SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database.
2
votes
3answers
265 views
Why are triggers not often used to secure a database?
I did an intern for a company becoming PCI compliant and instead of using triggers to prevent SQL injection, I went through 1000s (if not more) lines of web-app code and called functions every time ...
0
votes
3answers
224 views
SQL — using string concatenation, how can I exploit this procedure?
I have a simple SP
create procedure [dbo].[test]
@str varchar (100)
AS
BEGIN
select * from [AdventureWorks2012].[HumanResources].[Employee] where JobTitle like '%' + @str +'%'
END
GO
Given this ...
0
votes
1answer
99 views
Comparison between Data Encryption Tools and Data Sanitization Tools [closed]
What are the famous Data Sanitization Tools for languages such as ASP/PHP/Html Web Sites?
Which Data Sanitization tools have the best results?
Difference between Data encryption and Data ...
4
votes
3answers
336 views
Create a page to experiment with SQL injection [closed]
This semester, I have taken a course on Information Security and my project for this course is to implement an SQL injection to obtain admin privileges. For this I first download Havij software ...
3
votes
3answers
230 views
Is this a web attack I should be concerned about - trying to enter code for form vars
I have a created a simple CGI script running on a web server where a user can login using a username and password. The username and password are entered via a html form and the form POST's the data ...
5
votes
2answers
714 views
What type of attacks can be used vs MongoDB?
I'm starting to learn MongoDB and was curious if it was susceptible to some type of injection attack similar to SQLi. Due to the nature of the DB, I don't think you can inject into it but... What ...
3
votes
2answers
153 views
Are there special attack vectors for statistical databases?
Are statistical databases vulnerable to SQL injection attacks?
If so, what specific kind? Can you think of an example?
1
vote
1answer
816 views
Manual Testing and Exploitation of an SQL Injection
So I read over this, this and this. I understand WHAT an sql injection is and the different TYPES of sql. But none of these guides give a definitive example on how to find, enumerate and exploit the ...
2
votes
1answer
1k views
How to Insert data into a table with sqlmap using its sql-query command
I'm using sqlmap on a test site and I wanted to modify some of the data inside of a table. Using the switch "--sql-query".
What is the correct syntax?
example: is it --sql-query="My_query_here"?
...
0
votes
1answer
309 views
sql injection: use WHERE statement in address bar
How can i use "Where" statement during an sql-injection attack in address bar ?
for example:
... from+information_schema.TABLES+where+TABLE_SCHEMA+=+XXXX--
The code above does not work.
0
votes
4answers
707 views
A faster method than Blind SQL Injection?
Blind SQL Injection is based on TRUE/FALSE tests. Here is an example:
is first letter A? --> NO
is first letter B? --> YES
is second letter A? --> NO
...
is last letter X? --> YES
It's ...
4
votes
4answers
516 views
How to test for SQL injection query
When testing for SQL injection in an URL like this: example.com/videos.php?id='34, we use character sequences like:
'
"
""""
/*/
-' --
And many others...
How could you test links like these for ...
3
votes
3answers
158 views
Does SQL have any inherant weaknesses?
A prof said that SQL injection is misnamed because it actually occurs from the program generating the SQL (e.g. Perl, PHP etc.) and I'm wondering is SQL "complex" enough to have any vulnerabilities ...
2
votes
1answer
228 views
Using mysql root account to execute root commands
Suppose that I have full root access to mysql databases, but not root user shell (linux). How can I use the full root access to mysql databases to execute root commands?
1
vote
2answers
268 views
Strange Pharma Spam Site resulting from DAT file created by SQL Injection?
Working on cleaning up a site compromise for a client. Leaving aside that the site is using bunch of custom CodeIgniter code written by someone who had no concept of security, I've ran into a ...
10
votes
1answer
605 views
How to properly secure a $_GET in PHP?
I found an SQLi in a buddies work site. He reported it to his superiors and they allowed me to run additional tests and also patch the site. After reviewing the site, The vulnerable code was a $_GET. ...
