?

After scanning my website with uniscan I found a few vulnerabilities. I found this answer here and tried but it does not return anything except what it should return. Blind SQL Injection: [+] Vul ...
1
vote
2answers
65 views

Assigning cPanel MySQL Privileges

When I log into cPanel, I go to create a new MySQL Database with the wizard. Usually, it is recommended to assign the database user with all of the permissions from Insert, Update, Alter, Execute, ...
1
vote
2answers
147 views

Understanding the order by clause used in SQL Injections

I am trying to enumerate a database, created specifically for the purpose of learning SQL injections. I am trying to discover the number of columns a particular select statement might be using. I do ...
3
votes
1answer
104 views

How easy is it to make a malicious bank/identity card?

I recently got a magnetic card reader that plugs into my computer because I was bored. I decided to scan my ID and bank card through it and I was surprised to see my ID number/bank card number show up ...
2
votes
2answers
168 views

SQL injection: real escape string function

example4.php?id=id=2-1 I came across the above injection and I can not figure out why(how) does this work and what's interesting is it returns all the records from the database. Anything guys? ...
0
votes
1answer
73 views

Sql Injection and no priviliges to write files [closed]

I have a sql injection in my site and im using sqlmap but when i try --os-shell it says cannot write file due to permissions . now is it impossible to write a file to the server?
1
vote
2answers
204 views

Sql injection is not working on my site?

I have set up a page and database so I can practice SQL injection. Ive tried some examples and it doesn't seem to work. It seems to add the username and password to that database, even though I input ...
-4
votes
3answers
1k views

How do I hack this login page by using SQL injection? [closed]

I'm testing a client's web site vulnerability to SQL injection, which appears to be the case. The web site is hosted in IIS on a Windows server and is using Microsoft's .NET framework with SQL. I'm ...
2
votes
1answer
75 views

Unsafe sanitization? Is this code SQLi vulnerable?

Function RemoveSuspeitos(ByVal strTXT) Dim txtAux As String txtAux = strTXT txtAux = Replace(txtAux, chr(34), "") txtAux = Replace(txtAux, ...
4
votes
1answer
126 views

VB.NET stored procedure implementation?

While reviewing code for a vb.net application I have come across the following implementation of stored procedures using ExecuteDataSet Result = DBInstance.ExecuteDataSet(Name, ...
0
votes
2answers
153 views

SQL Injection and JavaScript Regex Bypass

me for learning SQLI. But I got stuck at this one regex which seems to be unbreakable : document.loginForm.username.value = document.loginForm.username.value.replace(/[^a-zA-Z0-9]/g, ""); If someone ...
1
vote
1answer
136 views

Why isn't it possible to do SQL injection (HIGH Level) in this example in Damn Vulnerable Web App?

$query = " $sql = select * from users where id = '$id' " Won't $id=3' OR '1'='1 break the query ? The doubt arose because someone claimed it can't be broken.
3
votes
0answers
18 views

SQL Injection via Unicode [duplicate]

My team currently uses ASP.NET with MS SQL Server for our software. Security has only become important since I started, in which there is injection vulnerabilities everywhere. Due to current ...
0
votes
4answers
463 views

SQL Injection via Unicode

My team currently uses ASP.NET with MS SQL Server for our software. Security has only become important since I started, in which there is injection vulnerabilities everywhere. Due to current ...
0
votes
2answers
151 views

Is sqlmap traceable?

Is sqlmap still traceable when we use --tor --user-agent and macchanger? For example: sqlmap -u "[vulnerable_website_link]" --tor --user-agent="Mozilla/5.0 (compatible; Googlebot/2.1; ...
2
votes
1answer
2k views

SqlMap bypasses OWASP ModSecurity Core Rule Set for SQL Injection

I am trying to perform a simple penetration test on the DVWA (the web application that has been specifically designed to be vulnerable to some of the most common web application attacks). I want to ...
1
vote
0answers
87 views

Hacking attempts:in.js

A client of mine keeps getting hacked by seemingly SQL injection where a script tag containing a link to an "in.js" file is added. Sometimes from a domain called sportserve.co.uk, other times from ...
0
votes
2answers
228 views

What kind of attack is this?

