SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database.

learn more… | top users | synonyms

19
votes
3answers
49k views

How do I test for SQL injection vulnerabilities on a site with input fields?

What methods are available for testing SQL injection vulnerabilities?
3
votes
3answers
3k views

Hibernate SQL Injection - Fortify 360

I am using Fortify 360 to analyze my code's security. Fortify has identified a Hibernate based delete method to perform a delete based on an object that has been passed in. My understanding of ...
2
votes
3answers
629 views

How does Facebook avoid crawling over their site?

I used Netsparker community edition and tried to find a vulnerability in my personal site. Then I thought let's try with Facebook. It didn't show a single webpage also because normally it shows ...
1
vote
3answers
299 views

Deploying vulnerable web application onlineā€

I am deploying a vulnerable web application for students (about 100) in a university, that they can test online and am collecting all the traffic for research purposes. I am deploying this machine on ...
11
votes
2answers
950 views

Interpolique: transparently preventing SQL Injection and XSS with base64 encoding, what happened?

For the keynote at The Next HOPE a couple of years ago, Dan Kaminsky unveiled Interpolique (the talk is really fun btw). The problem he raised was how to defend against injection attacks, including ...
4
votes
2answers
151 views

Changing windows client form values at runtime

I am performing a code audit of an older VB6 application which uses dynamically constructed SQL to execute against the database. While I see this as a SQL injection point, the developer contends that ...
5
votes
2answers
1k views

Scanning DVWA with w3af - Unable to detect SQLi when security on low

I've been messing around with DVWA (Damn vulnerable web application) and w3af. I've been scanning DVWA with w3af, and have used the spiderMan proxy and http config to setup auth credentials to get ...
0
votes
2answers
164 views

How much security should I use for my web application?

My question is, for a "normal" site, what do you think is enough to secure against methods used by "script kiddies"? For example, SQL injection, XSS, and stuff like that. Same question for password ...
5
votes
3answers
696 views

Best way to alert a website owner of a vulnerability?

recently i was browsing a site, and i noticed that at the end of the URL it said id=168, which is a common indicator that the site is vulnerable to an SQL injection attack. i did some tests and found ...
1
vote
0answers
176 views

How anonymous used UTF-16 ASCII to fool PHP escaping [duplicate]

Possible Duplicate: How anonymous used UTF-16 ASCII to fool PHP escaping (Reposted here as per request). A few months ago, anonymous took down a child pornography site using SQL-injection. ...
19
votes
4answers
6k views

How did Anonymous use UTF-16 ASCII to fool PHP escaping?

A few months ago, Anonymous took down a child pornography site using SQL-injection. I read in this article that Anonymous claimed that "the server was using hardened PHP with escaping," but they were ...
3
votes
4answers
4k views

How is my website vulnerable for sql injections?

I am running a small website where I have published some articles. I am also very interesed in security topics and tried sqlmap on my website. It found the database name, so my question is how it ...
6
votes
2answers
1k views

What is SQL injection?

What is the meaning of SQL injection? I am not able to understand the term. And what problems may be caused by SQL injection?
3
votes
4answers
1k views

SQL query sanitation (black list)

I have a following problem/challenge: Web application (ASP.NET 3.5) installed on corporate LAN and operates on SQL Server DB needs to provide ability to generate custom reports. These reports can be ...
2
votes
2answers
755 views

How can an IPS\IDS detect SQLi \ XSS (or other application layer) attacks?

I've been thinking about how an IPS works, and as far as I know it inspects the packets on the TCP\IP layer. How can it detect attacks on higher levels without harming the user experience? How does ...
0
votes
3answers
4k views

How to exploit this SQL inection vulnerability?

I am learning SQL injection on a vulnerable Web App. I scanned it with w3af. It showed many vulnerabilities. One of them is : SQL injection in a Microsoft SQL database was found at: ...
6
votes
2answers
242 views

Presentation on Web App Security (ACM Student Chapter)

I am a member of the local ACM student chapter in my university and as part of our activities I am scheduled to give a talk on current issues on Web Application Security (and possibly secure coding ...
13
votes
2answers
5k views

Multibyte character exploits - PHP/MySQL

Could someone please point me to a link with some information on multibyte character exploits for MySQL? A friend brought them to my attention, but I've not been able to find much information on the ...
6
votes
1answer
1k views

Do I have to make any more check if I use prepared statements for integers?

I am currently using PDO with prepared statements for some integer values (see PDO::PARAM_INT). That means I call PDO like this: $stmt = $conn->prepare("SELECT `lastMove` FROM ".GAMES_TABLE. ...
15
votes
3answers
15k views

SQL injection with AND 1=1

Please explain the meaning of "AND 1 = 1" in a SQL injection attack. It's from an exercise in my university. E.g. select * from user where id = 'smith'' AND 1=1;-- and birthdate = 1970; or ...
5
votes
3answers
3k views

Does mysql_escape_string have any security vulnerabilities if all tables using Latin1 encoding?

I have heard that the PHP function mysql_escape_string has security vulnerabilities related to mult-byte characters. Are there any vulnerabilities if all tables are using Latin1 encoding?
2
votes
4answers
2k views

Is replacing all apostrophes with two apostrophes sufficient to prevent SQL-injection on MSSQL?

