Tagged Questions

SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database.

learn more… | top users | synonyms

6
votes
2answers
265 views

SQL injection across multiple tables

If a website has multiple web apps, each of them connected to different tables in a database and all of the apps are protected from SQL Injection except one; can that one web app be used to ...
1
vote
4answers
5k views

SQL injection with “INSERT” statement

I am currently studying the most basic SQL injections that are possible. Pure and solely for the purpose of teaching myself the basics before advancing to more advanced ones. I am recreating this ...
1
vote
2answers
6k views

sqlmap unable to find SQL injection vulnerablitity

so i just started up with sqlmap to learn sql injection vulnerability on my application. Here I followed steps as per some tutorials. So this are the steps which i followed : sqlmap.py -u ...
5
votes
4answers
4k views

How to get the output of a SQL injection?

This is just for learning purpose. I want to get all the usernames and passwords from a table in a MySQL server, where "magic quotes" have been disable. In the input for the username: I put something ...
2
votes
0answers
355 views

how to prevent ASCII Encoded / Binary String SQL injection in Codeigniter

I am using CodeIgniter for two years and I am digging into penetration testing nowadays. I think that ActiveRecord does good job for preventing sql injections, but i have following questions: I want ...
13
votes
3answers
4k views

Is it possible to do SQL injection (HIGH Level) on Damn Vulnerable Web App?

I searched all over google to see how it would be possible to bypass the following (it's from the high level of security from DVWA): <?php if (isset($_GET['Submit'])) { // Retrieve data $id ...
0
votes
1answer
291 views

What are the reasons this SQL injection code wouldn't work? [duplicate]

In Software Assurance class I was asked a question why following query allows SQL injection which will allow log in into unsafe phpBB version but will not allow any modification of the database. We ...
3
votes
3answers
1k views

MySQL SQL injection without stacked queries - what is actually possible without affecting the FS?

I am exploring a vulnerability in one PHP website that is basically riddled with SQL injections. With SQLMap, I managed to dump all the tables and get some basic information (username, DB name, ...
2
votes
4answers
2k views

SQL Injection with pass MD5

I want to know, if in my login form there is any SQL injection possible. If there is, what could the exploit's web form entry look like? I send username and password by html form (POST). The login ...
2
votes
2answers
343 views

How to get URL behind REST-style

I've asked same question on StackOverflow but topic passed away with no answers except few comments so I'll try to ask the same question here as it's probably more specific to security. The only ...
1
vote
3answers
291 views

Vulnerability scanner shows SQL errors were disclosed.How Severe it is?

When I scanned my site for Vulnerabilities I found this error. Various SQL errors were disclosed within the application source code or other files. I have checked for sql injection and confirmed ...
0
votes
1answer
362 views

SQLMap extracts weird chars in one column

I saw this behaviour many times but I never solved it. Sometimes using sqlmap after retrieving good data from columns it fails retrieving only one of them. I can't figure out why this happens for just ...
1
vote
2answers
980 views

CGI generic sql injection

I was scanning a site with Nessus when the following vulnerability was reported: CGI Generic SQL Injection Nessus says that: "An attacker may exploit this flaw to bypass authentication, ...
1
vote
2answers
1k views

Getting a SQL injection past a given regex [duplicate]

I have been shown one regex which, per the one who wrote it, should protect against SQL injections on SQL server 2008. It doesn't really look like it, but I'm wondering exactly what code I can get ...
3
votes
1answer
717 views

SQLMap: How to test JavaScript generated field names?

I have a pretty simple HTML page that submits a username and password to the server via POST method: <doctype html> <head> <title>SQLMap dynamic parameters</title> ...
0
votes
2answers
161 views

Is there an open source runtime enforcement tool?

