SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database.

learn more… | top users | synonyms

1
vote
2answers
137 views

Breaking mysql username and password form [closed]

I have two versions of a website. The first one has no security precautions against sql injections. So if I try something like: Username: hello_world Password: ' or ' 1=1 I'll be signed in as the ...
-1
votes
1answer
110 views

Is there a way to bypass the inbuilt php functions for sqlinjection

If there is a way to bypass the built-in functions of PHP to protect against SQL injection or I should rely on some other filters rather than depending on built-in functions?
3
votes
1answer
136 views

Proving SQL Injection Vulnerability

I have recently come across what I believe to be a serious flaw in the security of a 3rd party computer program used within my company. Apologies for deliberately keeping details vague, but I hope you ...
0
votes
2answers
53 views

Which of these DBMS offers the lowest security for SQLI? [closed]

Which of these DBMS offers lowest security for SQLI? Oracle, MYSQL, SQL Server, ProstgreSQL or DB2? Why? Could you explain to me, why some are more vunerable to SQLI?
-1
votes
3answers
236 views

How to check for sql injection attack? [closed]

We do our final year project related to sql injection. For implementing sql injection attack which IDE or tool we used? bcoz netbeans and other type of IDE are more secured?
-1
votes
1answer
107 views

Blackbox testing for SQL injection

In my college, a security challenge event is going on for one whole month, Participants are expected to 'hack' into a website. The site has a login form, which accepts username and password and POSTs ...
1
vote
1answer
116 views

How to use mySQL UNION operator in sql injection, with injectable password paramiter?

Can someone give me an example of sql injection with UNION operator, that returns users and passwords, with regards to the bellow php example. I've managed to inject simple 1 or 1=1... in the pass ...
0
votes
2answers
297 views

How to perform SQL injection with real_escape_string filter in place?

can someone give me an example of mySQL injection payload, which will bypass the real_escape_string() sanitize filter in regards to the below php example. function sanitizeStrXSS51($var) { global ...
0
votes
3answers
139 views

How to organize a CTF?

In the context of an IT event, my team would organize a CTF (Capture The Flag). About the challenges (we’re working on them). I want to have some references on the types and levels of difficulty that ...
2
votes
1answer
193 views

Learning ethical SQL injection with php login form

I'm learning ethical hacking and now I'm on sql injection topic. I'm also new to SQL and php. Ok, so I have local damn vulnerable website with back-end Linux, MySQL and Apache and now trying to use ...
0
votes
2answers
73 views

SQLmap over uni wifi [closed]

I don't know if this is the right place to ask this question but I'll give it a shot! I was playing around with Kali and SQLmap. I was just scanning some sites nothing serious. When I was doing this I ...
0
votes
2answers
145 views

SQL injection at work [closed]

We have a web form that can be filled out with text fields and then they get emailed to us at work. Today we got some SQL commands it looks like in a bunch of emails. I just would like to have a bit ...
-1
votes
2answers
145 views

How to use ORM correctly to prevent SQL injection?

I read here that using ORM (like nHibernate) does not necessarily prevent SQL injection; for example, if you keep creating dynamic queries using your ORM framework you are still vulnerable. Fine, ...
0
votes
3answers
139 views

How to validate report given by a white hat hacker

I give a contract to find vulnerabilities in my site to a white hat hacker. According to him he performed several attacks on my site for 15 days and find that there is no any security threats. I am ...
2
votes
3answers
131 views

Is there an SQL injection equivalent on url-passed parameters to a servlet?

In SQL injection an attacker can craft a string that if left unchecked and executed it can complete and execute arbitrary SQL commands. Is there an equivalent to these kinds of attacks in JSP pages? ...
2
votes
1answer
137 views

Error-based SQL injection

I understand the conceptual idea behind error-based SQLi, but not the actual execution. In particular, I can't make sense of this expression: or 1 group by concat_ws(0x3a,version(),floor(rand(0)*2)) ...
5
votes
2answers
97 views

Is the separation of data from different applications via Oracle schemas considered secure?

