SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database.

learn more… | top users | synonyms

1
vote
0answers
70 views

What tools on unix can scan sql dumps for malware? [closed]

I'm attempting to check for malware, spam and any kind of injection/exploitation on a sql dump that has been provided and was wondering what kind of tools are there already in place to help with this? ...
1
vote
1answer
174 views

SQL truncation vulnerability

I came to know the SQL truncation vulnerability that I wasn't aware of. It is my understanding that this vulnerability is based on the fact that MySQL truncates the value of an "insert query" whether ...
0
votes
1answer
164 views

Why is it a bad idea to escape HTML before escaping SQL? [duplicate]

From the security perspective (and not usability as it's discussed here http://stackoverflow.com/questions/3648430/is-it-a-bad-idea-to-escape-html-before-inserting-into-a-database-instead-of-upon), ...
4
votes
1answer
962 views

Understanding Boolean Based SQL Injection

I am trying to understand the concept of Boolean Based Blind SQL Injection. I have gone through OWASP Guide To SQLi to understand it. However I am confused with how exactly does it work. Below id ...
25
votes
8answers
10k views

Why Disallow Special Characters In a Password?

The culprit in this case is a particular (and particularly large) bank that does not allow special characters (of any sort) in their passwords: Just [a-Z 1-9]. Is their any valid reason for doing ...
16
votes
4answers
2k views

Does stored procedure prevent SQL Injection in postgreSQL

Is it true that stored procedure will prevent databases from being injected? I did a little research and I found out that SQL-Server, Oracle and MySQL are not safe against SQL injections if we only ...
0
votes
2answers
411 views

Is sqlmap traceable?

Is sqlmap still traceable when we use --tor --user-agent and macchanger? For example: sqlmap -u "[vulnerable_website_link]" --tor --user-agent="Mozilla/5.0 (compatible; Googlebot/2.1; ...
0
votes
1answer
489 views

SQL injection is possible but selected queries not working

I'm black-box testing an application which uses java spring framework and MySQL in the back-end. When I insert a single quote (') in a text box field, the server returns a HTTP status code 500 ...
0
votes
0answers
65 views

Which enterprise-class DBMS allow forbiddance of (No)SQL comments?

This question could be renamed "Would forbidding SQL comments inside transactions prevent some SQL injections?", but I'd like to know if some DBMS allow this first. The goal is to reduce the attack ...
4
votes
2answers
113 views

SQL abstraction layer : A preventive mechanism for SQLi?

While performing a pentest for a Java based application I came across an SQL (actually HQL) error by simply putting a single quote in one of the request parameters and breaking the syntax of the ...
0
votes
3answers
121 views

What is blind injection and how to simulate the issue?

What is blind SQL injection, and how does it differ from normal SQL injection? How can I simulate an issue of blind injection?
10
votes
1answer
1k views

How is time-based SQL injection different from other types of SQL injection?

I understand what a time-based SQL injection is, and I understand how it works (at least how it's detected/exploited). However, is there anything in specific which makes this type of injection any ...
0
votes
2answers
82 views

Leading injection

Are there known exploits where a query of the form: select foo from bar where id = 6 can be turned into: select * from select foo from bar where id = random stuff It's clear that a badly formed ...
0
votes
1answer
61 views

Attacks to jump from SQL server to Web server, without direct network access?

Considering that I have a structure like the following, allowing only the TCP and UDP ports for SQL to be accessed. Specifically no traffic initiated from SQL is allowed to reach SECURE. SECURE-> ...
7
votes
3answers
767 views

What would the potential abuses be for an HTTP API that accepted raw SQL?

I was wondering what some of the potential abuses could be for an HTTP API that accepted SQL queries and output results sets. The fact that this is the canonical definition of SQL injection is not ...
0
votes
1answer
150 views

Some queries regarding SQL injection

[I'm not really sure if I should be posting this on SO or here. I think my questions might be answered if I have had a good experience with MySQL. But, I don't. So probably, most of you will ...
4
votes
1answer
232 views

VB.NET stored procedure implementation?

