SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database.

learn more… | top users | synonyms

6
votes
1answer
5k views

SQL Injection - UNION SELECT and returning a 'keyword' to find exploitable columns

I have a problem I'm hoping someone could help with regarding the use of UNION SELECT, in a scripted/automated way to find columns that are exploitable (having already found the number of columns ...
1
vote
1answer
282 views

XSS MySQL Database Accessible?

I'd like to know if there is any danger of someone being able to access the database via XSS vulnerabilities on this page. I have the following link. When you go to this link, the text I've enclosed ...
2
votes
3answers
260 views

SQL Injection - MSSQL

I'm learning about SQL injection and have the following backend code, Set rs = server.CreateObject("ADODB.Recordset") SQL = "SELECT * FROM Registration WHERE name='"&name&"'" rs.Open ...
0
votes
2answers
130 views

Relation between boolean blind SQLi and time blind SQLi?

I am part of a team which developing web app penetration testing framework, and I am taking care of SQLi detection. When I tested multiple known vulnerable local sites found Boolean Blind flaw always ...
9
votes
6answers
8k views

xp_cmdshell: should it ever be used?

Can 'xp_cmdshell' ever be used safely within a stored proc and are there any situations for which there really is no other option? In other words, should it's useage within a stored proc always be ...
0
votes
2answers
164 views

how to find injected code in SQL

Recently one of my sites is hacked. The hacker used SQL injection to compromise the security. After getting SQL access he injected code in many places in database. I cleaned up many of them. But I am ...
5
votes
3answers
1k views

What dangerous characters need to be filtered from user input prior to use in a DB2 SQL query?

I'm looking to fully understand how to properly filter/escape dangerous characters from user input that will be interpolated into a DB2 SQL query. The sanitization routing that I'm analyzing works ...
-2
votes
1answer
526 views

Admin area in my php website is vulnerable to sql injection without login [closed]

my website admin area is vulnerable to sql injection . I tried using havji and it hacked successfully to database. But how is this possible. without login it breaked into admin panel. ...
3
votes
2answers
367 views

Encrypting Fields in Database

I'm working on an ASP.NET web application that will have to store sensitive information. I would like to encrypt the sensitive fields to protect against any possible SQL injection vulnerabilities. ...
7
votes
4answers
2k views

SQL injection Are there any instances where a vulnerable url would not contain an 'equals' (=) symbol

I have a question I'm hoping you could help with? I am looking to filter/grep a very long list of spidered url's from my site to only get the url's that could possibly be vulnerable to sql injection. ...
5
votes
1answer
1k views

My site just got hit with a SQL injection attack, how can I tell what they were doing?

So a page on my site (it's a PHP page that displays newsletter articles) was vulnerable to SQL injection and got hit. I discovered it because it was doing enough database queries to cause the CPU load ...
2
votes
1answer
3k views

SQL injecting a search form which uses boolean mode

I'm testing a web app and I could get Mysql errors by inserting ' in the search field: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the ...
-1
votes
1answer
238 views

How to prevent code injection like automatically adding extra character? [closed]

Code: $result = "Hello World"; $jsonEncodeValue = $result; echo $jsonEncodedValue; Assumed Output: "Hello World" Real Output: \n"Hello World" This \n Line Feed added automatically. For this ...
3
votes
3answers
164 views

SQLi-protection ORDER BY

What would be a good check to remove all possibility of SQL-injection on an ORDER BY col where col is an unsafe variable? I'm currently removing [^A-Za-z0-9_] from the string in php. Is this too ...
1
vote
2answers
875 views

What vulnerabilities in the OWASP Top 10 are relevant to WordPress?