I am evaluating the pros and cons of having different Oracle schemas vs. separate Oracle servers. Having a dedicated server for each application is really expensive and I only want to consider this if ...
0
votes
1answer
227 views

SQL injection on query (MySQL/PHP) [closed]

First, sorry if my issue is a duplicate! This is an exercise that I can not solve. It is an authentication, simply. But the problem is that the application does not check both the password and ...
18
votes
6answers
3k views

Can SQL injection lead to remote code execution?

Is it possible to execute some code (e.g. PHP code on a PHP-based web application) on the server through SQL injection? If yes, how exactly? I understand that un-escaped field can lead to SQL ...
0
votes
1answer
106 views

Performant ways to identify potential SQL injection vulnerabilities in web applications [closed]

I [itsec novice] am developing a workflow/application for identifying potential SQL injection vulnerabilities in web applications and would like to get some professional opinions on my approach. ...
-1
votes
1answer
84 views

my table is dropped in PDO [closed]

This is my PDO method i used this method to save input value to SQL After reading this pdo-prepared-statements-sufficient-to-prevent-sql-injection Since Am started learning PHP i don't know this ...
35
votes
6answers
5k views

Is SQL injection possible with LIMIT?

A friend of mine built a web application that I'm testing for fun. I noticed that he allows a user to set the limit of a certain query, and that limit is not sanitized. For example, I can choose any ...
1
vote
3answers
185 views

Beyond SQL injections and XSS

I'm a programmer working on a web service (by myself). Given the fact that I am not a security expert, I came to this website to ask my question. I did all the major things to secure my website. I ...
4
votes
2answers
132 views

How do honeypots remain secure to 0days and newer exploits?

If honeypots are designed for a specific set of exploits, such as SQL injection and XSS, how do they protect themselves against other exploits? For instance, if I created a honeypot a few months ago, ...
-1
votes
3answers
151 views

SQL Injection solutions [closed]

I'm editing my question to clarify what I'm trying to ask. In order to launch an SQL injection there should be someway to get input from the user (i.e. username and password) for instance. So I've ...
1
vote
1answer
128 views

If mysql schema is missing, where can I find credentials?

After finding a sql injection vulnerability I need to provide the more information I can about the DB. Minimum I need to provide a list of users and passwords. I identified that it's a MySQL but ...
0
votes
1answer
181 views

Is dot character safe against sql injection?

I'm modifying the search module of prestashop in order to be able to search strings containing dots : . Prestashop uses its own sanitize functions against mysql injection vulnerability (yeah...) and ...
4
votes
2answers
184 views

In what situations does parameterizing a query NOT prevent SQL Injection?

While this isn't terribly common, I know that SQL Injection is still possible with a parameterized query, if you are calling a stored procedure that uses a parameter to construct and execute dynamic ...
1
vote
1answer
190 views

Do PHP/SQLI Prepared Statements Need Special Character Escaping?

I'm using php/mysqli queries such as this: $stmt = $con -> prepare("INSERT INTO `comments` (`uid`, `article_id`, `status`, `comment`) VALUES (?, ?, ?, ?)"); $stmt -> bind_param('iiis', $uid, ...
4
votes
2answers
354 views

Placeholders for cshtml — ASP.NET

I'm learning Application Security, and tutorials such as www.asp.net discuss updating databases with placeholders, instead of directly using user input @{ var title = ""; var genre = ""; ...
8
votes
3answers
3k views

SQL Injection if table structure/db structure not known

could an attacker who'd just found out that you're using mysql make an SQL Injection attack with only this information? If you don't know Any table/db name how come you can find it out? Is that even ...
4
votes
2answers
2k views

SQL Injection Modify / Insert Table Values

Is it possible to update a field in a MySQL database or insert a new row using SQL injection in this case: The only protection in the PHP code is mysql_real_escape_string(). The query is ...
-2
votes
2answers
173 views

How to know table name, and column names for login panel

I want to know the table name and column names of that table in website login page. How should I do that. There are only two input fields, Username and Password. And it is vulnerable to Sql ...
2
votes
0answers
39 views

Navigating SQL Injection Safeguards [duplicate]

I'm trying to get around the DVWA high security SQL injection challenge, I've tried a bunch of automated scanning tools with no luck, read a bunch of articles saying it's impossible now i've turned to ...
3
votes
3answers
145 views

Drupal SQLi only on login form?

