SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database.

learn more… | top users | synonyms

3
votes
3answers
353 views

Does SQL have any inherant weaknesses?

A prof said that SQL injection is misnamed because it actually occurs from the program generating the SQL (e.g. Perl, PHP etc.) and I'm wondering is SQL "complex" enough to have any vulnerabilities ...
4
votes
4answers
1k views

How to test for SQL injection query

When testing for SQL injection in an URL like this: example.com/videos.php?id='34, we use character sequences like: ' " """" /*/ -' -- And many others... How could you test links like these for ...
2
votes
1answer
587 views

Using mysql root account to execute root commands

Suppose that I have full root access to mysql databases, but not root user shell (linux). How can I use the full root access to mysql databases to execute root commands?
1
vote
2answers
2k views

SQL Injection tool (Mac OS X) [closed]

Do you know any software for searching (analyze) SQL injection (on website) from Snow Leopard ? I have found some that can run from Linux or Windows. I understand that most Linux (console) ...
9
votes
1answer
1k views

How to make SQL injection in PostgreSQL's tsquery?

I think there is SQL injection vulnerability in an application I'm testing. This is seen when I enter malformed parameters into a search form. All exceptions are shown in format: PHP raised unknown ...
2
votes
2answers
774 views

Potential insecurity in not sanitizing variables before INSERT with prepared statement in PDO

I use PDO with prepared statement when connecting to my database, and I do this because it is considered a safe way to do so, but one thing I could not help but to wonder was, can submitted data from ...
10
votes
1answer
2k views

How to properly secure a $_GET in PHP?

I found an SQLi in a buddies work site. He reported it to his superiors and they allowed me to run additional tests and also patch the site. After reviewing the site, The vulnerable code was a $_GET. ...
10
votes
3answers
2k views

Should IP addresses be validated to prevent SQL Injection?

In PHP I retrieve a user's IP address ($_SERVER['REMOTE_ADDR']) to use it in some MySQL queries, but I do not validate them to be true IP addresses. Should I validate user IP addresses before using ...
1
vote
2answers
367 views

Strange Pharma Spam Site resulting from DAT file created by SQL Injection?

Working on cleaning up a site compromise for a client. Leaving aside that the site is using bunch of custom CodeIgniter code written by someone who had no concept of security, I've ran into a ...
5
votes
2answers
359 views

Can anybody recommend any gems for checking security vulnerabilities?

I want to check one of my RoR projects for security vulnerabilities. So can anybody recommend any gems for my needs?
45
votes
9answers
13k views

Why Disallow Special Characters In a Password?

The culprit in this case is a particular (and particularly large) bank that does not allow special characters (of any sort) in their passwords: Just [a-Z 1-9]. Is their any valid reason for doing ...
0
votes
3answers
734 views

SQL injection explanation

I just found in logs that someone try to exectue this SQL injection ...
5
votes
2answers
836 views

Could this login form be “hacked” to allow access?

We have this legacy website which has horrendous code in it. I have just been looking through the login form/code and can see un-sanitised sql queries. E.g. in a nutshell: $email=$_POST['email']; ...
1
vote
3answers
925 views

Could some one please explain - Remote Post SQL Injection

Would anyone be able to post a link to an article which explains how to do a Remote Post SQL Injection and how to prevent anything bad happening. Or even just explain on here. Any help would be ...
0
votes
4answers
1k views

A faster method than Blind SQL Injection?

Blind SQL Injection is based on TRUE/FALSE tests. Here is an example: is first letter A? --> NO is first letter B? --> YES is second letter A? --> NO ... is last letter X? --> YES It's ...
3
votes
4answers
8k views

Why can't sqlmap find an SQL injection in my code?

I installed XAMPP on my development PC, and started Apache HTTP server and MySQL. It comes with a test page "CD collection", with the following back-end PHP code: mysql_query("DELETE FROM cds WHERE ...
2
votes
1answer
805 views

Example of attack trees in the web application security analysis

Here I am again asking for some informations about attack trees usage in web application analysis. For my master thesis I decided to study the usage of this formalism in order to reppresent attacks ...
33
votes
2answers
15k views

Are prepared statements 100% safe against SQL injection?

