SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database.

learn more… | top users | synonyms

1
vote
2answers
12k views

1'or'1'='1 help

When I put Username:anything and Password : 1'or'1'='1 Then my database retrieves the first row in the mysql table. But I want to retrieve the row corresponding to Username:anything row. How should I ...
0
votes
1answer
120 views

What SQL payloads can be injected for a numeric field?

I have a parameter (pi_apk_version_code) that seems to be vulnerable to SQL Injection (the team is divided on this). The database column corresponding to this parameter accepts only numeric values. ...
1
vote
1answer
64 views

Does fuzz testing produce different output compared to manual testing?

I am testing an API and one parameter is vulnerable to SQL injection. When I run OWASP ZAP's fuzzer on this parameter, the input "; or 1=1" results in a successful exploit of SQL injection. However, ...
1
vote
0answers
92 views

Dumping Large table using Sqlmap

I am learning/working on sqlmap and I was trying to dump a large table with 11K entries on my localhost. The command I used is: python sqlmap.py -u "http://localhost/searchre.php" --data="search=' ...
-6
votes
2answers
157 views

SQL injection using only Scala syntax?

Is there a way to perform an SQL injection using only Scala syntax (not importing any Java)? From what I've seen online all the examples (like this) were based on importing Java things and then using ...
0
votes
1answer
61 views

sqlmap not finding a proven vulnerability

I'm testing a wordpress site with the jetpack plugin installed. According to: https://www.exploit-db.com/exploits/18126/ this plugin should be vulnerable to SQL injection (found with sqlmap) but when ...
0
votes
0answers
20 views

Can someone provide some examples of boolean based SQLi tests?

I've seen tests ' or 1=1-- or ' and '1'='1. I was looking for some more boolean based tests. One of the sites I'm testing has WAF blocking a lot of tests, but simple boolean tests, like above, have ...
0
votes
1answer
37 views

Getting Operating System Username using MySQL SQLi

Suppose I have a website which has SQL injection vulnerability and I got the database schema etc. Is there any means by which I can get the operating system username or the SSH username? Asking from ...
3
votes
2answers
1k views

What makes a SQL Injection count as blind injection?

Firstly, from what I have read so far, boolean-based blind SQL injection is when you can't see any error messages and rely on true or false responses to queries to milk the database. For example, you ...
0
votes
2answers
169 views

SQL Injection Attack - Permissions Defenses

SQL injection attacks work by the attacker putting valid SQL into the text that goes back from the page to the server; something like "Delete * from tblAccounts where 1=1" What I cannot understand is ...
0
votes
1answer
148 views

Dumping custom query via SQL injection when output is in the die() function?

On my localhost I have a PHP link like this abc.com/index.php?q=XYZ where XYZ is a base64encoded parameter that I have verified is injectable. When I try abc.com/index.php?q=XYZ' it returns You ...
0
votes
0answers
65 views

MySQL SQL Injection - Get User Password

I've used SQLMAP to check for SQL injection. I've managed to retrieve the name of just one database (dbInfo) However, using SQLMAP I can't enumerate anything else - where it is tables within the DB ...
0
votes
3answers
92 views

Is it a good idea to let a database do a password check?

Setup A server running a PostgreSQL database and an Apache with several php applications. Access to db is over the loopback interface. The db contains a table with the username and SHA-512-CRYPT ...
1
vote
1answer
71 views

Are sqlcmd parameters inherently at risk of SQL injection?

The command line utility sqlcmd has a feature to allow parameter substitution, from command line parameters and environment variables. https://msdn.microsoft.com/en-us/library/ms188714.aspx If an ...
1
vote
1answer
38 views

How to extract data from hackyourself legal site with table and column information?

I am following the Pluralsight SQL injection tutorial. The instructor did not go over actually extracting the data. http://hackyourselffirst.troyhunt.com/CarsByCylinders?Cylinders=V12'AND 1=(SELECT ...
2
votes
1answer
145 views

SQL injection vulnerability when using prepared statements in PHP

I've been studying prepared statements and implemented it in my first login. I used a prepared statement for the SQL query and am wondering if this is enough to ward off most SQL injections? Since ...
0
votes
1answer
128 views

Can there still be SQL injection when storing the password as a hash?

