SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database.

learn more… | top users | synonyms

2
votes
1answer
109 views

Basic Website Protection (XSS,SQL-inject,hashing)

I have a very simple app that does allow unauthenticated users to leave comments (maybe later I will incorporate a capatcha). The app then stores the comments in a mysql db. I do my best to filter out ...
52
votes
7answers
13k views

SQL injection — why isn't escape quotes safe anymore?

Raw SQL When you're writing SQL -- for anything that takes human input really, a lot of things have been done to avoid the injection. Everyone that's heard of SQL injection knows that (I'm going to ...
4
votes
2answers
72 views

How do honeypots remain secure to 0days and newer exploits?

If honeypots are designed for a specific set of exploits, such as SQL injection and XSS, how do they protect themselves against other exploits? For instance, if I created a honeypot a few months ago, ...
4
votes
0answers
368 views

How to prevent ASCII Encoded / Binary String SQL injection in CodeIgniter

I have been using CodeIgniter for two years and I am digging into penetration testing. I think that ActiveRecord does good job at preventing SQL injections, but is there any possibility of bypassing ...
-1
votes
3answers
109 views

SQL Injection solutions [closed]

I'm editing my question to clarify what I'm trying to ask. In order to launch an SQL injection there should be someway to get input from the user (i.e. username and password) for instance. So I've ...
-1
votes
0answers
24 views

what if sql order by got waf security [closed]

I know that waf security can ensure some union queries but what if a website got order by security so attacker can't view how many columns and tables are there.
1
vote
3answers
698 views

Login required before SQLmap

I have a multipart form data where I am suspecting one of the multipart form fields (parameter named htmlbevt_id), to be vulnerable to SQLi. To test for the same I captured the request using Burp and ...
1
vote
1answer
59 views

If mysql schema is missing, where can I find credentials?

After finding a sql injection vulnerability I need to provide the more information I can about the DB. Minimum I need to provide a list of users and passwords. I identified that it's a MySQL but ...
2
votes
1answer
77 views

Drupal SQLi only on login form?

Recently, CVE-2014-3704 was in the news. This vulnerability allows attackers to execute SQLi without the need of being logged in. However, I've looked to the available exploits, and I found only ...
0
votes
1answer
119 views

Is dot character safe against sql injection?

I'm modifying the search module of prestashop in order to be able to search strings containing dots : . Prestashop uses its own sanitize functions against mysql injection vulnerability (yeah...) and ...
-2
votes
1answer
109 views

Interesting security demos for beginners [closed]

I am thinking about a creating short security demo to get people interested in the security topic. I've had a couple of ideas just want to see if anyone has anything else interesting. Edit: I was ...
4
votes
2answers
128 views

In what situations does parameterizing a query NOT prevent SQL Injection?

While this isn't terribly common, I know that SQL Injection is still possible with a parameterized query, if you are calling a stored procedure that uses a parameter to construct and execute dynamic ...
1
vote
1answer
51 views

Do PHP/SQLI Prepared Statements Need Special Character Escaping?

I'm using php/mysqli queries such as this: $stmt = $con -> prepare("INSERT INTO `comments` (`uid`, `article_id`, `status`, `comment`) VALUES (?, ?, ?, ?)"); $stmt -> bind_param('iiis', $uid, ...
4
votes
2answers
270 views

Placeholders for cshtml — ASP.NET

I'm learning Application Security, and tutorials such as www.asp.net discuss updating databases with placeholders, instead of directly using user input @{ var title = ""; var genre = ""; ...
-1
votes
0answers
46 views

Hibernate session.delete method vulnerable to SQL injection

I have scanned my application code with a commercial source code scanner and it reports a SQL injection vulnerability in the session.delete(object) method of the hibernate query . I am not sure how if ...
8
votes
3answers
2k views

SQL Injection if table structure/db structure not known

could an attacker who'd just found out that you're using mysql make an SQL Injection attack with only this information? If you don't know Any table/db name how come you can find it out? Is that even ...
4
votes
2answers
139 views

SQL Injection Modify / Insert Table Values

Is it possible to update a field in a MySQL database or insert a new row using SQL injection in this case: The only protection in the PHP code is mysql_real_escape_string(). The query is ...
-2
votes
2answers
81 views

How to know table name, and column names for login panel

I want to know the table name and column names of that table in website login page. How should I do that. There are only two input fields, Username and Password. And it is vulnerable to Sql ...
2
votes
0answers
39 views

Navigating SQL Injection Safeguards [duplicate]

I'm trying to get around the DVWA high security SQL injection challenge, I've tried a bunch of automated scanning tools with no luck, read a bunch of articles saying it's impossible now i've turned to ...
395
votes
19answers
50k views

How can I explain SQL injection without technical jargon?

I need to explain SQL injection to someone without technical training or experience. Can you suggest any approaches that have worked well?
0
votes
3answers
979 views

Does this simple function add something to prepared statements?

I've been researching how to completely prevent against SQL injection, but there are so many different forms of injecting that completely preventing it looks impossible to me. I am using prepared ...
1
vote
2answers
183 views

1'or'1'='1 help

When I put Username:anything and Password : 1'or'1'='1 Then my database retrieves the first row in the mysql table. But I want to retrieve the row corresponding to Username:anything row. How should I ...
4
votes
1answer
132 views

SQL injection with single statement query

Suppose I had a vulnerable query like this: var q = 'SELECT x FROM y WHERE id = ' + req.body.id + ' ORDER BY date DESC;'; For the purposes of this question, req.body.id could be any integer ...
1
vote
1answer
183 views

Devious Blind SQL Injection Payload

I came along this blind SQL injection time based payload and I need to understand how it works ...
1
vote
2answers
213 views

How does stored procedure prevents SQL injection?

