SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database.

learn more… | top users | synonyms

0
votes
2answers
688 views

How to perform SQL injection with real_escape_string filter in place?

can someone give me an example of mySQL injection payload, which will bypass the real_escape_string() sanitize filter in regards to the below php example. function sanitizeStrXSS51($var) { global $...
2
votes
1answer
297 views

Learning ethical SQL injection with php login form

I'm learning ethical hacking and now I'm on sql injection topic. I'm also new to SQL and php. Ok, so I have local damn vulnerable website with back-end Linux, MySQL and Apache and now trying to use ...
0
votes
2answers
104 views

SQLmap over uni wifi [closed]

I don't know if this is the right place to ask this question but I'll give it a shot! I was playing around with Kali and SQLmap. I was just scanning some sites nothing serious. When I was doing this I ...
0
votes
2answers
201 views

SQL injection at work [closed]

We have a web form that can be filled out with text fields and then they get emailed to us at work. Today we got some SQL commands it looks like in a bunch of emails. I just would like to have a bit ...
-1
votes
2answers
566 views

How to use ORM correctly to prevent SQL injection?

I read here that using ORM (like nHibernate) does not necessarily prevent SQL injection; for example, if you keep creating dynamic queries using your ORM framework you are still vulnerable. Fine, ...
17
votes
3answers
2k views

Does an ORM framework such as hibernate completely mitigate SQL injection?

I know that to prevent (prevent all or most?) SQL injection attacks that you should use parametrized queries. I've been using hibernate for a while instead of hand writing my sql statements. Are there ...
0
votes
3answers
159 views

How to validate report given by a white hat hacker

I give a contract to find vulnerabilities in my site to a white hat hacker. According to him he performed several attacks on my site for 15 days and find that there is no any security threats. I am ...
4
votes
1answer
663 views

How to prevent ASCII Encoded / Binary String SQL injection in CodeIgniter

I have been using CodeIgniter for two years and I am digging into penetration testing. I think that ActiveRecord does good job at preventing SQL injections, but is there any possibility of bypassing ...
2
votes
3answers
232 views

Is there an SQL injection equivalent on url-passed parameters to a servlet?

In SQL injection an attacker can craft a string that if left unchecked and executed it can complete and execute arbitrary SQL commands. Is there an equivalent to these kinds of attacks in JSP pages? ...
1
vote
4answers
2k views

String sql injection vs sql injection

What's the difference between normal sql injection and string based sql injection? An example would be appreciated. As far as I understand from the few readings around the net, string based sql ...
2
votes
1answer
248 views

Error-based SQL injection

I understand the conceptual idea behind error-based SQLi, but not the actual execution. In particular, I can't make sense of this expression: or 1 group by concat_ws(0x3a,version(),floor(rand(0)*2)) ...
5
votes
2answers
114 views

Is the separation of data from different applications via Oracle schemas considered secure?

I am evaluating the pros and cons of having different Oracle schemas vs. separate Oracle servers. Having a dedicated server for each application is really expensive and I only want to consider this if ...
0
votes
1answer
344 views

SQL injection on query (MySQL/PHP) [closed]

First, sorry if my issue is a duplicate! This is an exercise that I can not solve. It is an authentication, simply. But the problem is that the application does not check both the password and ...
18
votes
6answers
4k views

Can SQL injection lead to remote code execution?

Is it possible to execute some code (e.g. PHP code on a PHP-based web application) on the server through SQL injection? If yes, how exactly? I understand that un-escaped field can lead to SQL ...
36
votes
6answers
7k views

Is SQL injection possible with LIMIT?

A friend of mine built a web application that I'm testing for fun. I noticed that he allows a user to set the limit of a certain query, and that limit is not sanitized. For example, I can choose any ...
0
votes
1answer
115 views

Performant ways to identify potential SQL injection vulnerabilities in web applications [closed]

I [itsec novice] am developing a workflow/application for identifying potential SQL injection vulnerabilities in web applications and would like to get some professional opinions on my approach. ...
-1
votes
1answer
106 views

my table is dropped in PDO [closed]

This is my PDO method i used this method to save input value to SQL After reading this pdo-prepared-statements-sufficient-to-prevent-sql-injection Since Am started learning PHP i don't know this ...
3
votes
4answers
13k views

Why can't sqlmap find an SQL injection in my code?

