SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database.

learn more… | top users | synonyms

3
votes
1answer
353 views

SQL Injection - login bypass [closed]

Background information: SQL Injection as a school task. Login bypass. Given two input fields name and password. Confirm via solve button. Info on what I have and was able to find out: it is ...
16
votes
4answers
8k views

Is it possible to do SQL injection (HIGH Level) on Damn Vulnerable Web App?

I searched all over google to see how it would be possible to bypass the following (it's from the high level of security from DVWA): <?php if (isset($_GET['Submit'])) { // Retrieve data $id ...
1
vote
1answer
77 views

Can SQL test by using SqlMap tool harm a website?

I am just learning about SQL injection attack, and I want to test this by using sqlmap on my own website.However I wonder if the attack can cause any harm on my website's services during the attack? ...
5
votes
1answer
219 views

SQLmap injection not working, manually it works fine

I have built a vulnerable web application to demonstrate SQL injection. I want to show both manual injection and automated injection. The injection requires a) the user to be logged in (session ...
17
votes
3answers
25k views

SQL injection with AND 1=1

Please explain the meaning of "AND 1 = 1" in a SQL injection attack. It's from an exercise in my university. E.g. select * from user where id = 'smith'' AND 1=1;-- and birthdate = 1970; or ...
3
votes
0answers
192 views

Plugin for integrating SQLMAP and BURP SUITE

I am trying to do SQL Injection using the SQLMAP Burp Plugin which I downloaded from http://code.google.com/p/gason/downloads/list. I have followed the steps for windows provided in ...
2
votes
0answers
62 views

Bypass an escape function - SQL injection (Educational Purpose) [duplicate]

I am trying to simulate an SQL injection on a VM Apache server. The query I send is being converted into the part of a parameter's value i.e an escape function is restricting me. For example if I ...
1
vote
2answers
182 views

Blind SQL injection: Can you execute a hex string as part of the query?

Sorry in advance if this is a noobish question, but I can't seem to find the right phrasing to get the answer on google or here--I'm pretty new to SQL and am working on a SQLi challenge that is a ...
1
vote
0answers
102 views

How to tell sqlmap to resume an exploit from results-*.csv file?

How to notify SQLMap to resume an exploit from results-*.csv file? Example: ~/.sqlmap/output/results-xxxxxxxxxx.csv Target URL,Place,Parameter,Techniques ...
-1
votes
1answer
43 views

Is this PHP script secure? [closed]

I'm trying to create a secure website. Can someone let me know if this is susceptible to SQL injection? If it is, could you provide me with an exmaple of a statement that would work for injection? ...
6
votes
1answer
301 views

Why would output from sqlmap be trimmed?

I've decided to learn sqlmap but having an issue with Sqlmap trimming some of my output, the hash. The hash is about to be 32 characters long but I'm only getting 25 and the warning: [WARNING] ...
2
votes
1answer
122 views

sql injection: single quote vs double quote

Can someone explain me why this code: $sql='select * from admin where user_name="$user" and password="$pass" ' ; $re = mysql_query($sql); is not vulnerable (payload: "or 1=1-- ) while this ...
-4
votes
1answer
102 views

SQLi : Can I extract a mysql data without knowing column's name?

Here's the vulnerability code: <?php $filtered = "/information|schema|_/i"; #... blahblah $query = "SELECT * FROM user WHERE id='$id' AND pw='$pw';"; // exist hidden column ...
2
votes
1answer
51 views

SOP for SQL Injection Attack

What should (or) how an Incident Handler do (or) follow when an SQL injection attack is reported? Initial Response Analysis Action Aiming to make a procedure guide to follow for myself and my ...
3
votes
1answer
289 views
2
votes
2answers
109 views

Is it possible to do anything against a website with SQL injection that returns 400?

So today at my job I notified a senior programmer that I found an SQL injection at our website. However, when I make an SQL injection, the page just returns 400, so I can't really see any errors or ...
1
vote
1answer
382 views

How to use a Blind SQL-i keyword?

