SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database.

learn more… | top users | synonyms

0
votes
2answers
248 views

What kind of attack is this?

This past week, my traffic logs are showing many hits (usually with repeated tries) for a URL from perhaps 30+ different IP addresses all over the world. This is not a URL that should garner more than ...
0
votes
3answers
374 views

String sql injection vs sql injection

What's the difference between normal sql injection and string based sql injection? An example would be appreciated. As far as I understand from the few readings around the net, string based sql ...
1
vote
1answer
377 views

Recognize site vulnerable for SQL injection

Although I understand the concept of a SQL injection and have done simple exploits (simple hack challenge sites and stuff) I'm wondering if one of the site run by my employer is vulnerable. Unlike ...
0
votes
2answers
836 views

sqlmap: testing javascript or json parameters

I have a parameter in a POST request which is in the following format: ParamName= < r username="123" password="456" x="" y=""/> and I want to test username and password which are two HTML ...
1
vote
0answers
188 views

MSSQL injection convert syntax error

I just setup a test bed and i disabled information_schema from being accessed (a weak waf) and i've been trying to extract the table list from the database by using convert to spit out a conversion ...
0
votes
1answer
94 views

MSSQL injection help [closed]

If information_schema is not allowed in MSSQL , what is another method i can use to list the tables inside a database and ultimately the columns so i can dump them without using information_schema? ...
-1
votes
1answer
87 views

True/false statements in MSSQL without < > and = [closed]

How can i make a true/false statements in MSSQL without the following symbols: <,>,= ? Everything i can think of, e.g: or 1=1-- (true) or 1>1 (false) and 2<>3 (true) Makes use of ...
7
votes
2answers
332 views

How can this input-sanitizer function be defeated?

There's a Classic ASP application at my job that is (I believe) highly vulnerable to SQL injection. I want to prove to management that this code isn't secure, but all I'm able to do is insert "SQLINJ" ...
0
votes
1answer
237 views

Is ASP.net More Secure than PHP in GENERAL? [closed]

In other words, my (long version) question is: Are developers able to get away with, more using ASP.net than PHP in terms of writing secure code for their apps? I ask this because ASP.net has many ...
4
votes
1answer
185 views

Weird condition in blind SQL injection point, substr() is valid for exactly two chars

I'm exploiting a blind SQL injection point, which takes a variable as username then check if the username exists in a table. (It's running MySQL 5.X with PHP) So I'm using this to retrieve all ...
0
votes
2answers
131 views

Any residual effects after SQLMAP has been run?

Some time ago, penetration testing was done on our website, and one of the tools used was SQLMap It was executed by a security consultancy, but unfortunately they did not notify us beforehand. So, ...
1
vote
1answer
71 views

Base Programming for vulnerabilities

Hello, I am a beginner looking for some information. My question is the following: In order to understand certain security concepts is it essential that I understand the underlying languages? For ...
2
votes
2answers
136 views

Is sqlmap tracable?

The question is simple. For example, we access a database of any website. And looked up for datas. So, is the website owner can see me? If he/she can see, how can i protect? [These are for security ...
0
votes
1answer
63 views

How can we get the second id for sqlmap [closed]

I'm trying to find some vulnerable points in my website. My website like, www.example.com/index.php?menu_id=1002&news_id=5. When i trying to find these points with sql map, it tries for menu id. ...
0
votes
1answer
94 views

Sql Injection - Possible exploitations on a real case [duplicate]

This is a snippet of a PHP script: $useragent = isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : NULL; $query = "SELECT `id` FROM `browser` WHERE name = '".$useragent."' LIMIT ...
1
vote
1answer
68 views

Am I right by changing the default algorithm on a web app?

Numerous clients have told me that my suggestion on changing the algorithm on a web app does not increase security. I've tried reasoning that if the files have not been exposed, the attacker has to ...
-3
votes
1answer
649 views

Wordpress - cleartext admin credentials disclosure

I am testing my own wordpress blog against security issues with wpscan. Honestly I have never done that before and was shocked after I saw the result. One vulnerability of my wordpress site is: [+] ...
0
votes
1answer
93 views

Can a sql query with both user input and parameter be prone to sql injection?