1
vote
1answer
876 views
SQL Injection tool (Mac OS X)
Do you know any software for searching (analyze) SQL injection (on website) from Snow Leopard ?
I have found some that can run from Linux or Windows.
I understand that most Linux (console) ...
7
votes
1answer
493 views
How to make SQL injection in PostgreSQL's tsquery?
I think there is SQL injection vulnerability in an application I'm testing. This is seen when I enter malformed parameters into a search form. All exceptions are shown in format:
PHP raised unknown ...
0
votes
3answers
1k views
How to exploit this SQL inection vulnerability?
I am learning SQL injection on a vulnerable Web App. I scanned it with w3af. It showed many vulnerabilities. One of them is :
SQL injection in a Microsoft SQL database was found at: ...
4
votes
2answers
438 views
Security web scanner tool for IIS/SQL Server
I'm trying to do penetration testing of our ASP.NET web-site to check for security loopholes (specifically for SQL injections). We bought a commercial web scanner tool (IBM Rational AppScan), however ...
2
votes
2answers
226 views
Potential insecurity in not sanitizing variables before INSERT with prepared statement in PDO
I use PDO with prepared statement when connecting to my database, and I do this because it is considered a safe way to do so, but one thing I could not help but to wonder was, can submitted data from ...
-1
votes
4answers
3k views
SQL injection for a username/password form?
This is how user validation happens on my site:
if(!empty($_POST['username']) && !empty($_POST['password']))
{
$query = "SELECT * FROM users WHERE username='".$_POST['username']."' ...
7
votes
3answers
552 views
Should IP addresses be validated to prevent SQL Injection?
In PHP I retrieve a user's IP address ($_SERVER['REMOTE_ADDR']) to use it in some MySQL queries, but I do not validate them to be true IP addresses.
Should I validate user IP addresses before using ...
4
votes
1answer
176 views
Can anybody recommend any gems for checking security vulnerabilities?
I want to check one of my RoR projects for security vulnerabilities.
So can anybody recommend any gems for my needs?
0
votes
3answers
462 views
5
votes
2answers
634 views
Could this login form be “hacked” to allow access?
We have this legacy website which has horrendous code in it. I have just been looking through the login form/code and can see un-sanitised sql queries. E.g. in a nutshell:
$email=$_POST['email'];
...
1
vote
3answers
805 views
Could some one please explain - Remote Post SQL Injection
Would anyone be able to post a link to an article which explains how to do a Remote Post SQL Injection and how to prevent anything bad happening. Or even just explain on here.
Any help would be ...
3
votes
3answers
2k views
Why can't sqlmap find an SQL injection in my code?
I installed XAMPP on my development PC, and started Apache HTTP server and MySQL.
It comes with a test page "CD collection", with the following back-end PHP code:
mysql_query("DELETE FROM cds WHERE ...
1
vote
1answer
401 views
Example of attack trees in the web application security analysis
Here I am again asking for some informations about attack trees usage in web application analysis.
For my master thesis I decided to study the usage of this formalism in order to reppresent attacks ...
16
votes
1answer
2k views
Are prepared statements 100% safe against SQL injection?
Are prepared statements actually 100% safe against SQL injection, assuming all user-provided parameters are passed as query bound parameters?
Whenever I see people using the old mysql_ functions on ...
2
votes
2answers
1k views
How to check an Android Application for SQL Injection or XSS bugs?
I was just wondering how could i check my client's Android application for SQL Injection or other similar kind of bugs.
I mean if its an application, where should i write the queries. If through ...
3
votes
2answers
861 views
sanitizing input/output in php/codeigniter
I've been making some progress learning about web application security. Right now I'm trying to finalize my strategy for sanitizing input and output.
Background: Users can submit reviews to the site, ...
5
votes
1answer
3k views
Testing SQL injection using sqlmap
I'm just started using sqlmap ( http://sqlmap.sourceforge.net ) to test for possible sql injection attacks.
I got a website which is vulnerable:
C:\Python27>python xxx\sqlmap\sqlmap.py -u ...
