SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database.

learn more… | top users | synonyms

2
votes
3answers
3k views

Regarding SQL Inject me Firefox add-on?

Using SQL Inject Me Firefox add-on,I have selected the check-boxes then click on Execute button of SQL Inject Me tool. After getting result, it has displayed following responses Server Status Code: ...
1
vote
3answers
374 views

What is best method for retest blind sql vulnerability

I tested web site application with commercial automated tool.There are some blind sql injection.I want to retest this results .Is there any good method for test blind sql injection with tool or ...
2
votes
1answer
2k views

Sqlmap - appears to be UNION injectable

I am using sqlmap for finding out sql-injection threat on our application. So, here is my url : " http://myurl.net/question/teaching/answer/sujan-justice?as=Course ", and i tried to perform the ...
0
votes
1answer
1k views

Using timeouts to automatically detect blind sql injection exploits

I'm working on a penetration testing tool, and I have error-based sql injection pretty much covered, but I was wondering, is it possible to use timeouts, along with built in sql commands to detect an ...
3
votes
1answer
672 views

Why does MySQLi using question marks (?) instead of the sprintf formatting?

As the title states, why does MySQLi use question marks instead of sprintf() formatting? For example, why is it $stmt = $mysqli->prepare("SELECT * FROM table WHERE column1 = ?"); ...
-1
votes
1answer
535 views

Open Source tool for analysing javascript for security vulnerabilities [closed]

I am completely new to this field and am a college student. I am looking for a static code analysis tool that scans the source code of a web app ( NOT the URL) for security vulnerabilities. So far i ...
2
votes
2answers
2k views

Is $_REQUEST['id'] vulnerable to sql injection

I have the code below in my newsview.php.I want to know why the code below vulnerable to sql injection.I already test the sql injection in the code below. $id = intval($_REQUEST['id']); $result = ...
1
vote
2answers
10k views

Uploading Shell Using SQLI

I found an SQL injection vulnerability in a Wordpress installation inside one of my lab machines and I am trying to leverage it to upload a shell. I can get the admin hash but it seems that it is ...
2
votes
1answer
1k views

How to use sqlmap to perform SQL injection on a clean URL?

I am learning to use sqlmap and came across an application that has Clean URLs. Clean URL example //my url.net/project/public/#questions/question/edit/id/122/answer/1, here MVC framework is used. ...
-2
votes
2answers
967 views

Is this site vulnerable to sql injection? [closed]

I have my site build from a company. I read about website vulnerabilities on the internet and i did some test on my site. It throws these errors. QueryString key:TutorialId was expected to be of ...
11
votes
1answer
1k views

How is time-based SQL injection different from other types of SQL injection?

I understand what a time-based SQL injection is, and I understand how it works (at least how it's detected/exploited). However, is there anything in specific which makes this type of injection any ...
6
votes
2answers
287 views

SQL injection across multiple tables

If a website has multiple web apps, each of them connected to different tables in a database and all of the apps are protected from SQL Injection except one; can that one web app be used to ...
1
vote
4answers
7k views

SQL injection with “INSERT” statement

I am currently studying the most basic SQL injections that are possible. Pure and solely for the purpose of teaching myself the basics before advancing to more advanced ones. I am recreating this ...
1
vote
2answers
10k views

sqlmap unable to find SQL injection vulnerablitity

so i just started up with sqlmap to learn sql injection vulnerability on my application. Here I followed steps as per some tutorials. So this are the steps which i followed : sqlmap.py -u ...
5
votes
4answers
7k views

How to get the output of a SQL injection?

This is just for learning purpose. I want to get all the usernames and passwords from a table in a MySQL server, where "magic quotes" have been disable. In the input for the username: I put something ...
4
votes
1answer
465 views

How to prevent ASCII Encoded / Binary String SQL injection in CodeIgniter

I have been using CodeIgniter for two years and I am digging into penetration testing. I think that ActiveRecord does good job at preventing SQL injections, but is there any possibility of bypassing ...
14
votes
3answers
6k views

Is it possible to do SQL injection (HIGH Level) on Damn Vulnerable Web App?