Recently, CVE-2014-3704 was in the news. This vulnerability allows attackers to execute SQLi without the need of being logged in. However, I've looked to the available exploits, and I found only ...
0
votes
3answers
1k views

Does this simple function add something to prepared statements?

I've been researching how to completely prevent against SQL injection, but there are so many different forms of injecting that completely preventing it looks impossible to me. I am using prepared ...
2
votes
2answers
3k views

1'or'1'='1 help

When I put Username:anything and Password : 1'or'1'='1 Then my database retrieves the first row in the mysql table. But I want to retrieve the row corresponding to Username:anything row. How should I ...
5
votes
1answer
292 views

SQL injection with single statement query

Suppose I had a vulnerable query like this: var q = 'SELECT x FROM y WHERE id = ' + req.body.id + ' ORDER BY date DESC;'; For the purposes of this question, req.body.id could be any integer ...
4
votes
2answers
3k views

How does stored procedure prevents SQL injection?

May be I am not much clear about the stored procedure. Can someone explain me how stored procedure prevents SQL injection with a simple example using MySql.
2
votes
2answers
213 views

ASP.NET SqlDataSource injection risk

I have an internal website (going on the intranet) that is going to go through vigorous testing to make sure that it is secure, so I am battening down the hatches so to speak and I coded a .NET ...
1
vote
1answer
831 views

Devious Blind SQL Injection Payload

I came along this blind SQL injection time based payload and I need to understand how it works ...
0
votes
1answer
124 views

What is the main function of xp_cmdshell in SQL Server and what are its related security issues?

I was researching on Injection issues in MS SQL Server. I came to read about xp_cmdshell. I think this must be enabled in the SQL server for attackers to perform many exploits. Actually what is this ...
7
votes
2answers
3k views

What is the meaning of “something AND 1=0” command in SQL?

I have read somewhere that in SQL injection attacks the attackers use such keywords into application entry points. Whats the purpose of doing this?
2
votes
3answers
298 views

How do attackers find the database technology used by a web application?

These days there are several database technologies are available for data storage purpose. While performing injection attacks, how do attackers actually identify the database used by a website? If ...
14
votes
3answers
4k views

Why do testers often use the single quote ( ' ) to test for SQL injection?

It has been seen that security testers input either ' or ; into the application entry points to test for SQL injection. Why are these characters used?
2
votes
1answer
90 views

Why isn't recommended to use time-based blind for bruceforcing table/column names?

When not having priveleges on the session user you're using with sqlmap this warning appears when trying to retrieve table/column names, offering you to brute force names using a dictionary file, do ...
-1
votes
1answer
299 views

Is attempting mySQL injection illegal? [closed]

I was testing an SQL injector I made in Java and the site I tested it on said 'Detected security breach attempt' blah blah blah. Is what I did illegal or not? I have found different opinions and ...
2
votes
3answers
2k views

Login required before SQLmap

I have a multipart form data where I am suspecting one of the multipart form fields (parameter named htmlbevt_id), to be vulnerable to SQLi. To test for the same I captured the request using Burp and ...
8
votes
6answers
2k views

Faster SQL injection prevention

I looked around everywhere and I can't find the answer to my question. I'm using the latest PHP for server-sided scripting and MySQL for my database. The character set is utf8mb4, if that makes a ...
0
votes
3answers
1k views

SQL injection filter evasion

During manual SQL injection testing I came upon this. Is there any way to bypass these filters that supposedly prevent a UNION based attack? <?php error_reporting(0); include('db.inc.php'); ...