After scanning my website with uniscan I found a few vulnerabilities. I found this answer here and tried but it does not return anything except what it should return. Blind SQL Injection: [+] Vul ...
6
votes
1answer
155 views

Database table name prefixes and security by obscurity

One of the most common pieces of advice with respect to securing WordPress, Magento, and other widely-used pieces of software is to add a prefix to database table names or change the default prefix. ...
1
vote
0answers
72 views

Double Query injection

I'm trying to learn about "Double Query Injections", but in the tutorials they write following the command but without any explanation: (select * from (select count(*), concat(0x3a,0x3a,(select ...
1
vote
1answer
128 views

Why does error-based SQL injection works only with certan fields?

I'm currently investigating the latest vulnerability affecting Joomla CMS. You can find here a description of the vulnerability, however my question is merely on error-based SQL injections and is ...
4
votes
3answers
2k views

Create a page to experiment with SQL injection [closed]

This semester, I have taken a course on Information Security and my project for this course is to implement an SQL injection to obtain admin privileges. For this I first download Havij software ...
1
vote
1answer
239 views

If mysql schema is missing, where can I find credentials?

After finding a sql injection vulnerability I need to provide the more information I can about the DB. Minimum I need to provide a list of users and passwords. I identified that it's a MySQL but ...
2
votes
2answers
9k views

Sqlmap testing HTTP headers

I was wondering whether sqlmap is able to test HTTP headers for SQL vulnerabilities. I know that if I use --level>=3 then it will automatically check for User-Agent and Referrer HTTP headers, but I ...
3
votes
2answers
6k views

How does stored procedure prevents SQL injection?

May be I am not much clear about the stored procedure. Can someone explain me how stored procedure prevents SQL injection with a simple example using MySql.
1
vote
1answer
525 views

How we can Update table via sqlmap?

How we can update a table via sqlmap ? The injection is like this : mysite.com/?menu=-8' UNION ALL SELECT ...
0
votes
1answer
83 views

SQL Injection via table name?

Is it possible to perform SQL injection on a query where the name of the table is passed in as an argument? The user doesn't enter the table name themselves, but it can be inferred through element ...
1
vote
2answers
112 views

Injection/SQL Injection Attacks in Layman Terms

I'm having trouble figuring out what SQL injection attacks are, or in more general terms, what injection attacks are. Most explanations out there on the internets are kinda hard to understand. Could ...
2
votes
0answers
110 views

Is MySQL CONCAT with PDO enough to protect LIKEs from SQL injection?

I'm developing a user-facing, public-accessible website where the user can input an arbitrary, hostile search term. After that, the app must do something conceptually like this against a MySQL db ...
3
votes
1answer
114 views

PL/SQL injection and data exfil

During a pen test I stumbled upon the following error while fuzzing a few parameters: *HTTP Status 500 - org.springframework.jdbc.BadSqlGrammarException: PreparedStatementCallback; bad SQL grammar ...
0
votes
1answer
48 views

Why does the SQL Injection technique INTO OUTFILE sometimes not work? [closed]

Why does the SQL Injection technique INTO OUTFILE sometimes not work? http://example.com/file.php?id=1 union select 1,"<?php system($_REQUEST['cmd'])?>",3,4 INTO OUTFILE " ...
2
votes
3answers
8k views

How to exploit this SQL injection vulnerability?

I am learning SQL injection on a vulnerable web app. I scanned it with w3af. It showed many vulnerabilities. One of them is: SQL injection in a Microsoft SQL database was found at: ...
0
votes
2answers
601 views

SQLMap extracts weird chars in one column

I saw this behaviour many times but I never solved it. Sometimes using sqlmap after retrieving good data from columns it fails retrieving only one of them. I can't figure out why this happens for just ...
-2
votes
2answers
174 views

Is SQL injection still possible after filtering?