I searched all over google to see how it would be possible to bypass the following (it's from the high level of security from DVWA): <?php if (isset($_GET['Submit'])) { // Retrieve data $id ...
0
votes
1answer
373 views

What are the reasons this SQL injection code wouldn't work? [duplicate]

In Software Assurance class I was asked a question why following query allows SQL injection which will allow log in into unsafe phpBB version but will not allow any modification of the database. We ...
4
votes
3answers
2k views

MySQL SQL injection without stacked queries - what is actually possible without affecting the FS?

I am exploring a vulnerability in one PHP website that is basically riddled with SQL injections. With SQLMap, I managed to dump all the tables and get some basic information (username, DB name, ...
2
votes
4answers
4k views

SQL Injection with pass MD5

I want to know, if in my login form there is any SQL injection possible. If there is, what could the exploit's web form entry look like? I send username and password by html form (POST). The login ...
2
votes
2answers
441 views

How to get URL behind REST-style

I've asked same question on StackOverflow but topic passed away with no answers except few comments so I'll try to ask the same question here as it's probably more specific to security. The only ...
1
vote
3answers
305 views

Vulnerability scanner shows SQL errors were disclosed.How Severe it is?

When I scanned my site for Vulnerabilities I found this error. Various SQL errors were disclosed within the application source code or other files. I have checked for sql injection and confirmed ...
0
votes
1answer
443 views

SQLMap extracts weird chars in one column

I saw this behaviour many times but I never solved it. Sometimes using sqlmap after retrieving good data from columns it fails retrieving only one of them. I can't figure out why this happens for just ...
1
vote
2answers
1k views

CGI generic sql injection

I was scanning a site with Nessus when the following vulnerability was reported: CGI Generic SQL Injection Nessus says that: "An attacker may exploit this flaw to bypass authentication, ...
1
vote
2answers
2k views

Getting a SQL injection past a given regex [duplicate]

I have been shown one regex which, per the one who wrote it, should protect against SQL injections on SQL server 2008. It doesn't really look like it, but I'm wondering exactly what code I can get ...
3
votes
1answer
913 views

SQLMap: How to test JavaScript generated field names?

I have a pretty simple HTML page that submits a username and password to the server via POST method: <doctype html> <head> <title>SQLMap dynamic parameters</title> ...
2
votes
1answer
114 views

Ethical approach about corporate website and vulnerabilities [closed]

I like web security and i have academic formation about that. Just for fun I found a website (insurance company) with critical vulnerabilities like xss or sql injection. Now, I obviously will alert ...
3
votes
2answers
1k views

ASP.NET SQL Injection

I have custom authentication system on my ASP.NET website that can help me to register users from my Windows (Desktop) and mobile (Android) Applications.It means that I don't use ASP.NET ...
4
votes
6answers
10k views

Are there any tools for scanning for SQL injection vulnerabilities while logged in?

Some pages of my website were vulnerable to SQL injection. The injection worked only when the user was logged in. I have now fixed this problem, and now I want to make sure that no similar problems ...
7
votes
4answers
2k views

How to white hat Pen Test SQL injection

I will start off with saying apologies if this is something that has been asked 100s of times or is moot question within testing circles. I have come across this article I'd like to test this out ...
2
votes
1answer
1k views

How to save the random salt to the database

As I understand it, salting and hashing passwords is the way to go. I also understand that to authenticate a salted and hashed password, the random salt needs to be saved. Does this mean that if I use ...
1
vote
1answer
993 views

“ScriptResource.axd” vulnerability in Windows Server 2008

I am using Windows Server 2008, Plesk 9.5, IIS 7, SQL Server 2008, and recently I have received and email claiming this server is vulnerable, and sent me the following URL: ...
2
votes
3answers
342 views

Is + as an alternative to %20 an attack vector?

I was reading a Q&A on enabling + characters in URLs for Sitecore CMS, and the answer states: ASPNET application does not allow using “+” from the security point of view e.g. preventing SQL or ...
2
votes
2answers
2k views

Sqlmap and multipart/form-data forms

I'm working on some security for a website that is built in classic ASP and MS SQL 2000. I've successfully found a couple of flawed forms that allowed SQL injections through the form fields by using ...
2
votes
2answers
690 views

Suspicious entries in MySQL database from user input forms - sql injection?