I'm working in a web site that doesn't use parameters on SQL queries. All the queries are adhoc and the way they are doing the input validation seems good to me, I'm not able to break it to do SQL ...
4
votes
2answers
1k views

Is it possible to test for Postgres BlindSQL injection using pg_sleep() in a WHERE clause?

In mysql, I am familiar with using the following payloads to test for blindsql when the WHERE clause is vulnerable (all payload examples from fuzzdb): 1 or sleep(TIME)# " or sleep(TIME)# ' or ...
15
votes
4answers
5k views

Levraging a shell from SQL injection

As I understand it, SQL injection should only allow for the manipulation and retrivial of data, nothing more. Assuming no passwords are obtained, how can simple SQL injection be used to leverage a ...
8
votes
3answers
4k views

How to patch against RefRef's DOS attack

Overview Anonomous claimed responsibility today for the Denial of Service attack against wikileaks. They are using a new software called RefRef. It seems to exploit MySQL using the server's ...
10
votes
2answers
935 views

What are the SQL-injections issues of parameterized queries?

I've written some code to generate an SQL query in ASP classic. I'm not sure if it's secure or not: Set adoCon = Server.CreateObject("ADODB.Connection") adoCon.Open "Provider=Microsoft.Jet.OLEDB.4.0; ...
7
votes
4answers
4k views

Testing clean urls with sqlmap

Is it possible to test for SQL injection vulnerabilities with using sqlmap with a url that is using mod rewrite (or something like it) to make the urls clean? I know how to test my sites that have ...
2
votes
1answer
248 views

How to evade a signature to detect “xp_cmdshell” for SQLi?

What methods can be used to bypass a signature which detects "xp_cmdshell"?
5
votes
1answer
586 views

SQL Injection on URL, not on parameters

Should WAF or any protecting method, block SQLi done on URLs?(eg GET /test/url'or 1=1--)
6
votes
2answers
5k views

Testing SQL injection using sqlmap

I'm just started using sqlmap ( http://sqlmap.sourceforge.net ) to test for possible sql injection attacks. I got a website which is vulnerable: C:\Python27>python xxx\sqlmap\sqlmap.py -u ...
8
votes
3answers
740 views

Suggestion setting up a SQL injection honeypot

I just stumbled on a website vulnerable to an SQL injection attack by mistake ( http://stackoverflow.com/questions/6181248/is-this-site-vulnerable-to-an-sql-injection-attack ). That made me curious ...
10
votes
5answers
1k views

SQL Injection in a Non-Web Application

Does someone know of a good example of a SQL Injection vulnerability that isn't in a web application? What is the user input for this attack? I am looking for a real vulnerability, not speculation. ...
51
votes
7answers
12k views

SQL injection — but why isn't escape quotes safe anymore?

I haven't seen this question asked, and feel it's a valuable bit of information to have, especially because this is a huge source of mystery and confusion. Raw SQL When you're writing SQL -- for ...
9
votes
6answers
8k views

xp_cmdshell: should it ever be used?

Can 'xp_cmdshell' ever be used safely within a stored proc and are there any situations for which there really is no other option? In other words, should it's useage within a stored proc always be ...
3
votes
2answers
449 views

I'm Trying to Find how to Exploit my SQL Code

I'm trying to find a way to exploit my stored procedure to test for security problems, I have specifically been testing for SQL truncation-based injection, but I did not succeed so far; I don't think ...
9
votes
3answers
879 views

Demonstrating SQL injection on the following

I've got lines in my php/mysql code which look like this: ... $sqlquery = "SELECT price FROM products WHERE 1=1 AND id=".$_POST['id']; ... ... query is executed ... echo $price; As a ...
-1
votes
4answers
4k views

SQL injection for a username/password form?

This is how user validation happens on my site: if(!empty($_POST['username']) && !empty($_POST['password'])) { $query = "SELECT * FROM users WHERE username='".$_POST['username']."' ...
1
vote
1answer
337 views

Is this enough to tackle script / malicious code insertion in GET, POST requests?

I've got legacy PHP code which attempts to prevent script / SQL injection with the following: if (!empty($_POST)) { reset($_POST); while (list($k,$v)=each($_POST)) { ...
17
votes
7answers
1k views

How to exploit the “PHP_MAGIC_QUOTES ON” vulnerability in order to cause max damage?

I've found a whole lot of SQL injection exploits in some systems I maintain. I know how to prevent the injection, but I would like to demonstrate to my CEO and CTO how dangerous it is if we don't have ...
14
votes
7answers
1k views

SQL Injection Prevention

SQL Injection is always a hot topic particularly when it comes to web security. In this regard I am interested in what are the steps that should always be taken to prevent SQL Injection within any web ...
16
votes
2answers
1k views

Does an ORM framework such as hibernate completely mitigate SQL injection?

I know that to prevent (prevent all or most?) SQL injection attacks that you should use parametrized queries. I've been using hibernate for a while instead of hand writing my sql statements. Are there ...
16
votes
4answers
2k views

Does stored procedure prevent SQL Injection in postgreSQL

Is it true that stored procedure will prevent databases from being injected? I did a little research and I found out that SQL-Server, Oracle and MySQL are not safe against SQL injections if we only ...