SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database.

learn more… | top users | synonyms

8
votes
2answers
116 views

Response to unauthorized scan by legit company? [closed]

On Christmas day, our web service came under an apparent attack and we responded by blocking the (single) source IP. Upon later investigation, it turns out the 'attack' was actually an intense ...
3
votes
2answers
73 views

Presence of table “sqlmapoutput” in PostgreSQL database

I was pentesting a client's database and saw this one table "sqlmapoutput" in one of the user created schemas. It's a PostgreSQL DBMS. and he has no idea how it came there. There was no data in the ...
3
votes
0answers
360 views

SQL security - ACID transactions and locking to prevent financial fraud (timing attack?) [closed]

I am trying to prevent something similar to this from happening: http://hackingdistributed.com/2014/04/06/another-one-bites-the-dust-flexcoin/ Basically the financial exchange was using non-ACID ...
3
votes
1answer
379 views

SQL Injection - login bypass [closed]

Background information: SQL Injection as a school task. Login bypass. Given two input fields name and password. Confirm via solve button. Info on what I have and was able to find out: it is ...
1
vote
1answer
90 views

Can SQL test by using SqlMap tool harm a website?

I am just learning about SQL injection attack, and I want to test this by using sqlmap on my own website.However I wonder if the attack can cause any harm on my website's services during the attack? ...
5
votes
1answer
134 views

sqlmap HTTP 405 error on a vulnerable POST parameter

For academical purposes I need to explode a blind sql injection on a form paramater which is sent using the POST method. The form is very simple, it just has an input text box where to introduce the ...
16
votes
3answers
2k views

How to defeat doubling up apostrophes to create SQLi attack?

I know some developers double up apostrophes to mitigate SQLi. (This is when the input is ' so it becomes '') Is there a way to beat this? This is on MS SQl Server.
3
votes
0answers
227 views

Plugin for integrating SQLMAP and BURP SUITE

I am trying to do SQL Injection using the SQLMAP Burp Plugin which I downloaded from http://code.google.com/p/gason/downloads/list. I have followed the steps for windows provided in ...
2
votes
0answers
62 views

Bypass an escape function - SQL injection (Educational Purpose) [duplicate]

I am trying to simulate an SQL injection on a VM Apache server. The query I send is being converted into the part of a parameter's value i.e an escape function is restricting me. For example if I ...
1
vote
2answers
214 views

Blind SQL injection: Can you execute a hex string as part of the query?

Sorry in advance if this is a noobish question, but I can't seem to find the right phrasing to get the answer on google or here--I'm pretty new to SQL and am working on a SQLi challenge that is a ...
1
vote
0answers
155 views

How to tell sqlmap to resume an exploit from results-*.csv file?

How to notify SQLMap to resume an exploit from results-*.csv file? Example: ~/.sqlmap/output/results-xxxxxxxxxx.csv Target URL,Place,Parameter,Techniques ...
-1
votes
1answer
44 views

Is this PHP script secure? [closed]

I'm trying to create a secure website. Can someone let me know if this is susceptible to SQL injection? If it is, could you provide me with an exmaple of a statement that would work for injection? ...
2
votes
1answer
126 views

sql injection: single quote vs double quote

Can someone explain me why this code: $sql='select * from admin where user_name="$user" and password="$pass" ' ; $re = mysql_query($sql); is not vulnerable (payload: "or 1=1-- ) while this ...
-4
votes
1answer
110 views

SQLi : Can I extract a mysql data without knowing column's name?

Here's the vulnerability code: <?php $filtered = "/information|schema|_/i"; #... blahblah $query = "SELECT * FROM user WHERE id='$id' AND pw='$pw';"; // exist hidden column ...
2
votes
1answer
56 views

SOP for SQL Injection Attack

What should (or) how an Incident Handler do (or) follow when an SQL injection attack is reported? Initial Response Analysis Action Aiming to make a procedure guide to follow for myself and my ...
3
votes
1answer
296 views

Google crawling and SQL injection

recently my logs shows attack signatures from ...
2
votes
2answers
111 views

Is it possible to do anything against a website with SQL injection that returns 400?