I built a website from scratch using PHP and MySQL for my residential community and our budget is a big fat '0'. Five days ago I discovered that there were 222 entries in a table in my database that ...
4
votes
3answers
1k views

SQL injection using letters and numbers?

I was wondering if it is at all possible for a hacker to perform an SQL injection attack using just letters and numbers. For example, let's take a look at this PHP code which uses regular expressions ...
2
votes
2answers
2k views

How to deal with MySQL's Errcode 13 when trying to write a shell

My attack machine is running Kali and the server is running CentOS 6.4 with DVWA. I'm trying to write a shell through an SQL injection. The payload is ' UNION SELECT '', '<?PHP ...
1
vote
2answers
2k views

How to detect and exploit an SQLi in a POST method

Making it simple (no security at all), when we want to detect whether or not a GET parameter is vulnerable to SQLi, we could just type a ' as the value (?id=') and check if there is any error. (No ...
2
votes
2answers
2k views

Sqlmap fails at enabling xp_cmdshell procedure

I have been browsing the web looking for some help regarding the following issue. I am currently performing an web application penetration test, and I had come accross a beautiful blind SQL Injection. ...
2
votes
3answers
8k views

No single quotes is allowed, Is this SQL Injection point still exploitable?

The SQL phrase looks like this, "SELECT * from XX where id = '" + id + "'" The id variable comes directly from the GET parameter named id. And the Java web app explicitly disallowed single quote. ...
6
votes
2answers
946 views

Backdoors after SQL injection?

I just found an injection vulnerability on a live site of a client. It looks like this: $sql = "SELECT * FROM users_dl WHERE Username = '" . $Uname . "' AND Password = '" . $Pword . "'"; I ...
3
votes
2answers
1k views

What makes a SQL Injection counted as blind injection?

Firstly, from what I have read so far, boolean based blind sql injection is you can't see any error messages and rely on true or false query to milk the database. eg. Craft a query that will ask the ...
5
votes
2answers
12k views

How SQL Injection works through URL

I am Web developer , but i don't understand something , i did search and asked many but they know it is just there but the don't give me a technical answer: Main Question : How SQL Injection works ...
5
votes
1answer
432 views

Is Taking advantage of the IsNumeric() Function In VB.Net Through SQL Injection Possible?

Suppose this is the only mitigation used on a server: Dim IDPerson IDPerson = Request.Querystring("id") If IsNumeric(IDPerson) = True Then IDPerson = IDPerson Else IDPerson = 0 End If IDPerson is ...
5
votes
5answers
4k views

How to make a site vulnerable to SQLi?

I've recently taken an interest in SQL injections - it (for some reason, correct me if I'm wrong) seemed like a good place to start (I am pretty much a beginner). Anyways, I want to make a site that I ...
7
votes
3answers
3k views

What kind of attack was this?

So our website was hacked, and these are the things that were done: Some entries in the database were changed. I don't know if this was via SQL injection, or direct database access (only root is ...
2
votes
3answers
1k views

sql injection, exec and preg_replace filter

Ive been informed this is not safe to use in regards to sql injection: preg_replace("/[\"'%()@$.!&?_: #\/-]/","", mysql_real_escape_string($_GET['var'])); what would be the difference in the ...
4
votes
2answers
460 views

Protecting Password Hashes with Store Procedures?

I was thinking about the recent (seemingly weekly) security breaches we've seen where millions of password hashes have been leaked and I was wondering how one might secure their site against a ...
2
votes
4answers
729 views

Generic defense againt SQL injection

This is a little bit of a rant, but there's a real question at the end. I recently installed a new perl script on a site (which will remain nameless) which failed mysteriously with an error 403. ...
2
votes
4answers
5k views

Does escaping quotes protect me from SQL injection?

A newbie question here. I've just read through a short introduction to SQL injection on http://www.breakthesecurity.com/2010/12/hacking-website-using-sql-injection.html?m=1 It says to find a GET ...