I have been looking at the OWASP Top 10, and am wondering which of the top 10 security risks are relevant to a WordPress installation with various plugins installed? I know injections and XSS are ...
0
votes
1answer
433 views

Blind SQL injection: understanding heavy queries

This article (PDF) talks about a blind injection technique based on heavy queries. Questions: Can anyone explain to me the purpose of using heavy queries while compared to normal time-based ...
1
vote
1answer
943 views

I've heard that salt is not meant to be secret, but what if I made it secret? [duplicate]

Possible Duplicate: Password Hashing add salt + pepper or is salt enough? How to store salt? Ok I have been studying a lot about password hashing lately. And I have a few questions. So I ...
1
vote
2answers
4k views

Sqlmap testing HTTP headers

I was wondering whether sqlmap is able to test HTTP headers for sql vulnerabilities. I know that if I use --level>=3 then it will automatically check for User-Agent and Referer HTTP headers, but I ...
4
votes
5answers
1k views

Are image uploads also vulnerable to sql injection?

I have some good knowledge how sql injections work. I see that the Googling inurl upload.php will tell one about the upload paths in a website. My Question is that if a person finds a path by which he ...
4
votes
2answers
979 views

What exploit types do I need to protect against in PHP?

I recently learned that apparently, it is common for people to attempt SQL injections using the HTTP referrer in PHP. What other inputs do I need to protect against? I am currently "cleaning up" ...
1
vote
2answers
757 views

UNION SQL Injection

I'm trying to demo SQL Injection with a UNION query but I'm not getting results. This is the C# code and the database is SQL Server 2008 R2: string cString = "server=.\\sqlexpress; ...
6
votes
2answers
1k views

What is SQL injection?

What is the meaning of SQL injection? I am not able to understand the term. And what problems may be caused by SQL injection?
2
votes
5answers
262 views

Is there value in storing passwords in their own table with encrypted or hashed keys?

The usual method for simple sites is to store a hash of a user's password right in their user record. What if the password field is removed from the user table, and a password table is created? The ...
5
votes
4answers
346 views

Does any database let you disable non-parameterized queries and therefore disable SQL injection?

Is there a database that allows this already? If not, here is how I think it could be done. I think it would require modifying the database software and the driver or code that is assembling the SQL ...
-2
votes
1answer
779 views

Nessus does not detect sql injection with “Web App Tests” [closed]

In my website I have an sql injection vulnerability. But when I scan my website with Nessus under "Web app tests" there is no result on sql injection. Why is this? What should I do to make this ...
13
votes
3answers
3k views

How do I prevent this type of SQL injection attack?

Our company has been using several tool (Veracode, Appscan, etc) to verify that our applications meet minimum security requirements. I have inherited a legacy application which has several flaws. I've ...
1
vote
3answers
552 views

Sample vulnerable web apps to test Pentesting platforms

I am looking into a web application vulnerability scanner for my organization. I would like a sample web application that is loaded with vulnerabilities (similar to metasploitable on the application ...
2
votes
3answers
597 views

Why are triggers not often used to secure a database?

I did an intern for a company becoming PCI compliant and instead of using triggers to prevent SQL injection, I went through 1000s (if not more) lines of web-app code and called functions every time ...
1
vote
3answers
810 views

SQL — using string concatenation, how can I exploit this procedure?

I have a simple SP create procedure [dbo].[test] @str varchar (100) AS BEGIN select * from [AdventureWorks2012].[HumanResources].[Employee] where JobTitle like '%' + @str +'%' END GO Given this ...
0
votes
1answer
160 views

Comparison between Data Encryption Tools and Data Sanitization Tools [closed]

What are the famous Data Sanitization Tools for languages such as ASP/PHP/Html Web Sites? Which Data Sanitization tools have the best results? Difference between Data encryption and Data ...
4
votes
3answers
1k views

Create a page to experiment with SQL injection [closed]

This semester, I have taken a course on Information Security and my project for this course is to implement an SQL injection to obtain admin privileges. For this I first download Havij software ...
3
votes
3answers
366 views

Is this a web attack I should be concerned about - trying to enter code for form vars

I have a created a simple CGI script running on a web server where a user can login using a username and password. The username and password are entered via a html form and the form POST's the data ...
3
votes
2answers
302 views

Are there special attack vectors for statistical databases?