I have been looking for open source runtime enforcement tools that I can use my own policies to prevent input validation vulnerabilities, in web applications. The web applications that I want to ...
2
votes
1answer
104 views

Ethical approach about corporate website and vulnerabilities [closed]

I like web security and i have academic formation about that. Just for fun I found a website (insurance company) with critical vulnerabilities like xss or sql injection. Now, I obviously will alert ...
3
votes
2answers
1k views

ASP.NET SQL Injection

I have custom authentication system on my ASP.NET website that can help me to register users from my Windows (Desktop) and mobile (Android) Applications.It means that I don't use ASP.NET ...
4
votes
6answers
8k views

Are there any tools for scanning for SQL injection vulnerabilities while logged in?

Some pages of my website were vulnerable to SQL injection. The injection worked only when the user was logged in. I have now fixed this problem, and now I want to make sure that no similar problems ...
7
votes
4answers
2k views

How to white hat Pen Test SQL injection

I will start off with saying apologies if this is something that has been asked 100s of times or is moot question within testing circles. I have come across this article I'd like to test this out ...
2
votes
1answer
1k views

How to save the random salt to the database

As I understand it, salting and hashing passwords is the way to go. I also understand that to authenticate a salted and hashed password, the random salt needs to be saved. Does this mean that if I use ...
1
vote
1answer
684 views

“ScriptResource.axd” vulnerability in Windows Server 2008

I am using Windows Server 2008, Plesk 9.5, IIS 7, SQL Server 2008, and recently I have received and email claiming this server is vulnerable, and sent me the following URL: ...
2
votes
3answers
278 views

Is + as an alternative to %20 an attack vector?

I was reading a Q&A on enabling + characters in URLs for Sitecore CMS, and the answer states: ASPNET application does not allow using “+” from the security point of view e.g. preventing SQL or ...
2
votes
2answers
2k views

Sqlmap and multipart/form-data forms

I'm working on some security for a website that is built in classic ASP and MS SQL 2000. I've successfully found a couple of flawed forms that allowed SQL injections through the form fields by using ...
2
votes
2answers
579 views

Suspicious entries in MySQL database from user input forms - sql injection?

I built a website from scratch using PHP and MySQL for my residential community and our budget is a big fat '0'. Five days ago I discovered that there were 222 entries in a table in my database that ...
3
votes
3answers
1k views

SQL injection using letters and numbers?

I was wondering if it is at all possible for a hacker to perform an SQL injection attack using just letters and numbers. For example, let's take a look at this PHP code which uses regular expressions ...
2
votes
2answers
1k views

How to deal with MySQL's Errcode 13 when trying to write a shell

My attack machine is running Kali and the server is running CentOS 6.4 with DVWA. I'm trying to write a shell through an SQL injection. The payload is ' UNION SELECT '', '<?PHP ...
1
vote
2answers
2k views

How to detect and exploit an SQLi in a POST method

Making it simple (no security at all), when we want to detect whether or not a GET parameter is vulnerable to SQLi, we could just type a ' as the value (?id=') and check if there is any error. (No ...
2
votes
2answers
1k views

Sqlmap fails at enabling xp_cmdshell procedure

I have been browsing the web looking for some help regarding the following issue. I am currently performing an web application penetration test, and I had come accross a beautiful blind SQL Injection. ...
2
votes
3answers
5k views

No single quotes is allowed, Is this SQL Injection point still exploitable?

The SQL phrase looks like this, "SELECT * from XX where id = '" + id + "'" The id variable comes directly from the GET parameter named id. And the Java web app explicitly disallowed single quote. ...
6
votes
2answers
695 views

Backdoors after SQL injection?

I just found an injection vulnerability on a live site of a client. It looks like this: $sql = "SELECT * FROM users_dl WHERE Username = '" . $Uname . "' AND Password = '" . $Pword . "'"; I ...
3
votes
2answers
813 views

What makes a SQL Injection counted as blind injection?

Firstly, from what I have read so far, boolean based blind sql injection is you can't see any error messages and rely on true or false query to milk the database. eg. Craft a query that will ask the ...
5
votes
2answers
8k views

How SQL Injection works through URL

I am Web developer , but i don't understand something , i did search and asked many but they know it is just there but the don't give me a technical answer: Main Question : How SQL Injection works ...
5
votes
1answer
351 views

Is Taking advantage of the IsNumeric() Function In VB.Net Through SQL Injection Possible?