I've stumbled over some code in an application where (certain) users are allowed to input where conditions. In addition to this there is a part of the where condition that is set as a parameterized ...
3
votes
1answer
266 views

is 'mysql_real_escape_string' enough

Recently on stackoverflow I've seen many discussions that mysql_*_escape_string is deprecated and instead recommending PDO. The way I've been doing it was to allow only letters and ' in the name field ...
0
votes
1answer
198 views

Are cross site scripting attacks and sql injection a good topic for my thesis? [closed]

So I'm doing my undergraduate thesis, I would like to explore how cross site scripting sql injections occur. And for the purpose of the thesis I'd also like to create a fictional website that is ...
2
votes
2answers
316 views

What hacking risks a site has if it has no input boxes?

I recently posted a question about recovery of website from XSS attacks, http://stackoverflow.com/questions/20759081/how-to-recover-a-site-after-an-xss-attack... Doing a bit more digging online, i ...
3
votes
2answers
420 views

Regarding SQL Injection at Back End?

I have logged into SQL Server 2008 Database and executed following query: select * from USER_Main_INFO_Name where userid ='' or 'x'='x' After executing the query Database has given total user list. ...
3
votes
4answers
186 views

Are these SQL injection checks a bad idea?

Reading Preventing SQL Injection Attacks in Stored Procedures started this debate between my partner and I---and looking for the right approach is not as straight forward. I'm no security expert--but ...
1
vote
2answers
320 views

How a database connection makes mysqli_real_escape_string more secure?

I am learning PHP+MySQL and observed that mysqli_real_escape_string function in PHP requires a identifier to a MySQL connection. From some research I found that it has something to do with charset and ...
2
votes
3answers
2k views

Regarding SQL Inject me Firefox add-on?

Using SQL Inject Me Firefox add-on,I have selected the check-boxes then click on Execute button of SQL Inject Me tool. After getting result, it has displayed following responses Server Status Code: ...
1
vote
3answers
227 views

What is best method for retest blind sql vulnerability

I tested web site application with commercial automated tool.There are some blind sql injection.I want to retest this results .Is there any good method for test blind sql injection with tool or ...
1
vote
1answer
1k views

Sqlmap - appears to be UNION injectable

I am using sqlmap for finding out sql-injection threat on our application. So, here is my url : " http://myurl.net/question/teaching/answer/sujan-justice?as=Course ", and i tried to perform the ...
0
votes
1answer
656 views

Using timeouts to automatically detect blind sql injection exploits

I'm working on a penetration testing tool, and I have error-based sql injection pretty much covered, but I was wondering, is it possible to use timeouts, along with built in sql commands to detect an ...
3
votes
1answer
331 views

Why does MySQLi using question marks (?) instead of the sprintf formatting?

As the title states, why does MySQLi use question marks instead of sprintf() formatting? For example, why is it $stmt = $mysqli->prepare("SELECT * FROM table WHERE column1 = ?"); ...
-1
votes
1answer
346 views

Open Source tool for analysing javascript for security vulnerabilities [closed]

I am completely new to this field and am a college student. I am looking for a static code analysis tool that scans the source code of a web app ( NOT the URL) for security vulnerabilities. So far i ...
2
votes
2answers
1k views

Is $_REQUEST['id'] vulnerable to sql injection

I have the code below in my newsview.php.I want to know why the code below vulnerable to sql injection.I already test the sql injection in the code below. $id = intval($_REQUEST['id']); $result = ...
1
vote
2answers
5k views

Uploading Shell Using SQLI

I found an SQL injection vulnerability in a Wordpress installation inside one of my lab machines and I am trying to leverage it to upload a shell. I can get the admin hash but it seems that it is ...
2
votes
1answer
1k views

How to use sqlmap to perform SQL injection on a clean URL?

