SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database.

learn more… | top users | synonyms

0
votes
2answers
84 views

Leading injection

Are there known exploits where a query of the form: select foo from bar where id = 6 can be turned into: select * from select foo from bar where id = random stuff It's clear that a badly formed ...
0
votes
1answer
74 views

Attacks to jump from SQL server to Web server, without direct network access?

Considering that I have a structure like the following, allowing only the TCP and UDP ports for SQL to be accessed. Specifically no traffic initiated from SQL is allowed to reach SECURE. SECURE-> ...
8
votes
3answers
830 views

What would the potential abuses be for an HTTP API that accepted raw SQL?

I was wondering what some of the potential abuses could be for an HTTP API that accepted SQL queries and output results sets. The fact that this is the canonical definition of SQL injection is not ...
0
votes
1answer
211 views

Some queries regarding SQL injection

[I'm not really sure if I should be posting this on SO or here. I think my questions might be answered if I have had a good experience with MySQL. But, I don't. So probably, most of you will ...
4
votes
1answer
391 views

VB.NET stored procedure implementation?

While reviewing code for a vb.net application I have come across the following implementation of stored procedures using ExecuteDataSet Result = DBInstance.ExecuteDataSet(Name, ...
4
votes
2answers
158 views

2000 Sets of Personal Information

So the story goes like this.. I recently rediscovered an old website i used to go on quite often but i couldn't remember my login. The site is poorly made and hasn't been updated in about 5 years, so ...
19
votes
4answers
8k views

How did Anonymous use UTF-16 ASCII to fool PHP escaping?

A few months ago, Anonymous took down a child pornography site using SQL-injection. I read in this article that Anonymous claimed that "the server was using hardened PHP with escaping," but they were ...
0
votes
1answer
261 views

How to use a Blind SQL-i keyword?

After scanning my website with uniscan I found a few vulnerabilities. I found this answer here and tried but it does not return anything except what it should return. Blind SQL Injection: [+] Vul ...
4
votes
6answers
12k views

Are there any tools for scanning for SQL injection vulnerabilities while logged in?

Some pages of my website were vulnerable to SQL injection. The injection worked only when the user was logged in. I have now fixed this problem, and now I want to make sure that no similar problems ...
3
votes
1answer
206 views

How easy is it to make a malicious bank/identity card?

I recently got a magnetic card reader that plugs into my computer because I was bored. I decided to scan my ID and bank card through it and I was surprised to see my ID number/bank card number show up ...
1
vote
2answers
3k views

Understanding the order by clause used in SQL Injections

I am trying to enumerate a database, created specifically for the purpose of learning SQL injections. I am trying to discover the number of columns a particular select statement might be using. I do ...
6
votes
3answers
4k views

Does mysql_escape_string have any security vulnerabilities if all tables using Latin1 encoding?

I have heard that the PHP function mysql_escape_string has security vulnerabilities related to mult-byte characters. Are there any vulnerabilities if all tables are using Latin1 encoding?
2
votes
2answers
254 views

SQL injection: real escape string function

example4.php?id=id=2-1 I came across the above injection and I can not figure out why(how) does this work and what's interesting is it returns all the records from the database. Anything guys? ...
0
votes
1answer
184 views

Sql Injection and no priviliges to write files [closed]

I have a sql injection in my site and im using sqlmap but when i try --os-shell it says cannot write file due to permissions . now is it impossible to write a file to the server?
-5
votes
3answers
14k views

How do I hack this login page by using SQL injection? [closed]

I'm testing a client's web site vulnerability to SQL injection, which appears to be the case. The web site is hosted in IIS on a Windows server and is using Microsoft's .NET framework with SQL. I'm ...
1
vote
2answers
843 views

Sql injection is not working on my site?

I have set up a page and database so I can practice SQL injection. Ive tried some examples and it doesn't seem to work. It seems to add the username and password to that database, even though I input ...
3
votes
1answer
106 views

Unsafe sanitization? Is this code SQLi vulnerable?