6
votes
2answers
8k views
How do I test for SQL injection vulnerabilities on a site with input fields?
What methods are available for testing SQL injection vulnerabilities?
3
votes
3answers
1k views
Hibernate SQL Injection - Fortify 360
I am using Fortify 360 to analyze my code's security. Fortify has identified a Hibernate based delete method to perform a delete based on an object that has been passed in. My understanding of ...
3
votes
2answers
830 views
Scanning DVWA with w3af - Unable to detect SQLi when security on low
I've been messing around with DVWA (Damn vulnerable web application) and w3af. I've been scanning DVWA with w3af, and have used the spiderMan proxy and http config to setup auth credentials to get ...
2
votes
3answers
480 views
How does Facebook avoid crawling over their site?
I used Netsparker community edition and tried to find a vulnerability in my personal site. Then I thought let's try with Facebook. It didn't show a single webpage also because normally it shows ...
1
vote
3answers
234 views
Deploying vulnerable web application online
I am deploying a vulnerable web application for students (about 100) in a university, that they can test online and am collecting all the traffic for research purposes.
I am deploying this machine on ...
7
votes
2answers
587 views
Interpolique: transparently preventing SQL Injection and XSS with base64 encoding, what happened?
For the keynote at The Next HOPE a couple of years ago, Dan Kaminsky unveiled Interpolique (the talk is really fun btw). The problem he raised was how to defend against injection attacks, including ...
4
votes
2answers
112 views
Changing windows client form values at runtime
I am performing a code audit of an older VB6 application which uses dynamically constructed SQL to execute against the database. While I see this as a SQL injection point, the developer contends that ...
0
votes
2answers
143 views
How much security should I use for my web application?
My question is, for a "normal" site, what do you think is enough to secure against methods used by "script kiddies"? For example, SQL injection, XSS, and stuff like that.
Same question for password ...
14
votes
4answers
4k views
How did anonymous use UTF-16 ASCII to fool PHP escaping?
A few months ago, anonymous took down a child pornography site using SQL-injection. I read in this article that anonymous claimed that "the server was using hardened PHP with escaping," but they were ...
5
votes
3answers
391 views
Best way to alert a website owner of a vulnerability?
recently i was browsing a site, and i noticed that at the end of the URL it said id=168, which is a common indicator that the site is vulnerable to an SQL injection attack. i did some tests and found ...
1
vote
0answers
174 views
How anonymous used UTF-16 ASCII to fool PHP escaping [duplicate]
Possible Duplicate:
How anonymous used UTF-16 ASCII to fool PHP escaping
(Reposted here as per request). A few months ago, anonymous took down a child pornography site using SQL-injection. ...
3
votes
4answers
2k views
How is my website vulnerable for sql injections?
I am running a small website where I have published some articles.
I am also very interesed in security topics and tried sqlmap on my website. It found the database name, so my question is how it ...
3
votes
4answers
653 views
SQL query sanitation (black list)
I have a following problem/challenge:
Web application (ASP.NET 3.5) installed on corporate LAN and operates on SQL Server DB needs to provide ability to generate custom reports.
These reports can be ...
2
votes
2answers
349 views
How can an IPS\IDS detect SQLi \ XSS (or other application layer) attacks?
I've been thinking about how an IPS works, and as far as I know it inspects the packets on the TCP\IP layer.
How can it detect attacks on higher levels without harming the user experience? How does ...
11
votes
2answers
2k views
Multibyte character exploits - PHP/MySQL
Could someone please point me to a link with some information on multibyte character exploits for MySQL? A friend brought them to my attention, but I've not been able to find much information on the ...
6
votes
3answers
3k views
How to patch against RefRef's DOS attack
Overview
Anonomous claimed responsibility today for the Denial of Service attack against wikileaks. They are using a new software called RefRef. It seems to exploit Mysql using the server's ...
6
votes
2answers
192 views
Presentation on Web App Security (ACM Student Chapter)
I am a member of the local ACM student chapter in my university and as part of our activities I am scheduled to give a talk on current issues on Web Application Security (and possibly secure coding ...
