SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database.

learn more… | top users | synonyms

1
vote
1answer
68 views

Am I right by changing the default algorithm on a web app?

Numerous clients have told me that my suggestion on changing the algorithm on a web app does not increase security. I've tried reasoning that if the files have not been exposed, the attacker has to ...
-3
votes
1answer
617 views

Wordpress - cleartext admin credentials disclosure

I am testing my own wordpress blog against security issues with wpscan. Honestly I have never done that before and was shocked after I saw the result. One vulnerability of my wordpress site is: [+] ...
0
votes
1answer
89 views

Can a sql query with both user input and parameter be prone to sql injection?

I've stumbled over some code in an application where (certain) users are allowed to input where conditions. In addition to this there is a part of the where condition that is set as a parameterized ...
3
votes
1answer
248 views

is 'mysql_real_escape_string' enough

Recently on stackoverflow I've seen many discussions that mysql_*_escape_string is deprecated and instead recommending PDO. The way I've been doing it was to allow only letters and ' in the name field ...
0
votes
1answer
193 views

Are cross site scripting attacks and sql injection a good topic for my thesis? [closed]

So I'm doing my undergraduate thesis, I would like to explore how cross site scripting sql injections occur. And for the purpose of the thesis I'd also like to create a fictional website that is ...
2
votes
2answers
282 views

What hacking risks a site has if it has no input boxes?

I recently posted a question about recovery of website from XSS attacks, http://stackoverflow.com/questions/20759081/how-to-recover-a-site-after-an-xss-attack... Doing a bit more digging online, i ...
3
votes
2answers
406 views

Regarding SQL Injection at Back End?

I have logged into SQL Server 2008 Database and executed following query: select * from USER_Main_INFO_Name where userid ='' or 'x'='x' After executing the query Database has given total user list. ...
3
votes
4answers
165 views

Are these SQL injection checks a bad idea?

Reading Preventing SQL Injection Attacks in Stored Procedures started this debate between my partner and I---and looking for the right approach is not as straight forward. I'm no security expert--but ...
1
vote
2answers
303 views

How a database connection makes mysqli_real_escape_string more secure?

I am learning PHP+MySQL and observed that mysqli_real_escape_string function in PHP requires a identifier to a MySQL connection. From some research I found that it has something to do with charset and ...
2
votes
3answers
1k views

Regarding SQL Inject me Firefox add-on?

Using SQL Inject Me Firefox add-on,I have selected the check-boxes then click on Execute button of SQL Inject Me tool. After getting result, it has displayed following responses Server Status Code: ...
1
vote
3answers
209 views

What is best method for retest blind sql vulnerability

I tested web site application with commercial automated tool.There are some blind sql injection.I want to retest this results .Is there any good method for test blind sql injection with tool or ...
1
vote
1answer
1k views

Sqlmap - appears to be UNION injectable

I am using sqlmap for finding out sql-injection threat on our application. So, here is my url : " http://myurl.net/question/teaching/answer/sujan-justice?as=Course ", and i tried to perform the ...
0
votes
1answer
459 views

Using timeouts to automatically detect blind sql injection exploits

I'm working on a penetration testing tool, and I have error-based sql injection pretty much covered, but I was wondering, is it possible to use timeouts, along with built in sql commands to detect an ...
3
votes
1answer
297 views

Why does MySQLi using question marks (?) instead of the sprintf formatting?

As the title states, why does MySQLi use question marks instead of sprintf() formatting? For example, why is it $stmt = $mysqli->prepare("SELECT * FROM table WHERE column1 = ?"); ...
-1
votes
1answer
319 views

Open Source tool for analysing javascript for security vulnerabilities [closed]

I am completely new to this field and am a college student. I am looking for a static code analysis tool that scans the source code of a web app ( NOT the URL) for security vulnerabilities. So far i ...
2
votes
2answers
1k views

Is $_REQUEST['id'] vulnerable to sql injection

I have the code below in my newsview.php.I want to know why the code below vulnerable to sql injection.I already test the sql injection in the code below. $id = intval($_REQUEST['id']); $result = ...
1
vote
2answers
4k views

Uploading Shell Using SQLI

I found an SQL injection vulnerability in a Wordpress installation inside one of my lab machines and I am trying to leverage it to upload a shell. I can get the admin hash but it seems that it is ...
2
votes
1answer
1k views

How to use sqlmap to perform SQL injection on a clean URL?

