SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database.

learn more… | top users | synonyms

5
votes
3answers
619 views

Best way to alert a website owner of a vulnerability?

recently i was browsing a site, and i noticed that at the end of the URL it said id=168, which is a common indicator that the site is vulnerable to an SQL injection attack. i did some tests and found ...
5
votes
4answers
2k views

How to get the output of a SQL injection?

This is just for learning purpose. I want to get all the usernames and passwords from a table in a MySQL server, where "magic quotes" have been disable. In the input for the username: I put something ...
5
votes
3answers
1k views

What dangerous characters need to be filtered from user input prior to use in a DB2 SQL query?

I'm looking to fully understand how to properly filter/escape dangerous characters from user input that will be interpolated into a DB2 SQL query. The sanitization routing that I'm analyzing works ...
5
votes
2answers
765 views

Could this login form be “hacked” to allow access?

We have this legacy website which has horrendous code in it. I have just been looking through the login form/code and can see un-sanitised sql queries. E.g. in a nutshell: $email=$_POST['email']; ...
5
votes
2answers
7k views

How SQL Injection works through URL

I am Web developer , but i don't understand something , i did search and asked many but they know it is just there but the don't give me a technical answer: Main Question : How SQL Injection works ...
5
votes
2answers
1k views

Scanning DVWA with w3af - Unable to detect SQLi when security on low

I've been messing around with DVWA (Damn vulnerable web application) and w3af. I've been scanning DVWA with w3af, and have used the spiderMan proxy and http config to setup auth credentials to get ...
5
votes
1answer
574 views

SQL Injection on URL, not on parameters

Should WAF or any protecting method, block SQLi done on URLs?(eg GET /test/url'or 1=1--)
5
votes
1answer
1k views

My site just got hit with a SQL injection attack, how can I tell what they were doing?

So a page on my site (it's a PHP page that displays newsletter articles) was vulnerable to SQL injection and got hit. I discovered it because it was doing enough database queries to cause the CPU load ...
5
votes
2answers
410 views

Possibility of SQL injection on table name that filters backticks?

I am reviewing an application that has something like this: table_name = table_name.replace('`', '') c.execute('SELECT * FROM `' + table_name + '`') Is this actually exploitable if the attacker ...
5
votes
1answer
320 views

Is Taking advantage of the IsNumeric() Function In VB.Net Through SQL Injection Possible?

Suppose this is the only mitigation used on a server: Dim IDPerson IDPerson = Request.Querystring("id") If IsNumeric(IDPerson) = True Then IDPerson = IDPerson Else IDPerson = 0 End If IDPerson is ...
4
votes
6answers
6k views

Are there any tools for scanning for SQL injection vulnerabilities while logged in?

Some pages of my website were vulnerable to SQL injection. The injection worked only when the user was logged in. I have now fixed this problem, and now I want to make sure that no similar problems ...
4
votes
2answers
142 views

2000 Sets of Personal Information

So the story goes like this.. I recently rediscovered an old website i used to go on quite often but i couldn't remember my login. The site is poorly made and hasn't been updated in about 5 years, so ...
4
votes
4answers
949 views

How to test for SQL injection query

When testing for SQL injection in an URL like this: example.com/videos.php?id='34, we use character sequences like: ' " """" /*/ -' -- And many others... How could you test links like these for ...
4
votes
2answers
6k views

How to Insert data into a table with sqlmap using its sql-query command

I'm using sqlmap on a test site and I wanted to modify some of the data inside of a table. Using the switch "--sql-query". What is the correct syntax? example: is it --sql-query="My_query_here"? ...
4
votes
5answers
1k views

Are image uploads also vulnerable to sql injection?

I have some good knowledge how sql injections work. I see that the Googling inurl upload.php will tell one about the upload paths in a website. My Question is that if a person finds a path by which he ...
4
votes
3answers
1k views

Create a page to experiment with SQL injection [closed]

This semester, I have taken a course on Information Security and my project for this course is to implement an SQL injection to obtain admin privileges. For this I first download Havij software ...
4
votes
2answers
289 views

Can anybody recommend any gems for checking security vulnerabilities?