So today at my job I notified a senior programmer that I found an SQL injection at our website. However, when I make an SQL injection, the page just returns 400, so I can't really see any errors or ...
2
votes
2answers
537 views

SQLMap: How to dump tables that begin with a specific letter?

I would like to know the command of SQLMap, which permits me to retreive just tables that begin with a special letter. Example with letter "T": sqlmap.py -u www.website -D database -T tables (...)
6
votes
1answer
164 views

Database table name prefixes and security by obscurity

One of the most common pieces of advice with respect to securing WordPress, Magento, and other widely-used pieces of software is to add a prefix to database table names or change the default prefix. ...
1
vote
0answers
74 views

Double Query injection

I'm trying to learn about "Double Query Injections", but in the tutorials they write following the command but without any explanation: (select * from (select count(*), concat(0x3a,0x3a,(select ...
1
vote
1answer
133 views

Why does error-based SQL injection works only with certan fields?

I'm currently investigating the latest vulnerability affecting Joomla CMS. You can find here a description of the vulnerability, however my question is merely on error-based SQL injections and is ...
5
votes
1answer
243 views

SQLmap injection not working, manually it works fine

I have built a vulnerable web application to demonstrate SQL injection. I want to show both manual injection and automated injection. The injection requires a) the user to be logged in (session ...
5
votes
2answers
322 views

SQL Injection query error with backslash

I have a sql injection vulnerable site which works well if i input query like this qq' -- // or qq' -- ; . But when i inject without slash or semi-colon it throws following error "You have an error in ...
3
votes
1answer
316 views

SQLMAP and DBMS credentials, how do you use them?

for educational purposes and in order to develop a test for students, i try to "hack" a website developped by a friend : http://www.websitetohack.com.index.php?id=5 When i launch SQLMAP, it finds a ...
1
vote
1answer
664 views

How we can Update table via sqlmap?

How we can update a table via sqlmap ? The injection is like this : mysite.com/?menu=-8' UNION ALL SELECT ...
0
votes
1answer
88 views

SQL Injection via table name?

Is it possible to perform SQL injection on a query where the name of the table is passed in as an argument? The user doesn't enter the table name themselves, but it can be inferred through element ...
1
vote
2answers
117 views

Injection/SQL Injection Attacks in Layman Terms

I'm having trouble figuring out what SQL injection attacks are, or in more general terms, what injection attacks are. Most explanations out there on the internets are kinda hard to understand. Could ...
2
votes
0answers
124 views

Is MySQL CONCAT with PDO enough to protect LIKEs from SQL injection?

I'm developing a user-facing, public-accessible website where the user can input an arbitrary, hostile search term. After that, the app must do something conceptually like this against a MySQL db ...
3
votes
1answer
124 views

PL/SQL injection and data exfil

During a pen test I stumbled upon the following error while fuzzing a few parameters: *HTTP Status 500 - org.springframework.jdbc.BadSqlGrammarException: PreparedStatementCallback; bad SQL grammar ...
0
votes
1answer
50 views

Why does the SQL Injection technique INTO OUTFILE sometimes not work? [closed]

Why does the SQL Injection technique INTO OUTFILE sometimes not work? http://example.com/file.php?id=1 union select 1,"<?php system($_REQUEST['cmd'])?>",3,4 INTO OUTFILE " ...
-2
votes
2answers
184 views

Is SQL injection still possible after filtering?

I am just reviewing a script I want to use for my website. The author filters all user entered data ($_POST and $_GET) with this function: function XSSCheck($value) { return preg_replace( ...
0
votes
0answers
187 views

Insert Command in SQLMap causes Error

I have tried testing SQL injection using SQLMap using the below query sqlmap -u http://localhost/abc.php?id=1 -D datab --sql-shell When i drop into the SQL shell the following command select * from ...
1
vote
1answer
326 views

SQLMAP : Unable to dump any data

I am working on a black box web application pentesting project for a client and while testing found an error-based SQL injection. I went on to exploit it using SQLMAP, I retrieved the Database names, ...
0
votes
0answers
39 views

How to protect against SQL Injection in Jaggeryjs?

