SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database.

learn more… | top users | synonyms

1
vote
1answer
67 views

how to separate arguments in sql query [closed]

I have this query : 'UNION ALL SELECT group_concat(username,password) from users-- and I want to separate username and password because when I execute the code it prints it all in one long string. ...
-1
votes
1answer
183 views

Cookie based sqli [closed]

I have identified a website vulnerable to sql injection via a authentication token. Does anyone know where I can find a tutorial / example of cookie based sql injection?
0
votes
2answers
116 views

“&” character in url [duplicate]

I think I found a bug in my website but don't know how dangerous it is. My website will redirect you to a warning page whenever you click on a link that is pasted in the comments section. The url ...
4
votes
5answers
2k views

Are image uploads also vulnerable to sql injection?

I have some good knowledge how sql injections work. I see that the Googling inurl upload.php will tell one about the upload paths in a website. My Question is that if a person finds a path by which he ...
1
vote
0answers
38 views

Why the column fields doesn't show up on injection of column names?

I'm practicing SQL injection. I've been able to get the column names and table names on a test environment. query 1. On executing below query, I see adminId, adminUsername, adminPassword ...
0
votes
1answer
61 views

Injecting a query within a query that has an order by or group by function [closed]

Select * from Shop where Item = $item order by ProductNum desc I found this vulnerability within a website. To test if there's any vulnerabilities I inserted a single quotation after ...
0
votes
2answers
111 views

Would Insecure Direct References and SQL Injection be solved by using Row-Level Security and Per-User Connection Strings?

Regarding the following OWASP Vulnerabilities: Insecure Direct Object References By that I mean letting someone see /account/123/not-theirs (this could be the wrong reference I'm using above). SQL ...
2
votes
2answers
190 views

After trying successful SQL injection why the result isn't getting displayed on the webpage?

Below is the PHP code I wrote that allows SQL injection with one parameter ie 'id' in this case. On trying SQL injection via putting this 2' ORDER BY 1;--' in the parameter (id field ), I get ...
0
votes
2answers
172 views

SQL Injection in a Web Service URL as a Parameter Value [closed]

Obviously SQL Injection via the payload of a message is a very common practice and therefore it is always key to cover this (I already have in my code). However I'm just wondering about how possible ...
46
votes
9answers
15k views

Why Disallow Special Characters In a Password?

The culprit in this case is a particular (and particularly large) bank that does not allow special characters (of any sort) in their passwords: Just [a-Z 1-9]. Is their any valid reason for doing ...
4
votes
3answers
244 views

Demonstrating SQL injection

I want to do a demo for a login page that is vulnerable to SQL injection for training purposes. I already tried to build one using PHP and MySQL. I commented the code sanitation to make the page ...
3
votes
1answer
80 views

Can we join a table in this Ruby on Rails Direct Object Reference?

I am trying to inject a RoR application... I have found a nice command which will allow me to delete things unchecked...but the problem is that its not a problem its a very minor point, to make it a ...
3
votes
1answer
349 views

SQLMap: Testing implicit parameter URL

I'm pentesting a client's website but could not find a syntax to tell SQLMap that the variable it should test doesn't have an explicit name in the URL. I've already tried the MVC method that says to ...
7
votes
2answers
7k views

Testing SQL injection using sqlmap

I'm just started using sqlmap to test for possible SQL injection attacks. I have got a website which is vulnerable: C:\Python27>python xxx\sqlmap\sqlmap.py -u http://www.example.com/page.php?id=1 ...
9
votes
2answers
1k views

Cross site scripting when the greater than and less than signs are escaped?

If a website encodes < to &lt; and > becomes &gt;, is it still possible to perform cross site scripting? What would you enclose the script tags in? For example, on one of my sites I can ...
2
votes
1answer
161 views

Using INTO OUTFILE with INSERT

I have some free time so I'm testing various local vulnerable machines. In one particular lab machine, you first have to gain administration panel, and then use the available "insert" command and ...
57
votes
7answers
20k views

SQL injection — why isn't escape quotes safe anymore?