I installed XAMPP on my development PC, and started Apache HTTP server and MySQL. It comes with a test page "CD collection", with the following back-end PHP code: mysql_query("DELETE FROM cds WHERE ...
1
vote
3answers
245 views

Beyond SQL injections and XSS

I'm a programmer working on a web service (by myself). Given the fact that I am not a security expert, I came to this website to ask my question. I did all the major things to secure my website. I ...
2
votes
1answer
171 views

Basic Website Protection (XSS,SQL-inject,hashing)

I have a very simple app that does allow unauthenticated users to leave comments (maybe later I will incorporate a capatcha). The app then stores the comments in a mysql db. I do my best to filter out ...
4
votes
2answers
162 views

How do honeypots remain secure to 0days and newer exploits?

If honeypots are designed for a specific set of exploits, such as SQL injection and XSS, how do they protect themselves against other exploits? For instance, if I created a honeypot a few months ago, ...
-1
votes
3answers
209 views

SQL Injection solutions [closed]

I'm editing my question to clarify what I'm trying to ask. In order to launch an SQL injection there should be someway to get input from the user (i.e. username and password) for instance. So I've ...
1
vote
1answer
247 views

Is dot character safe against sql injection?

I'm modifying the search module of prestashop in order to be able to search strings containing dots : . Prestashop uses its own sanitize functions against mysql injection vulnerability (yeah...) and ...
-1
votes
1answer
134 views

Interesting security demos for beginners [closed]

I am thinking about a creating short security demo to get people interested in the security topic. I've had a couple of ideas just want to see if anyone has anything else interesting. Edit: I was ...
4
votes
2answers
223 views

In what situations does parameterizing a query NOT prevent SQL Injection?

While this isn't terribly common, I know that SQL Injection is still possible with a parameterized query, if you are calling a stored procedure that uses a parameter to construct and execute dynamic ...
1
vote
1answer
417 views

Do PHP/SQLI Prepared Statements Need Special Character Escaping?

I'm using php/mysqli queries such as this: $stmt = $con -> prepare("INSERT INTO `comments` (`uid`, `article_id`, `status`, `comment`) VALUES (?, ?, ?, ?)"); $stmt -> bind_param('iiis', $uid, $...
4
votes
2answers
472 views

Placeholders for cshtml — ASP.NET

I'm learning Application Security, and tutorials such as www.asp.net discuss updating databases with placeholders, instead of directly using user input @{ var title = ""; var genre = ""; ...
10
votes
3answers
4k views

SQL Injection if table structure/db structure not known

could an attacker who'd just found out that you're using mysql make an SQL Injection attack with only this information? If you don't know Any table/db name how come you can find it out? Is that even ...
4
votes
2answers
5k views

SQL Injection Modify / Insert Table Values

Is it possible to update a field in a MySQL database or insert a new row using SQL injection in this case: The only protection in the PHP code is mysql_real_escape_string(). The query is ...
-2
votes
2answers
379 views

How to know table name, and column names for login panel

I want to know the table name and column names of that table in website login page. How should I do that. There are only two input fields, Username and Password. And it is vulnerable to Sql ...
2
votes
0answers
40 views

Navigating SQL Injection Safeguards [duplicate]

I'm trying to get around the DVWA high security SQL injection challenge, I've tried a bunch of automated scanning tools with no luck, read a bunch of articles saying it's impossible now i've turned to ...
0
votes
3answers
1k views

Does this simple function add something to prepared statements?

I've been researching how to completely prevent against SQL injection, but there are so many different forms of injecting that completely preventing it looks impossible to me. I am using prepared ...
6
votes
1answer
801 views

SQL injection with single statement query

Suppose I had a vulnerable query like this: var q = 'SELECT x FROM y WHERE id = ' + req.body.id + ' ORDER BY date DESC;'; For the purposes of this question, req.body.id could be any integer ...
1
vote
1answer
2k views

Devious Blind SQL Injection Payload

I came along this blind SQL injection time based payload and I need to understand how it works (select(0)from(select(sleep(0)))v)/*'+(select(0)from(select(sleep(12)))v)+'"+(select(0)from(select(sleep(...
2
votes
3answers
661 views

How do attackers find the database technology used by a web application?