I am learning to use sqlmap and came across an application that has Clean URLs. Clean URL example //my url.net/project/public/#questions/question/edit/id/122/answer/1, here MVC framework is used. ...
-2
votes
2answers
764 views

Is this site vulnerable to sql injection? [closed]

I have my site build from a company. I read about website vulnerabilities on the internet and i did some test on my site. It throws these errors. QueryString key:TutorialId was expected to be of ...
10
votes
1answer
984 views

How is time-based SQL injection different from other types of SQL injection?

I understand what a time-based SQL injection is, and I understand how it works (at least how it's detected/exploited). However, is there anything in specific which makes this type of injection any ...
6
votes
2answers
250 views

SQL injection across multiple tables

If a website has multiple web apps, each of them connected to different tables in a database and all of the apps are protected from SQL Injection except one; can that one web app be used to ...
1
vote
4answers
3k views

SQL injection with “INSERT” statement

I am currently studying the most basic SQL injections that are possible. Pure and solely for the purpose of teaching myself the basics before advancing to more advanced ones. I am recreating this ...
1
vote
2answers
4k views

sqlmap unable to find SQL injection vulnerablitity

so i just started up with sqlmap to learn sql injection vulnerability on my application. Here I followed steps as per some tutorials. So this are the steps which i followed : sqlmap.py -u ...
5
votes
4answers
2k views

How to get the output of a SQL injection?

This is just for learning purpose. I want to get all the usernames and passwords from a table in a MySQL server, where "magic quotes" have been disable. In the input for the username: I put something ...
2
votes
0answers
311 views

how to prevent ASCII Encoded / Binary String SQL injection in Codeigniter

I am using CodeIgniter for two years and I am digging into penetration testing nowadays. I think that ActiveRecord does good job for preventing sql injections, but i have following questions: I want ...
13
votes
3answers
3k views

Is it possible to do SQL injection (HIGH Level) on Damn Vulnerable Web App?

I searched all over google to see how it would be possible to bypass the following (it's from the high level of security from DVWA): <?php if (isset($_GET['Submit'])) { // Retrieve data $id ...
0
votes
1answer
252 views

What are the reasons this SQL injection code wouldn't work? [duplicate]

In Software Assurance class I was asked a question why following query allows SQL injection which will allow log in into unsafe phpBB version but will not allow any modification of the database. We ...
3
votes
3answers
659 views

MySQL SQL injection without stacked queries - what is actually possible without affecting the FS?

I am exploring a vulnerability in one PHP website that is basically riddled with SQL injections. With SQLMap, I managed to dump all the tables and get some basic information (username, DB name, ...
2
votes
4answers
2k views

SQL Injection with pass MD5

I want to know, if in my login form there is any SQL injection possible. If there is, what could the exploit's web form entry look like? I send username and password by html form (POST). The login ...
2
votes
2answers
295 views

How to get URL behind REST-style

I've asked same question on StackOverflow but topic passed away with no answers except few comments so I'll try to ask the same question here as it's probably more specific to security. The only ...
1
vote
3answers
279 views

Vulnerability scanner shows SQL errors were disclosed.How Severe it is?

When I scanned my site for Vulnerabilities I found this error. Various SQL errors were disclosed within the application source code or other files. I have checked for sql injection and confirmed ...
0
votes
1answer
295 views

SQLMap extracts weird chars in one column

I saw this behaviour many times but I never solved it. Sometimes using sqlmap after retrieving good data from columns it fails retrieving only one of them. I can't figure out why this happens for just ...
1
vote
2answers
625 views

CGI generic sql injection

I was scanning a site with Nessus when the following vulnerability was reported: CGI Generic SQL Injection Nessus says that: "An attacker may exploit this flaw to bypass authentication, ...
1
vote
2answers
803 views

Getting a SQL injection past a given regex [duplicate]

I have been shown one regex which, per the one who wrote it, should protect against SQL injections on SQL server 2008. It doesn't really look like it, but I'm wondering exactly what code I can get ...
3
votes
1answer
557 views

SQLMap: How to test JavaScript generated field names?