I am just reviewing a script I want to use for my website. The author filters all user entered data ($_POST and $_GET) with this function: function XSSCheck($value) { return preg_replace( ...
0
votes
0answers
164 views

Insert Command in SQLMap causes Error

I have tried testing SQL injection using SQLMap using the below query sqlmap -u http://localhost/abc.php?id=1 -D datab --sql-shell When i drop into the SQL shell the following command select * from ...
1
vote
1answer
297 views

SQLMAP : Unable to dump any data

I am working on a black box web application pentesting project for a client and while testing found an error-based SQL injection. I went on to exploit it using SQLMAP, I retrieved the Database names, ...
7
votes
4answers
14k views

How to get the output of a SQL injection?

This is just for learning purpose. I want to get all the usernames and passwords from a table in a MySQL server, where "magic quotes" have been disable. In the input for the username: I put something ...
2
votes
2answers
6k views

SqlMap bypasses OWASP ModSecurity Core Rule Set for SQL Injection

I am trying to perform a simple penetration test on the DVWA (the web application that has been specifically designed to be vulnerable to some of the most common web application attacks). I want to ...
2
votes
1answer
5k views

Manual Testing and Exploitation of an SQL Injection

So I read over this, this and this. I understand WHAT an sql injection is and the different TYPES of sql. But none of these guides give a definitive example on how to find, enumerate and exploit the ...
0
votes
0answers
38 views

How to protect against SQL Injection in Jaggeryjs?

I am working with Jaggeryjs now which is a server side JavaScript like Nodejs. When I tried the example mentioned in the documentation, They have provided simple example just like Statement in Java. ...
2
votes
0answers
127 views

Obtaining large data sets for research: MySQL, PHP, Apache, etc

I have been looking around the web for large data sets (specifically web related log files - MySQL, PHP, Apache, and so on) that contains data of attempted intrusions/exploits. I am doing some ...
-1
votes
1answer
215 views

Does the 'Relational' Foundation of Database Theory enable 'Ashley Madison'-like attacks?

Again and again hackers use SQL injection to get information from the backend database. Is it fair to say because a relational database by its nature has all the links within the data sets (e.g., ...
15
votes
4answers
15k views

What type of attacks can be used vs MongoDB?

I'm starting to learn MongoDB and was curious if it was susceptible to some type of injection attack similar to SQLi. Due to the nature of the DB, I don't think you can inject into it but... What ...
9
votes
4answers
9k views

Testing clean urls with sqlmap

Is it possible to test for SQL injection vulnerabilities with using sqlmap with a url that is using mod rewrite (or something like it) to make the urls clean? I know how to test my sites that have ...
3
votes
1answer
71 views

Understanding how openx cache was infected

I have a system that uses openx for serving banners. I have recently noticed that several cache file in /var/cache contain infected code. The code contains sql queries that create several php files in ...
-3
votes
1answer
164 views

{PHP} SQL Injection [duplicate]

Please note: this isn't a duplicate!!! Why? You can use ' but You don't know how :) I have this PHP code: <?php (...) function escape($str) { $ret = ''; for($i=0;@$str[$i];$i++) { ...
0
votes
1answer
60 views

Examples of in-band signalling hacks? [closed]

In-band signalling or the mixing of control and metadata on the same channel is what allowed the early phone phreakers to obtain free calls on telecommunications systems. By sending control tones ...
44
votes
2answers
7k views

Is this an attempted SQL injection?

Looking through error logs I found lots of requests to a web-app where the URL contains: ...
1
vote
1answer
410 views

Oracle Sql Injection Reverse Shell [closed]

I am testing for SQL Injection on a website that uses ASP code. I can successfully get all the databases and tables. Current user has DBA privileges. I wonder how can I get a reverse shell by using ...
1
vote
1answer
143 views

SQL Injection from Data Import Files

We process a lot of batch files and do an initial batch file import via the LOAD DATA LOCAL INFILE call in MySQL. Is there a tool / standard out there that can scan or help to mitigate SQL injection ...
0
votes
1answer
151 views

How to Perform SQL insert or update command using SQL injection

I have a URL http://localhost/usernfo.php?id=8 on which SQL injection can be performed. How can I perform an Update, Insert or Delete command from this link after I have got the structure of the ...