Function RemoveSuspeitos(ByVal strTXT) Dim txtAux As String txtAux = strTXT txtAux = Replace(txtAux, chr(34), "") txtAux = Replace(txtAux, ...
1
vote
1answer
1k views

Why isn't it possible to do SQL injection (HIGH Level) in this example in Damn Vulnerable Web App?

$query = " $sql = select * from users where id = '$id' " Won't $id=3' OR '1'='1 break the query ? The doubt arose because someone claimed it can't be broken.
0
votes
2answers
616 views

SQL Injection and JavaScript Regex Bypass

me for learning SQLI. But I got stuck at this one regex which seems to be unbreakable : document.loginForm.username.value = document.loginForm.username.value.replace(/[^a-zA-Z0-9]/g, ""); If someone ...
3
votes
0answers
24 views

SQL Injection via Unicode [duplicate]

My team currently uses ASP.NET with MS SQL Server for our software. Security has only become important since I started, in which there is injection vulnerabilities everywhere. Due to current ...
2
votes
4answers
4k views

SQL Injection with pass MD5

I want to know, if in my login form there is any SQL injection possible. If there is, what could the exploit's web form entry look like? I send username and password by html form (POST). The login ...
1
vote
4answers
2k views

SQL Injection via Unicode

My team currently uses ASP.NET with MS SQL Server for our software. Security has only become important since I started, in which there is injection vulnerabilities everywhere. Due to current ...
8
votes
3answers
19k views

Is there any SQL injection for this PHP login example?

I want to write a login form, and I got one example from the web. I want to know, if there is any SQL injection for this code? If there is, what could the exploit's web form entry look like? This is ...
5
votes
2answers
393 views

Can anybody recommend any gems for checking security vulnerabilities?

I want to check one of my RoR projects for security vulnerabilities. So can anybody recommend any gems for my needs?
2
votes
4answers
855 views

Generic defense againt SQL injection

This is a little bit of a rant, but there's a real question at the end. I recently installed a new perl script on a site (which will remain nameless) which failed mysteriously with an error 403. ...
0
votes
2answers
330 views

What kind of attack is this?

This past week, my traffic logs are showing many hits (usually with repeated tries) for a URL from perhaps 30+ different IP addresses all over the world. This is not a URL that should garner more than ...
1
vote
0answers
112 views

Hacking attempts:in.js

A client of mine keeps getting hacked by seemingly SQL injection where a script tag containing a link to an "in.js" file is added. Sometimes from a domain called sportserve.co.uk, other times from ...
8
votes
2answers
807 views

How can this input-sanitizer function be defeated?

There's a Classic ASP application at my job that is (I believe) highly vulnerable to SQL injection. I want to prove to management that this code isn't secure, but all I'm able to do is insert "SQLINJ" ...
0
votes
3answers
758 views

SQL injection explanation

I just found in logs that someone try to exectue this SQL injection ...
0
votes
2answers
3k views

sqlmap: testing javascript or json parameters

I have a parameter in a POST request which is in the following format: ParamName= < r username="123" password="456" x="" y=""/> and I want to test username and password which are two HTML ...
1
vote
0answers
336 views

MSSQL injection convert syntax error [closed]

I just setup a test bed and i disabled information_schema from being accessed (a weak waf) and i've been trying to extract the table list from the database by using convert to spit out a conversion ...
0
votes
1answer
166 views

MSSQL injection help [closed]

If information_schema is not allowed in MSSQL , what is another method i can use to list the tables inside a database and ultimately the columns so i can dump them without using information_schema? ...
-1
votes
1answer
148 views

True/false statements in MSSQL without < > and = [closed]

How can i make a true/false statements in MSSQL without the following symbols: <,>,= ? Everything i can think of, e.g: or 1=1-- (true) or 1>1 (false) and 2<>3 (true) Makes use of ...
0
votes
1answer
2k views

Is ASP.net More Secure than PHP in GENERAL? [closed]

In other words, my (long version) question is: Are developers able to get away with, more using ASP.net than PHP in terms of writing secure code for their apps? I ask this because ASP.net has many ...
0
votes
2answers
307 views

Any residual effects after SQLMAP has been run?