These days there are several database technologies are available for data storage purpose. While performing injection attacks, how do attackers actually identify the database used by a website? If ...
2
votes
2answers
364 views

ASP.NET SqlDataSource injection risk

I have an internal website (going on the intranet) that is going to go through vigorous testing to make sure that it is secure, so I am battening down the hatches so to speak and I coded a .NET ...
7
votes
2answers
4k views

What is the meaning of “something AND 1=0” command in SQL?

I have read somewhere that in SQL injection attacks the attackers use such keywords into application entry points. Whats the purpose of doing this?
1
vote
1answer
242 views

What is the main function of xp_cmdshell in SQL Server and what are its related security issues?

I was researching on Injection issues in MS SQL Server. I came to read about xp_cmdshell. I think this must be enabled in the SQL server for attackers to perform many exploits. Actually what is this ...
14
votes
3answers
6k views

Why do testers often use the single quote ( ' ) to test for SQL injection?

It has been seen that security testers input either ' or ; into the application entry points to test for SQL injection. Why are these characters used?
4
votes
3answers
218 views

Is my vendor vulnerable to sql injection?

The company I work for has recently moved to an external vendor for payroll services. We did an initial upload of data from our old system to the new vendor. I noticed that our employees that have ...
2
votes
1answer
178 views

Why isn't recommended to use time-based blind for bruceforcing table/column names?

When not having priveleges on the session user you're using with sqlmap this warning appears when trying to retrieve table/column names, offering you to brute force names using a dictionary file, do ...
-1
votes
1answer
1k views

Is attempting mySQL injection illegal? [closed]

I was testing an SQL injector I made in Java and the site I tested it on said 'Detected security breach attempt' blah blah blah. Is what I did illegal or not? I have found different opinions and ...
8
votes
6answers
3k views

Faster SQL injection prevention

I looked around everywhere and I can't find the answer to my question. I'm using the latest PHP for server-sided scripting and MySQL for my database. The character set is utf8mb4, if that makes a ...
0
votes
3answers
2k views

SQL injection filter evasion

During manual SQL injection testing I came upon this. Is there any way to bypass these filters that supposedly prevent a UNION based attack? <?php error_reporting(0); include('db.inc.php'); $id=...
1
vote
2answers
853 views

Assigning cPanel MySQL Privileges

When I log into cPanel, I go to create a new MySQL Database with the wizard. Usually, it is recommended to assign the database user with all of the permissions from Insert, Update, Alter, Execute, etc....
1
vote
1answer
763 views

someone is trying to SQL injection me.. what are they trying to do?

I get a lot of logs saying someone is trying to reach /sign_in?t=login'+union+select+char(38,126,33),char(38,126,33),char(38,126,33),char(38,126,33),char(38,126,33),char(38,126,33),char(38,126,33),...
1
vote
1answer
391 views

how to null out a insert statement?

I am doing a SQLi-Quiz. Below is the orignal statement. insert into users(name,pass) values('bob', [injection point here]) The statement is heavily filterd because the website which supplys the ...
4
votes
1answer
232 views

Weird condition in blind SQL injection point, substr() is valid for exactly two chars

I'm exploiting a blind SQL injection point, which takes a variable as username then check if the username exists in a table. (It's running MySQL 5.X with PHP) So I'm using this to retrieve all ...
0
votes
0answers
2k views

SQLMap and Manage Engine Service Desk Plus Union Injection

Would like some assistance against this SQL injection: http://www.exploit-db.com/exploits/11793/ Proof of Concept: Microsoft Windows Environment with MySQL: http://x.x.x.x:8080/WorkOrder.do?woMode=...
1
vote
1answer
6k views

sql injection vulnerability to codeigniter

Hello i want to know why this kind of example question never been asked before. i got this code from my college that they say this kind of code is able to prevent sql injection we use codeigniter to ...