Are statistical databases vulnerable to SQL injection attacks? If so, what specific kind? Can you think of an example?
2
votes
1answer
2k views

Manual Testing and Exploitation of an SQL Injection

So I read over this, this and this. I understand WHAT an sql injection is and the different TYPES of sql. But none of these guides give a definitive example on how to find, enumerate and exploit the ...
1
vote
1answer
485 views

sql injection: use WHERE statement in address bar

How can i use "Where" statement during an sql-injection attack in address bar ? for example: ... from+information_schema.TABLES+where+TABLE_SCHEMA+=+XXXX-- The code above does not work.
0
votes
4answers
1k views

A faster method than Blind SQL Injection?

Blind SQL Injection is based on TRUE/FALSE tests. Here is an example: is first letter A? --> NO is first letter B? --> YES is second letter A? --> NO ... is last letter X? --> YES It's ...
4
votes
4answers
968 views

How to test for SQL injection query

When testing for SQL injection in an URL like this: example.com/videos.php?id='34, we use character sequences like: ' " """" /*/ -' -- And many others... How could you test links like these for ...
3
votes
3answers
250 views

Does SQL have any inherant weaknesses?

A prof said that SQL injection is misnamed because it actually occurs from the program generating the SQL (e.g. Perl, PHP etc.) and I'm wondering is SQL "complex" enough to have any vulnerabilities ...
2
votes
1answer
460 views

Using mysql root account to execute root commands

Suppose that I have full root access to mysql databases, but not root user shell (linux). How can I use the full root access to mysql databases to execute root commands?
1
vote
2answers
337 views

Strange Pharma Spam Site resulting from DAT file created by SQL Injection?

Working on cleaning up a site compromise for a client. Leaving aside that the site is using bunch of custom CodeIgniter code written by someone who had no concept of security, I've ran into a ...
10
votes
1answer
1k views

How to properly secure a $_GET in PHP?

I found an SQLi in a buddies work site. He reported it to his superiors and they allowed me to run additional tests and also patch the site. After reviewing the site, The vulnerable code was a $_GET. ...
9
votes
1answer
887 views

How to make SQL injection in PostgreSQL's tsquery?

I think there is SQL injection vulnerability in an application I'm testing. This is seen when I enter malformed parameters into a search form. All exceptions are shown in format: PHP raised unknown ...
0
votes
3answers
4k views

How to exploit this SQL inection vulnerability?

I am learning SQL injection on a vulnerable Web App. I scanned it with w3af. It showed many vulnerabilities. One of them is : SQL injection in a Microsoft SQL database was found at: ...
4
votes
2answers
715 views

Security web scanner tool for IIS/SQL Server

I'm trying to do penetration testing of our ASP.NET web-site to check for security loopholes (specifically for SQL injections). We bought a commercial web scanner tool (IBM Rational AppScan), however ...
2
votes
2answers
554 views

Potential insecurity in not sanitizing variables before INSERT with prepared statement in PDO

I use PDO with prepared statement when connecting to my database, and I do this because it is considered a safe way to do so, but one thing I could not help but to wonder was, can submitted data from ...
-1
votes
4answers
4k views

SQL injection for a username/password form?

This is how user validation happens on my site: if(!empty($_POST['username']) && !empty($_POST['password'])) { $query = "SELECT * FROM users WHERE username='".$_POST['username']."' ...
9
votes
3answers
1k views

Should IP addresses be validated to prevent SQL Injection?

In PHP I retrieve a user's IP address ($_SERVER['REMOTE_ADDR']) to use it in some MySQL queries, but I do not validate them to be true IP addresses. Should I validate user IP addresses before using ...
1
vote
3answers
909 views

Could some one please explain - Remote Post SQL Injection

Would anyone be able to post a link to an article which explains how to do a Remote Post SQL Injection and how to prevent anything bad happening. Or even just explain on here. Any help would be ...
3
votes
3answers
6k views

Why can't sqlmap find an SQL injection in my code?

I installed XAMPP on my development PC, and started Apache HTTP server and MySQL. It comes with a test page "CD collection", with the following back-end PHP code: mysql_query("DELETE FROM cds WHERE ...
2
votes
1answer
667 views

Example of attack trees in the web application security analysis

Here I am again asking for some informations about attack trees usage in web application analysis. For my master thesis I decided to study the usage of this formalism in order to reppresent attacks ...