I am working with Jaggeryjs now which is a server side JavaScript like Nodejs. When I tried the example mentioned in the documentation, They have provided simple example just like Statement in Java. ...
-1
votes
1answer
218 views

Does the 'Relational' Foundation of Database Theory enable 'Ashley Madison'-like attacks?

Again and again hackers use SQL injection to get information from the backend database. Is it fair to say because a relational database by its nature has all the links within the data sets (e.g., ...
0
votes
1answer
64 views

Examples of in-band signalling hacks? [closed]

In-band signalling or the mixing of control and metadata on the same channel is what allowed the early phone phreakers to obtain free calls on telecommunications systems. By sending control tones ...
-3
votes
1answer
165 views

{PHP} SQL Injection [duplicate]

Please note: this isn't a duplicate!!! Why? You can use ' but You don't know how :) I have this PHP code: <?php (...) function escape($str) { $ret = ''; for($i=0;@$str[$i];$i++) { ...
44
votes
2answers
7k views

Is this an attempted SQL injection?

Looking through error logs I found lots of requests to a web-app where the URL contains: ...
1
vote
1answer
465 views

Oracle Sql Injection Reverse Shell [closed]

I am testing for SQL Injection on a website that uses ASP code. I can successfully get all the databases and tables. Current user has DBA privileges. I wonder how can I get a reverse shell by using ...
1
vote
1answer
150 views

SQL Injection from Data Import Files

We process a lot of batch files and do an initial batch file import via the LOAD DATA LOCAL INFILE call in MySQL. Is there a tool / standard out there that can scan or help to mitigate SQL injection ...
0
votes
1answer
151 views

How to Perform SQL insert or update command using SQL injection

I have a URL http://localhost/usernfo.php?id=8 on which SQL injection can be performed. How can I perform an Update, Insert or Delete command from this link after I have got the structure of the ...
0
votes
1answer
198 views

Securing SQL injection for my PHP files [closed]

I have made a PHP forum. I used PDO, as well as SQLi. When I did a security scan of my website, it found errors, and after a long time of trying different stuff, I can't fix them. Points to whomever ...
1
vote
1answer
320 views

Why does SQL not escape/sanitize by default?

First, since there is no SQL stackexchange I am not sure where the best place to ask this question is (I debated between here and programmers.stackexchange). If this is the wrong place, please move ...
1
vote
2answers
139 views

how should I protect url parameter in JPQL query for reset password flow

I am implementing a web app with reset password flow. Here is what I've done to try to make it secure. Put in the email address in forgotten password form. Regardless of whether the customer exists, ...
3
votes
0answers
134 views

Obtaining large data sets for research: MySQL, PHP, Apache, etc

I have been looking around the web for large data sets (specifically web related log files - MySQL, PHP, Apache, and so on) that contains data of attempted intrusions/exploits. I am doing some ...
3
votes
3answers
167 views

SQL Injection - Find SQL platform

Is there any query that I can use to know which SQL platform a website is using ? ( Oracle - MySQL - MSSQL - PostgreSQL - Ingres.... )
6
votes
1answer
316 views

Why would output from sqlmap be trimmed?

I've decided to learn sqlmap but having an issue with Sqlmap trimming some of my output, the hash. The hash is about to be 32 characters long but I'm only getting 25 and the warning: [WARNING] ...
-2
votes
2answers
69 views

Exploiting SQL injection union base [closed]

A PHP website ends with php?id=1 and when I place a tic it prints this error: Warning: mysql_fetch_array(): supplied argument is not a valid MySQL result resource in ...
1
vote
0answers
17 views

Help with Error-Based SQL Injection [duplicate]

Like the guy in this thread : Error-based SQL injection I understand the idea behing SQL Error-Based Injection but not how it works on the MySQL server. or 1 group by ...
2
votes
2answers
151 views

What are the dangers of sql injection with php?

I made an SQL-injectable web-app build to with PHP to get a better understanding of what is going on and automated it all with sqlmap. The relevant code is the following: mysqli_query($conn, SELECT ...