Are prepared statements actually 100% safe against SQL injection, assuming all user-provided parameters are passed as query bound parameters? Whenever I see people using the old mysql_ functions on ...
2
votes
2answers
4k views

How to check an Android Application for SQL Injection or XSS bugs?

I was just wondering how could i check my client's Android application for SQL Injection or other similar kind of bugs. I mean if its an application, where should i write the queries. If through ...
3
votes
2answers
2k views

sanitizing input/output in php/codeigniter

I've been making some progress learning about web application security. Right now I'm trying to finalize my strategy for sanitizing input and output. Background: Users can submit reviews to the site, ...
4
votes
2answers
857 views

Security web scanner tool for IIS/SQL Server

I'm trying to do penetration testing of our ASP.NET web-site to check for security loopholes (specifically for SQL injections). We bought a commercial web scanner tool (IBM Rational AppScan), however ...
21
votes
3answers
72k views

How do I test for SQL injection vulnerabilities on a site with input fields?

What methods are available for testing SQL injection vulnerabilities?
3
votes
3answers
3k views

Hibernate SQL Injection - Fortify 360

I am using Fortify 360 to analyze my code's security. Fortify has identified a Hibernate based delete method to perform a delete based on an object that has been passed in. My understanding of ...
2
votes
3answers
678 views

How does Facebook avoid crawling over their site?

I used Netsparker community edition and tried to find a vulnerability in my personal site. Then I thought let's try with Facebook. It didn't show a single webpage also because normally it shows ...
1
vote
3answers
305 views

Deploying vulnerable web application online‏

I am deploying a vulnerable web application for students (about 100) in a university, that they can test online and am collecting all the traffic for research purposes. I am deploying this machine on ...
11
votes
2answers
1k views

Interpolique: transparently preventing SQL Injection and XSS with base64 encoding, what happened?

For the keynote at The Next HOPE a couple of years ago, Dan Kaminsky unveiled Interpolique (the talk is really fun btw). The problem he raised was how to defend against injection attacks, including ...
4
votes
2answers
157 views

Changing windows client form values at runtime

I am performing a code audit of an older VB6 application which uses dynamically constructed SQL to execute against the database. While I see this as a SQL injection point, the developer contends that ...
5
votes
2answers
1k views

Scanning DVWA with w3af - Unable to detect SQLi when security on low

I've been messing around with DVWA (Damn vulnerable web application) and w3af. I've been scanning DVWA with w3af, and have used the spiderMan proxy and http config to setup auth credentials to get ...
0
votes
2answers
164 views

How much security should I use for my web application?

My question is, for a "normal" site, what do you think is enough to secure against methods used by "script kiddies"? For example, SQL injection, XSS, and stuff like that. Same question for password ...
5
votes
3answers
822 views

Best way to alert a website owner of a vulnerability?

recently i was browsing a site, and i noticed that at the end of the URL it said id=168, which is a common indicator that the site is vulnerable to an SQL injection attack. i did some tests and found ...
1
vote
0answers
177 views

How anonymous used UTF-16 ASCII to fool PHP escaping [duplicate]

Possible Duplicate: How anonymous used UTF-16 ASCII to fool PHP escaping (Reposted here as per request). A few months ago, anonymous took down a child pornography site using SQL-injection. ...
19
votes
4answers
7k views

How did Anonymous use UTF-16 ASCII to fool PHP escaping?

A few months ago, Anonymous took down a child pornography site using SQL-injection. I read in this article that Anonymous claimed that "the server was using hardened PHP with escaping," but they were ...
3
votes
4answers
4k views

How is my website vulnerable for sql injections?

I am running a small website where I have published some articles. I am also very interesed in security topics and tried sqlmap on my website. It found the database name, so my question is how it ...
6
votes
2answers
1k views

What is SQL injection?