May be I am not much clear about the stored procedure. Can someone explain me how stored procedure prevents SQL injection with a simple example using MySql.
1
vote
3answers
132 views

How do attackers find the database technology used by a web application?

These days there are several database technologies are available for data storage purpose. While performing injection attacks, how do attackers actually identify the database used by a website? If ...
2
votes
2answers
97 views

ASP.NET SqlDataSource injection risk

I have an internal website (going on the intranet) that is going to go through vigorous testing to make sure that it is secure, so I am battening down the hatches so to speak and I coded a .NET ...
6
votes
2answers
2k views

What is the meaning of “something AND 1=0” command in SQL?

I have read somewhere that in SQL injection attacks the attackers use such keywords into application entry points. Whats the purpose of doing this?
0
votes
1answer
62 views

What is the main function of xp_cmdshell in SQL Server and what are its related security issues?

I was researching on Injection issues in MS SQL Server. I came to read about xp_cmdshell. I think this must be enabled in the SQL server for attackers to perform many exploits. Actually what is this ...
12
votes
3answers
4k views

Why do testers often use the single quote ( ' ) to test for SQL injection?

It has been seen that security testers input either ' or ; into the application entry points to test for SQL injection. Why are these characters used?
5
votes
3answers
152 views

Is my vendor vulnerable to sql injection?

The company I work for has recently moved to an external vendor for payroll services. We did an initial upload of data from our old system to the new vendor. I noticed that our employees that have ...
2
votes
1answer
68 views

Why isn't recommended to use time-based blind for bruceforcing table/column names?

When not having priveleges on the session user you're using with sqlmap this warning appears when trying to retrieve table/column names, offering you to brute force names using a dictionary file, do ...
-1
votes
1answer
86 views

Is attempting mySQL injection illegal? [closed]

I was testing an SQL injector I made in Java and the site I tested it on said 'Detected security breach attempt' blah blah blah. Is what I did illegal or not? I have found different opinions and ...
7
votes
6answers
524 views

Faster SQL injection prevention

I looked around everywhere and I can't find the answer to my question. I'm using the latest PHP for server-sided scripting and MySQL for my database. The character set is utf8mb4, if that makes a ...
7
votes
4answers
5k views

Testing clean urls with sqlmap

Is it possible to test for SQL injection vulnerabilities with using sqlmap with a url that is using mod rewrite (or something like it) to make the urls clean? I know how to test my sites that have ...
0
votes
3answers
390 views

SQL injection filter evasion

During manual SQL injection testing I came upon this. Is there any way to bypass these filters that supposedly prevent a UNION based attack? <?php error_reporting(0); include('db.inc.php'); ...
1
vote
2answers
225 views

Assigning cPanel MySQL Privileges

When I log into cPanel, I go to create a new MySQL Database with the wizard. Usually, it is recommended to assign the database user with all of the permissions from Insert, Update, Alter, Execute, ...
1
vote
1answer
616 views
1
vote
2answers
184 views

how to null out a insert statement?

I am doing a SQLi-Quiz. Below is the orignal statement. insert into users(name,pass) values('bob', [injection point here]) The statement is heavily filterd because the website which supplys the ...
4
votes
1answer
200 views

Weird condition in blind SQL injection point, substr() is valid for exactly two chars

I'm exploiting a blind SQL injection point, which takes a variable as username then check if the username exists in a table. (It's running MySQL 5.X with PHP) So I'm using this to retrieve all ...
0
votes
0answers
261 views

SQLMap and Manage Engine Service Desk Plus Union Injection

Would like some assistance against this SQL injection: http://www.exploit-db.com/exploits/11793/ Proof of Concept: Microsoft Windows Environment with MySQL: ...
0
votes
1answer
1k views

sql injection vulnerability to codeigniter

Hello i want to know why this kind of example question never been asked before. i got this code from my college that they say this kind of code is able to prevent sql injection we use codeigniter to ...
0
votes
1answer
56 views

How sqlmap tests/injections are seen by the victim?

I wonder if the normal webmaster can get some information about SQL injection into their sites. I guess that it is written in some log, and only if you happen to see the logs you'll see that activity, ...
5
votes
2answers
788 views

Could this login form be “hacked” to allow access?

We have this legacy website which has horrendous code in it. I have just been looking through the login form/code and can see un-sanitised sql queries. E.g. in a nutshell: $email=$_POST['email']; ...
1
vote
1answer
778 views

Recognize site vulnerable for SQL injection

Although I understand the concept of a SQL injection and have done simple exploits (simple hack challenge sites and stuff) I'm wondering if one of the site run by my employer is vulnerable. Unlike ...
17
votes
3answers
817 views

Protecting Health Care Database

I am doing a minor project on information security in which i am implementing techniques listed below to protect a HEALTH CARE database. Preventing SQL Injection (using prepared ...
-5
votes
1answer
154 views

what type of database server is used by fb? [closed]

I want to know what type of server facebook uses ? If they use sql server , then is it vulnerable to sql injection ? Are all sql servers vulnerable to sql injection ? I just want to know this ...
-1
votes
1answer
67 views

Where do I put the request data?

Now, I understand this might not be the right place to post about Acunetix but I'm searching my site for any exploits and a couple of SQL Injection exploits have shown up on a /Profile page, how would ...
7
votes
3answers
6k views

What type of attacks can be used vs MongoDB?

I'm starting to learn MongoDB and was curious if it was susceptible to some type of injection attack similar to SQLi. Due to the nature of the DB, I don't think you can inject into it but... What ...
0
votes
1answer
372 views

SQLMap extracts weird chars in one column

I saw this behaviour many times but I never solved it. Sometimes using sqlmap after retrieving good data from columns it fails retrieving only one of them. I can't figure out why this happens for just ...