I have a pretty simple HTML page that submits a username and password to the server via POST method: <doctype html> <head> <title>SQLMap dynamic parameters</title> ...
0
votes
2answers
154 views

Is there an open source runtime enforcement tool?

I have been looking for open source runtime enforcement tools that I can use my own policies to prevent input validation vulnerabilities, in web applications. The web applications that I want to ...
2
votes
1answer
99 views

Ethical approach about corporate website and vulnerabilities [closed]

I like web security and i have academic formation about that. Just for fun I found a website (insurance company) with critical vulnerabilities like xss or sql injection. Now, I obviously will alert ...
3
votes
2answers
800 views

ASP.NET SQL Injection

I have custom authentication system on my ASP.NET website that can help me to register users from my Windows (Desktop) and mobile (Android) Applications.It means that I don't use ASP.NET ...
4
votes
6answers
6k views

Are there any tools for scanning for SQL injection vulnerabilities while logged in?

Some pages of my website were vulnerable to SQL injection. The injection worked only when the user was logged in. I have now fixed this problem, and now I want to make sure that no similar problems ...
7
votes
4answers
1k views

How to white hat Pen Test SQL injection

I will start off with saying apologies if this is something that has been asked 100s of times or is moot question within testing circles. I have come across this article I'd like to test this out ...
2
votes
1answer
838 views

How to save the random salt to the database

As I understand it, salting and hashing passwords is the way to go. I also understand that to authenticate a salted and hashed password, the random salt needs to be saved. Does this mean that if I use ...
1
vote
1answer
446 views

“ScriptResource.axd” vulnerability in Windows Server 2008

I am using Windows Server 2008, Plesk 9.5, IIS 7, SQL Server 2008, and recently I have received and email claiming this server is vulnerable, and sent me the following URL: ...
2
votes
3answers
242 views

Is + as an alternative to %20 an attack vector?

I was reading a Q&A on enabling + characters in URLs for Sitecore CMS, and the answer states: ASPNET application does not allow using “+” from the security point of view e.g. preventing SQL or ...
2
votes
2answers
1k views

Sqlmap and multipart/form-data forms

I'm working on some security for a website that is built in classic ASP and MS SQL 2000. I've successfully found a couple of flawed forms that allowed SQL injections through the form fields by using ...
2
votes
2answers
419 views

Suspicious entries in MySQL database from user input forms - sql injection?

I built a website from scratch using PHP and MySQL for my residential community and our budget is a big fat '0'. Five days ago I discovered that there were 222 entries in a table in my database that ...
3
votes
3answers
899 views

SQL injection using letters and numbers?

I was wondering if it is at all possible for a hacker to perform an SQL injection attack using just letters and numbers. For example, let's take a look at this PHP code which uses regular expressions ...
1
vote
2answers
720 views

How to deal with MySQL's Errcode 13 when trying to write a shell

My attack machine is running Kali and the server is running CentOS 6.4 with DVWA. I'm trying to write a shell through an SQL injection. The payload is ' UNION SELECT '', '<?PHP ...
1
vote
2answers
1k views

How to detect and exploit an SQLi in a POST method

Making it simple (no security at all), when we want to detect whether or not a GET parameter is vulnerable to SQLi, we could just type a ' as the value (?id=') and check if there is any error. (No ...
2
votes
2answers
883 views

Sqlmap fails at enabling xp_cmdshell procedure

I have been browsing the web looking for some help regarding the following issue. I am currently performing an web application penetration test, and I had come accross a beautiful blind SQL Injection. ...
1
vote
3answers
3k views

No single quotes is allowed, Is this SQL Injection point still exploitable?

The SQL phrase looks like this, "SELECT * from XX where id = '" + id + "'" The id variable comes directly from the GET parameter named id. And the Java web app explicitly disallowed single quote. ...