Could there be any SQL injection vulnerability in the code below since it only queries the database for username and bcrypt hash? Would the vulnerability of this code be more on the bcrypt hashing ...
1
vote
1answer
387 views

Is this enough to tackle script / malicious code insertion in GET, POST requests?

I've got legacy PHP code which attempts to prevent script/SQL injection with the following: if (!empty($_POST)) { reset($_POST); while (list($k,$v)=each($_POST)) { if(!is_array($_POST{...
-5
votes
1answer
155 views

What is the most secure database? [closed]

I need to learn about database systems, but first I need to know which is the safest. For example, information like government data need to be protected, so what is the best database to handle this ...
2
votes
1answer
135 views

Bypassing login with SQL Injection

I'm learning about SQL Injection, and I'm playing around on my local machine with vulnerable web application, which has login form. How the login mechanism works is that it first searches whether ...
0
votes
0answers
41 views

Oracle PL/SQL SQL Injection Test from Unicode to Windows-1252

I have a DB using windows-1252 character encoding and dynamic SQL that does simple single quote escaping like this... l_str := REPLACE(TRIM(someUserInput),'''',''''''); Because the DB is windows-...
1
vote
0answers
28 views

Error based SQLi, i don't understand this SQL statement [duplicate]

I'm trying to validate a challenge on Error-based SQL injection: and there is this SQL statement in the documentation which procude an error, but i really don't see why (also i'm not sure to ...
1
vote
1answer
186 views

How make SQL select query without comma? [closed]

I am trying SQLi and comma was filtered there. How make SELECT SQL request without a comma?
3
votes
1answer
121 views

SQL injection: insert data from Get request

I am using the vulnerable web app mutillidae. There is a webpage where you can view information from a profile but you first need to provide a user and a password. Once you click send, it sends it to ...
2
votes
2answers
732 views

SQLMap: How to dump tables that begin with a specific letter?

I would like to know the command of SQLMap, which permits me to retreive just tables that begin with a special letter. Example with letter "T": sqlmap.py -u www.website -D database -T tables (...)
0
votes
0answers
50 views

sqlmap receiving corrupt/garbage data for password column only

sqlmap is receiving corrupt/garbage data for the password column. The rest of the columns extract just fine. Example: Đ\x9eđ\x98Ú I did a bit of research and a few people have experienced the ...
1
vote
2answers
147 views

Is my code using mysqli_real_escape_string and quotes100% safe against SQL Injection?

My code is: SELECT * FROM tlb_members WHERE username="{mysqli_real_escape_string($_GET['test'])}" I'm searching and some people said using quotes in SQL statements is safe. Is this true?
3
votes
1answer
98 views

Why is this SQL Injection attempt failing on DVWA?

I'm practicing SQL injection on DVWA (non-blind) with the lowest security settings. I want to list the tables in the current database. To do that, I attempt to enter 0'; show tables;-- in the User ID ...
0
votes
2answers
36 views

How to protect data of users in multi-user site?

I am working on a system where people can make their accounts with few things being stored in database like id (that will be auto increment), first name, last name, username etc. Now I am well aware ...
1
vote
0answers
56 views

Open source tool to test a WAF against OWASP Top 10? [closed]

Are there any open source tools to test a WAF against OWASP Top 10? Especially I am looking for a tool that tests a WAF against different types of attacks & reports test results.
1
vote
2answers
342 views

SQLmap POST parameter 'txtLoginID' is not injectable

I have a lab machine that I have been practicing some SQL injection on. I know that the POST parameter that I am trying to exploit is vulnerable as I was able to extract the user DB manually. I ...
0
votes
1answer
180 views

How too use R0b0tPirates 500 error bypass

I had a valid injection, but could not exploit it due to 500 errors, so I looked around and found that R0b0t Pirates, a blog that specializes in tools like sqlmap, has put out a 500 error bypass, ...
1
vote
0answers
55 views

Encoding payloads for GWT version 7

I'm auditing a website built with Google Web Toolkit. It uses serialization version 7, so the tools from GDS Security won't work (they only work till version 5). Using this technique I got all classes,...
30
votes
4answers
2k views

Is it okay to reveal database's table names?