I am learning to use sqlmap and came across an application that has Clean URLs. Clean URL example //my url.net/project/public/#questions/question/edit/id/122/answer/1, here MVC framework is used. ...
-2
votes
2answers
799 views

Is this site vulnerable to sql injection? [closed]

I have my site build from a company. I read about website vulnerabilities on the internet and i did some test on my site. It throws these errors. QueryString key:TutorialId was expected to be of ...
10
votes
1answer
1k views

How is time-based SQL injection different from other types of SQL injection?

I understand what a time-based SQL injection is, and I understand how it works (at least how it's detected/exploited). However, is there anything in specific which makes this type of injection any ...
6
votes
2answers
254 views

SQL injection across multiple tables

If a website has multiple web apps, each of them connected to different tables in a database and all of the apps are protected from SQL Injection except one; can that one web app be used to ...
1
vote
4answers
4k views

SQL injection with “INSERT” statement

I am currently studying the most basic SQL injections that are possible. Pure and solely for the purpose of teaching myself the basics before advancing to more advanced ones. I am recreating this ...
1
vote
2answers
5k views

sqlmap unable to find SQL injection vulnerablitity

so i just started up with sqlmap to learn sql injection vulnerability on my application. Here I followed steps as per some tutorials. So this are the steps which i followed : sqlmap.py -u ...
5
votes
4answers
3k views

How to get the output of a SQL injection?

This is just for learning purpose. I want to get all the usernames and passwords from a table in a MySQL server, where "magic quotes" have been disable. In the input for the username: I put something ...
2
votes
0answers
331 views

how to prevent ASCII Encoded / Binary String SQL injection in Codeigniter

I am using CodeIgniter for two years and I am digging into penetration testing nowadays. I think that ActiveRecord does good job for preventing sql injections, but i have following questions: I want ...
13
votes
3answers
3k views

Is it possible to do SQL injection (HIGH Level) on Damn Vulnerable Web App?

I searched all over google to see how it would be possible to bypass the following (it's from the high level of security from DVWA): <?php if (isset($_GET['Submit'])) { // Retrieve data $id ...
0
votes
1answer
260 views

What are the reasons this SQL injection code wouldn't work? [duplicate]

In Software Assurance class I was asked a question why following query allows SQL injection which will allow log in into unsafe phpBB version but will not allow any modification of the database. We ...
3
votes
3answers
797 views

MySQL SQL injection without stacked queries - what is actually possible without affecting the FS?

I am exploring a vulnerability in one PHP website that is basically riddled with SQL injections. With SQLMap, I managed to dump all the tables and get some basic information (username, DB name, ...
2
votes
4answers
2k views

SQL Injection with pass MD5

I want to know, if in my login form there is any SQL injection possible. If there is, what could the exploit's web form entry look like? I send username and password by html form (POST). The login ...
2
votes
2answers
308 views

How to get URL behind REST-style

I've asked same question on StackOverflow but topic passed away with no answers except few comments so I'll try to ask the same question here as it's probably more specific to security. The only ...
1
vote
3answers
283 views

Vulnerability scanner shows SQL errors were disclosed.How Severe it is?

When I scanned my site for Vulnerabilities I found this error. Various SQL errors were disclosed within the application source code or other files. I have checked for sql injection and confirmed ...
0
votes
1answer
329 views

SQLMap extracts weird chars in one column

I saw this behaviour many times but I never solved it. Sometimes using sqlmap after retrieving good data from columns it fails retrieving only one of them. I can't figure out why this happens for just ...
1
vote
2answers
785 views

CGI generic sql injection

I was scanning a site with Nessus when the following vulnerability was reported: CGI Generic SQL Injection Nessus says that: "An attacker may exploit this flaw to bypass authentication, ...
1
vote
2answers
900 views

Getting a SQL injection past a given regex [duplicate]

I have been shown one regex which, per the one who wrote it, should protect against SQL injections on SQL server 2008. It doesn't really look like it, but I'm wondering exactly what code I can get ...
3
votes
1answer
613 views

SQLMap: How to test JavaScript generated field names?

I have a pretty simple HTML page that submits a username and password to the server via POST method: <doctype html> <head> <title>SQLMap dynamic parameters</title> ...