This past week, my traffic logs are showing many hits (usually with repeated tries) for a URL from perhaps 30+ different IP addresses all over the world. This is not a URL that should garner more than ...
0
votes
3answers
268 views

String sql injection vs sql injection

What's the difference between normal sql injection and string based sql injection? An example would be appreciated. As far as I understand from the few readings around the net, string based sql ...
1
vote
1answer
228 views

Recognize site vulnerable for SQL injection

Although I understand the concept of a SQL injection and have done simple exploits (simple hack challenge sites and stuff) I'm wondering if one of the site run by my employer is vulnerable. Unlike ...
0
votes
2answers
629 views

sqlmap: testing javascript or json parameters

I have a parameter in a POST request which is in the following format: ParamName= < r username="123" password="456" x="" y=""/> and I want to test username and password which are two HTML ...
1
vote
0answers
144 views

MSSQL injection convert syntax error

I just setup a test bed and i disabled information_schema from being accessed (a weak waf) and i've been trying to extract the table list from the database by using convert to spit out a conversion ...
0
votes
1answer
87 views

MSSQL injection help [closed]

If information_schema is not allowed in MSSQL , what is another method i can use to list the tables inside a database and ultimately the columns so i can dump them without using information_schema? ...
-1
votes
1answer
75 views

True/false statements in MSSQL without < > and = [closed]

How can i make a true/false statements in MSSQL without the following symbols: <,>,= ? Everything i can think of, e.g: or 1=1-- (true) or 1>1 (false) and 2<>3 (true) Makes use of ...
7
votes
2answers
276 views

How can this input-sanitizer function be defeated?

There's a Classic ASP application at my job that is (I believe) highly vulnerable to SQL injection. I want to prove to management that this code isn't secure, but all I'm able to do is insert "SQLINJ" ...
0
votes
1answer
147 views

Is ASP.net More Secure than PHP in GENERAL? [closed]

In other words, my (long version) question is: Are developers able to get away with, more using ASP.net than PHP in terms of writing secure code for their apps? I ask this because ASP.net has many ...
3
votes
0answers
135 views

Weird condition in blind SQL injection point, substr() is valid for exactly two chars

I'm exploiting a blind SQL injection point, which takes a variable as username then check if the username exists in a table. (It's running MySQL 5.X with PHP) So I'm using this to retrieve all ...
0
votes
2answers
109 views

Any residual effects after SQLMAP has been run?

Some time ago, penetration testing was done on our website, and one of the tools used was SQLMap It was executed by a security consultancy, but unfortunately they did not notify us beforehand. So, ...
1
vote
1answer
68 views

Base Programming for vulnerabilities

Hello, I am a beginner looking for some information. My question is the following: In order to understand certain security concepts is it essential that I understand the underlying languages? For ...
2
votes
2answers
120 views

Is sqlmap tracable?

The question is simple. For example, we access a database of any website. And looked up for datas. So, is the website owner can see me? If he/she can see, how can i protect? [These are for security ...
0
votes
1answer
57 views

How can we get the second id for sqlmap [closed]

I'm trying to find some vulnerable points in my website. My website like, www.example.com/index.php?menu_id=1002&news_id=5. When i trying to find these points with sql map, it tries for menu id. ...
0
votes
1answer
88 views

Sql Injection - Possible exploitations on a real case [duplicate]

This is a snippet of a PHP script: $useragent = isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : NULL; $query = "SELECT `id` FROM `browser` WHERE name = '".$useragent."' LIMIT ...
1
vote
1answer
67 views

Am I right by changing the default algorithm on a web app?

Numerous clients have told me that my suggestion on changing the algorithm on a web app does not increase security. I've tried reasoning that if the files have not been exposed, the attacker has to ...
-3
votes
1answer
613 views

Wordpress - cleartext admin credentials disclosure

I am testing my own wordpress blog against security issues with wpscan. Honestly I have never done that before and was shocked after I saw the result. One vulnerability of my wordpress site is: [+] ...