I want to check one of my RoR projects for security vulnerabilities. So can anybody recommend any gems for my needs?
4
votes
2answers
971 views

What exploit types do I need to protect against in PHP?

I recently learned that apparently, it is common for people to attempt SQL injections using the HTTP referrer in PHP. What other inputs do I need to protect against? I am currently "cleaning up" ...
4
votes
2answers
994 views

Is it possible to test for Postgres BlindSQL injection using pg_sleep() in a WHERE clause?

In mysql, I am familiar with using the following payloads to test for blindsql when the WHERE clause is vulnerable (all payload examples from fuzzdb): 1 or sleep(TIME)# " or sleep(TIME)# ' or ...
4
votes
2answers
147 views

Changing windows client form values at runtime

I am performing a code audit of an older VB6 application which uses dynamically constructed SQL to execute against the database. While I see this as a SQL injection point, the developer contends that ...
4
votes
2answers
311 views

Protecting Password Hashes with Store Procedures?

I was thinking about the recent (seemingly weekly) security breaches we've seen where millions of password hashes have been leaked and I was wondering how one might secure their site against a ...
4
votes
2answers
4k views

SQL Injection - Extracting database data from the page content

I have a question I am hoping someone could help with.. I am in the process of writing an SQL Injection tool from scratch (I am aware there are already excellent tools out there such as SQL Map, but ...
4
votes
2answers
742 views

SQL Injection - Automating the fingerprinting of the DBMS

I have a problem I'm hoping someone could help with regarding the fingerprinting of the DBMS using sql injection, in a scripted/automated way to accurately and reliabling determine the DBMS. I am in ...
4
votes
2answers
95 views

SQL abstraction layer : A preventive mechanism for SQLi?

While performing a pentest for a Java based application I came across an SQL (actually HQL) error by simply putting a single quote in one of the request parameters and breaking the syntax of the ...
4
votes
1answer
145 views

VB.NET stored procedure implementation?

While reviewing code for a vb.net application I have come across the following implementation of stored procedures using ExecuteDataSet Result = DBInstance.ExecuteDataSet(Name, ...
4
votes
1answer
173 views

Weird condition in blind SQL injection point, substr() is valid for exactly two chars

I'm exploiting a blind SQL injection point, which takes a variable as username then check if the username exists in a table. (It's running MySQL 5.X with PHP) So I'm using this to retrieve all ...
4
votes
2answers
711 views

Security web scanner tool for IIS/SQL Server

I'm trying to do penetration testing of our ASP.NET web-site to check for security loopholes (specifically for SQL injections). We bought a commercial web scanner tool (IBM Rational AppScan), however ...
3
votes
4answers
1k views

SQL query sanitation (black list)

I have a following problem/challenge: Web application (ASP.NET 3.5) installed on corporate LAN and operates on SQL Server DB needs to provide ability to generate custom reports. These reports can be ...
3
votes
4answers
4k views

How is my website vulnerable for sql injections?

I am running a small website where I have published some articles. I am also very interesed in security topics and tried sqlmap on my website. It found the database name, so my question is how it ...
3
votes
3answers
931 views

SQL injection using letters and numbers?

I was wondering if it is at all possible for a hacker to perform an SQL injection attack using just letters and numbers. For example, let's take a look at this PHP code which uses regular expressions ...
3
votes
3answers
248 views

Does SQL have any inherant weaknesses?

A prof said that SQL injection is misnamed because it actually occurs from the program generating the SQL (e.g. Perl, PHP etc.) and I'm wondering is SQL "complex" enough to have any vulnerabilities ...
3
votes
4answers
175 views

Are these SQL injection checks a bad idea?

Reading Preventing SQL Injection Attacks in Stored Procedures started this debate between my partner and I---and looking for the right approach is not as straight forward. I'm no security expert--but ...
3
votes
3answers
365 views

Is this a web attack I should be concerned about - trying to enter code for form vars

I have a created a simple CGI script running on a web server where a user can login using a username and password. The username and password are entered via a html form and the form POST's the data ...
3
votes
3answers
5k views

Why can't sqlmap find an SQL injection in my code?