While reviewing code for a vb.net application I have come across the following implementation of stored procedures using ExecuteDataSet Result = DBInstance.ExecuteDataSet(Name, ...
4
votes
2answers
148 views

2000 Sets of Personal Information

So the story goes like this.. I recently rediscovered an old website i used to go on quite often but i couldn't remember my login. The site is poorly made and hasn't been updated in about 5 years, so ...
19
votes
4answers
7k views

How did Anonymous use UTF-16 ASCII to fool PHP escaping?

A few months ago, Anonymous took down a child pornography site using SQL-injection. I read in this article that Anonymous claimed that "the server was using hardened PHP with escaping," but they were ...
0
votes
1answer
127 views

How to use a Blind SQL-i keyword?

After scanning my website with uniscan I found a few vulnerabilities. I found this answer here and tried but it does not return anything except what it should return. Blind SQL Injection: [+] Vul ...
4
votes
6answers
8k views

Are there any tools for scanning for SQL injection vulnerabilities while logged in?

Some pages of my website were vulnerable to SQL injection. The injection worked only when the user was logged in. I have now fixed this problem, and now I want to make sure that no similar problems ...
3
votes
1answer
140 views

How easy is it to make a malicious bank/identity card?

I recently got a magnetic card reader that plugs into my computer because I was bored. I decided to scan my ID and bank card through it and I was surprised to see my ID number/bank card number show up ...
1
vote
2answers
1k views

Understanding the order by clause used in SQL Injections

I am trying to enumerate a database, created specifically for the purpose of learning SQL injections. I am trying to discover the number of columns a particular select statement might be using. I do ...
6
votes
3answers
4k views

Does mysql_escape_string have any security vulnerabilities if all tables using Latin1 encoding?

I have heard that the PHP function mysql_escape_string has security vulnerabilities related to mult-byte characters. Are there any vulnerabilities if all tables are using Latin1 encoding?
2
votes
2answers
208 views

SQL injection: real escape string function

example4.php?id=id=2-1 I came across the above injection and I can not figure out why(how) does this work and what's interesting is it returns all the records from the database. Anything guys? ...
0
votes
1answer
112 views

Sql Injection and no priviliges to write files [closed]

I have a sql injection in my site and im using sqlmap but when i try --os-shell it says cannot write file due to permissions . now is it impossible to write a file to the server?
-4
votes
3answers
8k views

How do I hack this login page by using SQL injection? [closed]

I'm testing a client's web site vulnerability to SQL injection, which appears to be the case. The web site is hosted in IIS on a Windows server and is using Microsoft's .NET framework with SQL. I'm ...
1
vote
2answers
460 views

Sql injection is not working on my site?

I have set up a page and database so I can practice SQL injection. Ive tried some examples and it doesn't seem to work. It seems to add the username and password to that database, even though I input ...
3
votes
1answer
97 views

Unsafe sanitization? Is this code SQLi vulnerable?

Function RemoveSuspeitos(ByVal strTXT) Dim txtAux As String txtAux = strTXT txtAux = Replace(txtAux, chr(34), "") txtAux = Replace(txtAux, ...
1
vote
1answer
537 views

Why isn't it possible to do SQL injection (HIGH Level) in this example in Damn Vulnerable Web App?

$query = " $sql = select * from users where id = '$id' " Won't $id=3' OR '1'='1 break the query ? The doubt arose because someone claimed it can't be broken.
0
votes
2answers
412 views

SQL Injection and JavaScript Regex Bypass

me for learning SQLI. But I got stuck at this one regex which seems to be unbreakable : document.loginForm.username.value = document.loginForm.username.value.replace(/[^a-zA-Z0-9]/g, ""); If someone ...
3
votes
0answers
21 views

SQL Injection via Unicode [duplicate]

My team currently uses ASP.NET with MS SQL Server for our software. Security has only become important since I started, in which there is injection vulnerabilities everywhere. Due to current ...
2
votes
4answers
3k views

SQL Injection with pass MD5

I want to know, if in my login form there is any SQL injection possible. If there is, what could the exploit's web form entry look like? I send username and password by html form (POST). The login ...
0
votes
4answers
987 views

SQL Injection via Unicode

My team currently uses ASP.NET with MS SQL Server for our software. Security has only become important since I started, in which there is injection vulnerabilities everywhere. Due to current ...
2
votes
3answers
5k views

No single quotes is allowed, Is this SQL Injection point still exploitable?