What is the meaning of SQL injection? I am not able to understand the term. And what problems may be caused by SQL injection?
3
votes
4answers
1k views

SQL query sanitation (black list)

I have a following problem/challenge: Web application (ASP.NET 3.5) installed on corporate LAN and operates on SQL Server DB needs to provide ability to generate custom reports. These reports can be ...
2
votes
2answers
908 views

How can an IPS\IDS detect SQLi \ XSS (or other application layer) attacks?

I've been thinking about how an IPS works, and as far as I know it inspects the packets on the TCP\IP layer. How can it detect attacks on higher levels without harming the user experience? How does ...
0
votes
3answers
5k views

How to exploit this SQL inection vulnerability?

I am learning SQL injection on a vulnerable Web App. I scanned it with w3af. It showed many vulnerabilities. One of them is : SQL injection in a Microsoft SQL database was found at: ...
7
votes
2answers
257 views

Presentation on Web App Security (ACM Student Chapter)

I am a member of the local ACM student chapter in my university and as part of our activities I am scheduled to give a talk on current issues on Web Application Security (and possibly secure coding ...
15
votes
2answers
7k views

Multibyte character exploits - PHP/MySQL

Could someone please point me to a link with some information on multibyte character exploits for MySQL? A friend brought them to my attention, but I've not been able to find much information on the ...
6
votes
1answer
2k views

Do I have to make any more check if I use prepared statements for integers?

I am currently using PDO with prepared statements for some integer values (see PDO::PARAM_INT). That means I call PDO like this: $stmt = $conn->prepare("SELECT `lastMove` FROM ".GAMES_TABLE. ...
16
votes
3answers
18k views

SQL injection with AND 1=1

Please explain the meaning of "AND 1 = 1" in a SQL injection attack. It's from an exercise in my university. E.g. select * from user where id = 'smith'' AND 1=1;-- and birthdate = 1970; or ...
6
votes
3answers
4k views

Does mysql_escape_string have any security vulnerabilities if all tables using Latin1 encoding?

I have heard that the PHP function mysql_escape_string has security vulnerabilities related to mult-byte characters. Are there any vulnerabilities if all tables are using Latin1 encoding?
3
votes
4answers
2k views

Is replacing all apostrophes with two apostrophes sufficient to prevent SQL-injection on MSSQL?

I'm working in a web site that doesn't use parameters on SQL queries. All the queries are adhoc and the way they are doing the input validation seems good to me, I'm not able to break it to do SQL ...
4
votes
2answers
1k views

Is it possible to test for Postgres BlindSQL injection using pg_sleep() in a WHERE clause?

In mysql, I am familiar with using the following payloads to test for blindsql when the WHERE clause is vulnerable (all payload examples from fuzzdb): 1 or sleep(TIME)# " or sleep(TIME)# ' or ...
15
votes
4answers
7k views

Levraging a shell from SQL injection

As I understand it, SQL injection should only allow for the manipulation and retrivial of data, nothing more. Assuming no passwords are obtained, how can simple SQL injection be used to leverage a ...
8
votes
3answers
4k views

How to patch against RefRef's DOS attack

Overview Anonomous claimed responsibility today for the Denial of Service attack against wikileaks. They are using a new software called RefRef. It seems to exploit MySQL using the server's ...
10
votes
2answers
1k views

What are the SQL-injections issues of parameterized queries?

I've written some code to generate an SQL query in ASP classic. I'm not sure if it's secure or not: Set adoCon = Server.CreateObject("ADODB.Connection") adoCon.Open "Provider=Microsoft.Jet.OLEDB.4.0; ...
7
votes
4answers
6k views

Testing clean urls with sqlmap

Is it possible to test for SQL injection vulnerabilities with using sqlmap with a url that is using mod rewrite (or something like it) to make the urls clean? I know how to test my sites that have ...
2
votes
1answer
257 views

How to evade a signature to detect “xp_cmdshell” for SQLi?

What methods can be used to bypass a signature which detects "xp_cmdshell"?
5
votes
1answer
611 views

SQL Injection on URL, not on parameters

Should WAF or any protecting method, block SQLi done on URLs?(eg GET /test/url'or 1=1--)