I installed XAMPP on my development PC, and started Apache HTTP server and MySQL. It comes with a test page "CD collection", with the following back-end PHP code: mysql_query("DELETE FROM cds WHERE ...
3
votes
1answer
254 views

is 'mysql_real_escape_string' enough

Recently on stackoverflow I've seen many discussions that mysql_*_escape_string is deprecated and instead recommending PDO. The way I've been doing it was to allow only letters and ' in the name field ...
3
votes
3answers
3k views

Hibernate SQL Injection - Fortify 360

I am using Fortify 360 to analyze my code's security. Fortify has identified a Hibernate based delete method to perform a delete based on an object that has been passed in. My understanding of ...
3
votes
2answers
438 views

I'm Trying to Find how to Exploit my SQL Code

I'm trying to find a way to exploit my stored procedure to test for security problems, I have specifically been testing for SQL truncation-based injection, but I did not succeed so far; I don't think ...
3
votes
2answers
411 views

Regarding SQL Injection at Back End?

I have logged into SQL Server 2008 Database and executed following query: select * from USER_Main_INFO_Name where userid ='' or 'x'='x' After executing the query Database has given total user list. ...
3
votes
2answers
837 views

ASP.NET SQL Injection

I have custom authentication system on my ASP.NET website that can help me to register users from my Windows (Desktop) and mobile (Android) Applications.It means that I don't use ASP.NET ...
3
votes
2answers
364 views

Encrypting Fields in Database

I'm working on an ASP.NET web application that will have to store sensitive information. I would like to encrypt the sensitive fields to protect against any possible SQL injection vulnerabilities. ...
3
votes
2answers
301 views

Are there special attack vectors for statistical databases?

Are statistical databases vulnerable to SQL injection attacks? If so, what specific kind? Can you think of an example?
3
votes
1answer
306 views

Why does MySQLi using question marks (?) instead of the sprintf formatting?

As the title states, why does MySQLi use question marks instead of sprintf() formatting? For example, why is it $stmt = $mysqli->prepare("SELECT * FROM table WHERE column1 = ?"); ...
3
votes
2answers
737 views

What makes a SQL Injection counted as blind injection?

Firstly, from what I have read so far, boolean based blind sql injection is you can't see any error messages and rely on true or false query to milk the database. eg. Craft a query that will ask the ...
3
votes
2answers
2k views

sanitizing input/output in php/codeigniter

I've been making some progress learning about web application security. Right now I'm trying to finalize my strategy for sanitizing input and output. Background: Users can submit reviews to the site, ...
3
votes
3answers
164 views

SQLi-protection ORDER BY

What would be a good check to remove all possibility of SQL-injection on an ORDER BY col where col is an unsafe variable? I'm currently removing [^A-Za-z0-9_] from the string in php. Is this too ...
3
votes
2answers
100 views

Is my vendor vulnerable to sql injection?

The company I work for has recently moved to an external vendor for payroll services. We did an initial upload of data from our old system to the new vendor. I noticed that our employees that have ...
3
votes
1answer
156 views

Understanding Boolean Based SQL Injection

I am trying to understand the concept of Boolean Based Blind SQL Injection. I have gone through OWASP Guide To SQLi to understand it. However I am confused with how exactly does it work. Below id ...
3
votes
1answer
584 views

SQLMap: How to test JavaScript generated field names?

I have a pretty simple HTML page that submits a username and password to the server via POST method: <doctype html> <head> <title>SQLMap dynamic parameters</title> ...
3
votes
1answer
110 views

How easy is it to make a malicious bank/identity card?

I recently got a magnetic card reader that plugs into my computer because I was bored. I decided to scan my ID and bank card through it and I was surprised to see my ID number/bank card number show up ...
3
votes
0answers
21 views

SQL Injection via Unicode [duplicate]

My team currently uses ASP.NET with MS SQL Server for our software. Security has only become important since I started, in which there is injection vulnerabilities everywhere. Due to current ...