Raw SQL When you're writing SQL -- for anything that takes human input really, a lot of things have been done to avoid the injection. Everyone that's heard of SQL injection knows that (I'm going to ...
2
votes
2answers
735 views

Preventing SQL Injections

So I'm pretty new to SQL so I'm not too familiar with how to prevent any SQL injections. I have 1 main form that's being used as a poll and it currently only has 1 text field. At the moment I think ...
1
vote
2answers
342 views

SQL Injection Issue Multi-line query

I am currently doing a SQL Injection attack against a website in school(that the tech created) sadly I can't point anyone to the site in question, the teacher has allowed us to gain knowledge as ...
1
vote
2answers
147 views

Breaking mysql username and password form [closed]

I have two versions of a website. The first one has no security precautions against sql injections. So if I try something like: Username: hello_world Password: ' or ' 1=1 I'll be signed in as the ...
-1
votes
1answer
124 views

Is there a way to bypass the inbuilt php functions for sqlinjection

If there is a way to bypass the built-in functions of PHP to protect against SQL injection or I should rely on some other filters rather than depending on built-in functions?
3
votes
3answers
151 views

Drupal SQLi only on login form?

Recently, CVE-2014-3704 was in the news. This vulnerability allows attackers to execute SQLi without the need of being logged in. However, I've looked to the available exploits, and I found only ...
3
votes
1answer
144 views

Proving SQL Injection Vulnerability

I have recently come across what I believe to be a serious flaw in the security of a 3rd party computer program used within my company. Apologies for deliberately keeping details vague, but I hope you ...
0
votes
2answers
54 views

Which of these DBMS offers the lowest security for SQLI? [closed]

Which of these DBMS offers lowest security for SQLI? Oracle, MYSQL, SQL Server, ProstgreSQL or DB2? Why? Could you explain to me, why some are more vunerable to SQLI?
0
votes
3answers
162 views

How to organize a CTF?

In the context of an IT event, my team would organize a CTF (Capture The Flag). About the challenges (we’re working on them). I want to have some references on the types and levels of difficulty that ...
-1
votes
3answers
243 views

How to check for sql injection attack? [closed]

We do our final year project related to sql injection. For implementing sql injection attack which IDE or tool we used? bcoz netbeans and other type of IDE are more secured?
1
vote
1answer
120 views

How to use mySQL UNION operator in sql injection, with injectable password paramiter?

Can someone give me an example of sql injection with UNION operator, that returns users and passwords, with regards to the bellow php example. I've managed to inject simple 1 or 1=1... in the pass ...
-1
votes
1answer
115 views

Blackbox testing for SQL injection

In my college, a security challenge event is going on for one whole month, Participants are expected to 'hack' into a website. The site has a login form, which accepts username and password and POSTs ...
0
votes
2answers
340 views

How to perform SQL injection with real_escape_string filter in place?

can someone give me an example of mySQL injection payload, which will bypass the real_escape_string() sanitize filter in regards to the below php example. function sanitizeStrXSS51($var) { global ...
2
votes
1answer
203 views

Learning ethical SQL injection with php login form

I'm learning ethical hacking and now I'm on sql injection topic. I'm also new to SQL and php. Ok, so I have local damn vulnerable website with back-end Linux, MySQL and Apache and now trying to use ...
0
votes
2answers
77 views

SQLmap over uni wifi [closed]

I don't know if this is the right place to ask this question but I'll give it a shot! I was playing around with Kali and SQLmap. I was just scanning some sites nothing serious. When I was doing this I ...
0
votes
2answers
149 views

SQL injection at work [closed]

We have a web form that can be filled out with text fields and then they get emailed to us at work. Today we got some SQL commands it looks like in a bunch of emails. I just would like to have a bit ...
-1
votes
2answers
167 views

How to use ORM correctly to prevent SQL injection?

I read here that using ORM (like nHibernate) does not necessarily prevent SQL injection; for example, if you keep creating dynamic queries using your ORM framework you are still vulnerable. Fine, ...
17
votes
3answers
2k views

Does an ORM framework such as hibernate completely mitigate SQL injection?