The SQL phrase looks like this, "SELECT * from XX where id = '" + id + "'" The id variable comes directly from the GET parameter named id. And the Java web app explicitly disallowed single quote. ...
8
votes
3answers
13k views

Is there any SQL injection for this PHP login example?

I want to write a login form, and I got one example from the web. I want to know, if there is any SQL injection for this code? If there is, what could the exploit's web form entry look like? This is ...
4
votes
2answers
328 views

Can anybody recommend any gems for checking security vulnerabilities?

I want to check one of my RoR projects for security vulnerabilities. So can anybody recommend any gems for my needs?
1
vote
2answers
7k views

Uploading Shell Using SQLI

I found an SQL injection vulnerability in a Wordpress installation inside one of my lab machines and I am trying to leverage it to upload a shell. I can get the admin hash but it seems that it is ...
2
votes
4answers
589 views

Generic defense againt SQL injection

This is a little bit of a rant, but there's a real question at the end. I recently installed a new perl script on a site (which will remain nameless) which failed mysteriously with an error 403. ...
2
votes
1answer
3k views

SqlMap bypasses OWASP ModSecurity Core Rule Set for SQL Injection

I am trying to perform a simple penetration test on the DVWA (the web application that has been specifically designed to be vulnerable to some of the most common web application attacks). I want to ...
0
votes
2answers
277 views

What kind of attack is this?

This past week, my traffic logs are showing many hits (usually with repeated tries) for a URL from perhaps 30+ different IP addresses all over the world. This is not a URL that should garner more than ...
1
vote
0answers
99 views

Hacking attempts:in.js

A client of mine keeps getting hacked by seemingly SQL injection where a script tag containing a link to an "in.js" file is added. Sometimes from a domain called sportserve.co.uk, other times from ...
0
votes
3answers
618 views

String sql injection vs sql injection

What's the difference between normal sql injection and string based sql injection? An example would be appreciated. As far as I understand from the few readings around the net, string based sql ...
7
votes
2answers
461 views

How can this input-sanitizer function be defeated?

There's a Classic ASP application at my job that is (I believe) highly vulnerable to SQL injection. I want to prove to management that this code isn't secure, but all I'm able to do is insert "SQLINJ" ...
0
votes
3answers
704 views

SQL injection explanation

I just found in logs that someone try to exectue this SQL injection ...
0
votes
2answers
1k views

sqlmap: testing javascript or json parameters

I have a parameter in a POST request which is in the following format: ParamName= < r username="123" password="456" x="" y=""/> and I want to test username and password which are two HTML ...
1
vote
0answers
224 views

MSSQL injection convert syntax error [on hold]

I just setup a test bed and i disabled information_schema from being accessed (a weak waf) and i've been trying to extract the table list from the database by using convert to spit out a conversion ...
0
votes
1answer
111 views

MSSQL injection help [closed]

If information_schema is not allowed in MSSQL , what is another method i can use to list the tables inside a database and ultimately the columns so i can dump them without using information_schema? ...
-1
votes
1answer
106 views

True/false statements in MSSQL without < > and = [closed]

How can i make a true/false statements in MSSQL without the following symbols: <,>,= ? Everything i can think of, e.g: or 1=1-- (true) or 1>1 (false) and 2<>3 (true) Makes use of ...
0
votes
1answer
576 views

Is ASP.net More Secure than PHP in GENERAL? [closed]

In other words, my (long version) question is: Are developers able to get away with, more using ASP.net than PHP in terms of writing secure code for their apps? I ask this because ASP.net has many ...