Suppose this is the only mitigation used on a server: Dim IDPerson IDPerson = Request.Querystring("id") If IsNumeric(IDPerson) = True Then IDPerson = IDPerson Else IDPerson = 0 End If IDPerson is ...
5
votes
5answers
3k views

How to make a site vulnerable to SQLi?

I've recently taken an interest in SQL injections - it (for some reason, correct me if I'm wrong) seemed like a good place to start (I am pretty much a beginner). Anyways, I want to make a site that I ...
7
votes
3answers
2k views

What kind of attack was this?

So our website was hacked, and these are the things that were done: Some entries in the database were changed. I don't know if this was via SQL injection, or direct database access (only root is ...
2
votes
3answers
915 views

sql injection, exec and preg_replace filter

Ive been informed this is not safe to use in regards to sql injection: preg_replace("/[\"'%()@$.!&?_: #\/-]/","", mysql_real_escape_string($_GET['var'])); what would be the difference in the ...
4
votes
2answers
348 views

Protecting Password Hashes with Store Procedures?

I was thinking about the recent (seemingly weekly) security breaches we've seen where millions of password hashes have been leaked and I was wondering how one might secure their site against a ...
2
votes
4answers
572 views

Generic defense againt SQL injection

This is a little bit of a rant, but there's a real question at the end. I recently installed a new perl script on a site (which will remain nameless) which failed mysteriously with an error 403. ...
2
votes
4answers
4k views

Does escaping quotes protect me from SQL injection?

A newbie question here. I've just read through a short introduction to SQL injection on http://www.breakthesecurity.com/2010/12/hacking-website-using-sql-injection.html?m=1 It says to find a GET ...
25
votes
4answers
2k views

Is it okay to reveal database's table names?

I'm developing web application that uses database. I have to do some operations which needs database table names and db table schema. Will it be secure if I send this kind of information to client ...
0
votes
1answer
110 views

Create additional database in server using sql injection [closed]

I'm trying to do an sql injection in DVWA with Apache2 and MySQL that would create one more database. This: 2' union select 1,2' create database kala;#-- does not give me any errors but it also does ...
6
votes
4answers
3k views

A customers site had a big mysql injection attack on it, just want to learn from it

I created an online store for a friend of mine. I created a system that shoots me an email any time there is a database error, that way if it is a bug in my code I can identify it and fix it. The ...
5
votes
2answers
461 views

Possibility of SQL injection on table name that filters backticks?

I am reviewing an application that has something like this: table_name = table_name.replace('`', '') c.execute('SELECT * FROM `' + table_name + '`') Is this actually exploitable if the attacker ...
4
votes
2answers
5k views

SQL Injection - Extracting database data from the page content

I have a question I am hoping someone could help with.. I am in the process of writing an SQL Injection tool from scratch (I am aware there are already excellent tools out there such as SQL Map, but ...
5
votes
3answers
602 views

How do I make SQL injection harder but not impossible?

I'm doing a CTF application for my final year project. I wanted to craft a SQL injection flag but I don't wish that they can simply found out the SQLi vulnerability by injecting ' . Hence, is there ...
8
votes
3answers
13k views

Is there any SQL injection for this PHP login example?

I want to write a login form, and I got one example from the web. I want to know, if there is any SQL injection for this code? If there is, what could the exploit's web form entry look like? This is ...
1
vote
1answer
124 views

Isolating database? Is it possible?

I have been assigned CTF project for IT Security for my final year project in school. We are planning to have a flag that are base on SQL injection but for the user to overcome the challenge, they ...
1
vote
1answer
573 views

WAF SQL evasion using HPF technique

I was reading an article on WAF evasion techniques http://www.slideshare.net/devteev/methods-to-bypass-a-web-application-firewall-eng. The article discuss two techniques HPP (HTTP parameter ...
4
votes
2answers
845 views

SQL Injection - Automating the fingerprinting of the DBMS

I have a problem I'm hoping someone could help with regarding the fingerprinting of the DBMS using sql injection, in a scripted/automated way to accurately and reliabling determine the DBMS. I am in ...