I know that to prevent (prevent all or most?) SQL injection attacks that you should use parametrized queries. I've been using hibernate for a while instead of hand writing my sql statements. Are there ...
0
votes
3answers
143 views

How to validate report given by a white hat hacker

I give a contract to find vulnerabilities in my site to a white hat hacker. According to him he performed several attacks on my site for 15 days and find that there is no any security threats. I am ...
4
votes
1answer
511 views

How to prevent ASCII Encoded / Binary String SQL injection in CodeIgniter

I have been using CodeIgniter for two years and I am digging into penetration testing. I think that ActiveRecord does good job at preventing SQL injections, but is there any possibility of bypassing ...
2
votes
3answers
142 views

Is there an SQL injection equivalent on url-passed parameters to a servlet?

In SQL injection an attacker can craft a string that if left unchecked and executed it can complete and execute arbitrary SQL commands. Is there an equivalent to these kinds of attacks in JSP pages? ...
1
vote
4answers
1k views

String sql injection vs sql injection

What's the difference between normal sql injection and string based sql injection? An example would be appreciated. As far as I understand from the few readings around the net, string based sql ...
2
votes
1answer
144 views

Error-based SQL injection

I understand the conceptual idea behind error-based SQLi, but not the actual execution. In particular, I can't make sense of this expression: or 1 group by concat_ws(0x3a,version(),floor(rand(0)*2)) ...
5
votes
2answers
103 views

Is the separation of data from different applications via Oracle schemas considered secure?

I am evaluating the pros and cons of having different Oracle schemas vs. separate Oracle servers. Having a dedicated server for each application is really expensive and I only want to consider this if ...
0
votes
1answer
241 views

SQL injection on query (MySQL/PHP) [closed]

First, sorry if my issue is a duplicate! This is an exercise that I can not solve. It is an authentication, simply. But the problem is that the application does not check both the password and ...
18
votes
6answers
3k views

Can SQL injection lead to remote code execution?

Is it possible to execute some code (e.g. PHP code on a PHP-based web application) on the server through SQL injection? If yes, how exactly? I understand that un-escaped field can lead to SQL ...
35
votes
6answers
5k views

Is SQL injection possible with LIMIT?

A friend of mine built a web application that I'm testing for fun. I noticed that he allows a user to set the limit of a certain query, and that limit is not sanitized. For example, I can choose any ...
0
votes
1answer
106 views

Performant ways to identify potential SQL injection vulnerabilities in web applications [closed]

I [itsec novice] am developing a workflow/application for identifying potential SQL injection vulnerabilities in web applications and would like to get some professional opinions on my approach. ...
-1
votes
1answer
85 views

my table is dropped in PDO [closed]

This is my PDO method i used this method to save input value to SQL After reading this pdo-prepared-statements-sufficient-to-prevent-sql-injection Since Am started learning PHP i don't know this ...
3
votes
4answers
9k views

Why can't sqlmap find an SQL injection in my code?

I installed XAMPP on my development PC, and started Apache HTTP server and MySQL. It comes with a test page "CD collection", with the following back-end PHP code: mysql_query("DELETE FROM cds WHERE ...
1
vote
3answers
216 views

Beyond SQL injections and XSS

I'm a programmer working on a web service (by myself). Given the fact that I am not a security expert, I came to this website to ask my question. I did all the major things to secure my website. I ...
2
votes
1answer
150 views

Basic Website Protection (XSS,SQL-inject,hashing)

I have a very simple app that does allow unauthenticated users to leave comments (maybe later I will incorporate a capatcha). The app then stores the comments in a mysql db. I do my best to filter out ...
4
votes
2answers
136 views

How do honeypots remain secure to 0days and newer exploits?

If honeypots are designed for a specific set of exploits, such as SQL injection and XSS, how do they protect themselves against other exploits? For instance, if I created a honeypot a few months ago, ...
-1
votes
3answers
156 views

SQL Injection solutions [closed]

I'm editing my question to clarify what I'm trying to ask. In order to launch an SQL injection there should be someway to get input from the user (i.e. username and password) for instance. So I've ...