I'm developing web application that uses database. I have to do some operations which needs database table names and db table schema. Will it be secure if I send this kind of information to client ...
0
votes
1answer
95 views

How does Netsparker extract the version of SQL Server during a SQL injection?

We are using netsparker cloud version On last week when netsparker scan it detect SQL Injection Vulnerabilities. However I am surprised as the injection query throw error for casting and the scanner ...
0
votes
1answer
80 views

What does the below SQL injection indicate?

What is the meaning of this command in SQL ? php?que_id =-1/**/UNION/**/ ALL/**/SELECT What does /**/? indicate here?
-1
votes
1answer
165 views

why database show vulnerable column when i give a wrong parameter in query?

When we try for inject a website for find vulnerable column then sometimes we need to give a wrong value in the website parameter. Like www.vhul-web.com/index.php?id=1 union select 1,2,3 -- - Now ...
1
vote
2answers
2k views

What makes an Android application vulnerable to SQL Injection?

Definition of SQL Injection SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g....
4
votes
1answer
96 views

xp_cmdshell to add domain admin

Did an assessment on SQL injection the other day and the only question I didn't do was to add an domain admin. Got access to xp_cmdshell. Tried net user username password /ADD /DOMAIN but permission ...
0
votes
1answer
736 views

Exploit SQL injection in OWASP ZAP

I have done a normal scan (not fuzzing) of a website using ZAP in attack mode, and it gives me several possible injections. My question is if there is any way to try to exploit these within ZAP, ...
5
votes
1answer
162 views

sqlmap HTTP 405 error on a vulnerable POST parameter

For academical purposes I need to explode a blind sql injection on a form paramater which is sent using the POST method. The form is very simple, it just has an input text box where to introduce the ...
8
votes
2answers
117 views

Response to unauthorized scan by legit company? [closed]

On Christmas day, our web service came under an apparent attack and we responded by blocking the (single) source IP. Upon later investigation, it turns out the 'attack' was actually an intense ...
3
votes
1answer
357 views

SQLMAP and DBMS credentials, how do you use them?

for educational purposes and in order to develop a test for students, i try to "hack" a website developped by a friend : http://www.websitetohack.com.index.php?id=5 When i launch SQLMAP, it finds a "...
1
vote
2answers
18k views

sqlmap unable to find SQL injection vulnerablitity

so i just started up with sqlmap to learn sql injection vulnerability on my application. Here I followed steps as per some tutorials. So this are the steps which i followed : sqlmap.py -u "http://...
3
votes
2answers
95 views

Presence of table “sqlmapoutput” in PostgreSQL database

I was pentesting a client's database and saw this one table "sqlmapoutput" in one of the user created schemas. It's a PostgreSQL DBMS. and he has no idea how it came there. There was no data in the ...
16
votes
3answers
2k views

How to defeat doubling up apostrophes to create SQLi attack?

I know some developers double up apostrophes to mitigate SQLi. (This is when the input is ' so it becomes '') Is there a way to beat this? This is on MS SQl Server.
3
votes
0answers
369 views

SQL security - ACID transactions and locking to prevent financial fraud (timing attack?) [closed]

I am trying to prevent something similar to this from happening: http://hackingdistributed.com/2014/04/06/another-one-bites-the-dust-flexcoin/ Basically the financial exchange was using non-ACID ...
4
votes
1answer
443 views

SQL Injection - login bypass [closed]

Background information: SQL Injection as a school task. Login bypass. Given two input fields name and password. Confirm via solve button. Info on what I have and was able to find out: it is ...
17
votes
4answers
9k views

Is it possible to do SQL injection (HIGH Level) on Damn Vulnerable Web App?

I searched all over google to see how it would be possible to bypass the following (it's from the high level of security from DVWA): <?php if (isset($_GET['Submit'])) { // Retrieve data $id ...
1
vote
1answer
117 views

Can SQL test by using SqlMap tool harm a website?

I am just learning about SQL injection attack, and I want to test this by using sqlmap on my own website.However I wonder if the attack can cause any harm on my website's services during the attack? ...