Some time ago, penetration testing was done on our website, and one of the tools used was SQLMap It was executed by a security consultancy, but unfortunately they did not notify us beforehand. So, ...
1
vote
1answer
88 views

Base Programming for vulnerabilities

Hello, I am a beginner looking for some information. My question is the following: In order to understand certain security concepts is it essential that I understand the underlying languages? For ...
8
votes
3answers
4k views

How to patch against RefRef's DOS attack

Overview Anonomous claimed responsibility today for the Denial of Service attack against wikileaks. They are using a new software called RefRef. It seems to exploit MySQL using the server's ...
2
votes
2answers
191 views

Is sqlmap tracable?

The question is simple. For example, we access a database of any website. And looked up for datas. So, is the website owner can see me? If he/she can see, how can i protect? [These are for security ...
0
votes
1answer
136 views

How can we get the second id for sqlmap [closed]

I'm trying to find some vulnerable points in my website. My website like, www.example.com/index.php?menu_id=1002&news_id=5. When i trying to find these points with sql map, it tries for menu id. ...
0
votes
1answer
155 views

Sql Injection - Possible exploitations on a real case [duplicate]

This is a snippet of a PHP script: $useragent = isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : NULL; $query = "SELECT `id` FROM `browser` WHERE name = '".$useragent."' LIMIT ...
3
votes
4answers
306 views

Are these SQL injection checks a bad idea?

Reading Preventing SQL Injection Attacks in Stored Procedures started this debate between my partner and I---and looking for the right approach is not as straight forward. I'm no security expert--but ...
1
vote
1answer
73 views

Am I right by changing the default algorithm on a web app?

Numerous clients have told me that my suggestion on changing the algorithm on a web app does not increase security. I've tried reasoning that if the files have not been exposed, the attacker has to ...
-3
votes
1answer
800 views

Wordpress - cleartext admin credentials disclosure

I am testing my own wordpress blog against security issues with wpscan. Honestly I have never done that before and was shocked after I saw the result. One vulnerability of my wordpress site is: [+] ...
0
votes
1answer
183 views

Can a sql query with both user input and parameter be prone to sql injection?

I've stumbled over some code in an application where (certain) users are allowed to input where conditions. In addition to this there is a part of the where condition that is set as a parameterized ...
21
votes
3answers
83k views
3
votes
1answer
433 views

is 'mysql_real_escape_string' enough

Recently on stackoverflow I've seen many discussions that mysql_*_escape_string is deprecated and instead recommending PDO. The way I've been doing it was to allow only letters and ' in the name field ...
0
votes
1answer
237 views

Are cross site scripting attacks and sql injection a good topic for my thesis? [closed]

So I'm doing my undergraduate thesis, I would like to explore how cross site scripting sql injections occur. And for the purpose of the thesis I'd also like to create a fictional website that is ...
17
votes
7answers
1k views

How to exploit the “PHP_MAGIC_QUOTES ON” vulnerability in order to cause max damage?

I've found a whole lot of SQL injection exploits in some systems I maintain. I know how to prevent the injection, but I would like to demonstrate to my CEO and CTO how dangerous it is if we don't have ...
3
votes
2answers
495 views

Regarding SQL Injection at Back End?

I have logged into SQL Server 2008 Database and executed following query: select * from USER_Main_INFO_Name where userid ='' or 'x'='x' After executing the query Database has given total user list. ...
2
votes
2answers
552 views

What hacking risks a site has if it has no input boxes?

I recently posted a question about recovery of website from XSS attacks, http://stackoverflow.com/questions/20759081/how-to-recover-a-site-after-an-xss-attack... Doing a bit more digging online, i ...