SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database.

learn more… | top users | synonyms

0
votes
0answers
9 views

Sql Injection and no priviliges to write files

I have a sql injection in my site and im using sqlmap but when i try --os-shell it says cannot write file due to permissions . now is it impossible to write a file to the server?
-4
votes
3answers
125 views

How do I hack this login page by using SQL injection? [on hold]

I'm testing a client's web site vulnerability to SQL injection, which appears to be the case. The web site is hosted in IIS on a Windows server and is using Microsoft's .NET framework with SQL. I'm ...
1
vote
2answers
72 views

Sql injection is not working on my site?

I have set up a page and database so I can practice SQL injection. Ive tried some examples and it doesn't seem to work. It seems to add the username and password to that database, even though I input ...
2
votes
1answer
52 views

Unsafe sanitization? Is this code SQLi vulnerable?

Function RemoveSuspeitos(ByVal strTXT) Dim txtAux As String txtAux = strTXT txtAux = Replace(txtAux, chr(34), "") txtAux = Replace(txtAux, ...
1
vote
1answer
71 views

Why isn't it possible to do SQL injection (HIGH Level) in this example in Damn Vulnerable Web App?

$query = " $sql = select * from users where id = '$id' " Won't $id=3' OR '1'='1 break the query ? The doubt arose because someone claimed it can't be broken.
3
votes
0answers
37 views

VB.NET stored procedure implementation?

While reviewing code for a vb.net application I have come across the following implementation of stored procedures using ExecuteDataSet Result = DBInstance.ExecuteDataSet(Name, ...
0
votes
2answers
57 views

SQL Injection and JavaScript Regex Bypass

me for learning SQLI. But I got stuck at this one regex which seems to be unbreakable : document.loginForm.username.value = document.loginForm.username.value.replace(/[^a-zA-Z0-9]/g, ""); If someone ...
3
votes
0answers
17 views

SQL Injection via Unicode [duplicate]

My team currently uses ASP.NET with MS SQL Server for our software. Security has only become important since I started, in which there is injection vulnerabilities everywhere. Due to current ...
1
vote
4answers
1k views

SQL Injection with pass MD5

I want to know, if in my login form there is any SQL injection possible. If there is, what could the exploit's web form entry look like? I send username and password by html form (POST). The login ...
0
votes
4answers
169 views

SQL Injection via Unicode

My team currently uses ASP.NET with MS SQL Server for our software. Security has only become important since I started, in which there is injection vulnerabilities everywhere. Due to current ...
1
vote
3answers
2k views

No single quotes is allowed, Is this SQL Injection point still exploitable?

The SQL phrase looks like this, "SELECT * from XX where id = '" + id + "'" The id variable comes directly from the GET parameter named id. And the Java web app explicitly disallowed single quote. ...
8
votes
3answers
9k views

Is there any SQL injection for this PHP login example?

I want to write a login form, and I got one example from the web. I want to know, if there is any SQL injection for this code? If there is, what could the exploit's web form entry look like? This is ...
0
votes
1answer
62 views

Is sqlmap traceable?

Is sqlmap still traceable when we use --tor --user-agent and macchanger? For example: sqlmap -u "[vulnerable_website_link]" --tor --user-agent="Mozilla/5.0 (compatible; Googlebot/2.1; ...
4
votes
2answers
262 views

Can anybody recommend any gems for checking security vulnerabilities?

I want to check one of my RoR projects for security vulnerabilities. So can anybody recommend any gems for my needs?
-1
votes
0answers
27 views

Error selecting Public Page from database. Contact System Administrator

I am pentesting a website: http://www.membermanager.net/summerchallengeride/index.php?ID=3719' I a having this error: Error selecting Public Page from database. Contact System Administrator. After ...
1
vote
2answers
2k views

Uploading Shell Using SQLI

I found an SQL injection vulnerability in a Wordpress installation inside one of my lab machines and I am trying to leverage it to upload a shell. I can get the admin hash but it seems that it is ...
0
votes
0answers
28 views

How does data.stackexchange.com allow queries securely? [migrated]

https://data.stackexchange.com/ lets me query some (all?) of stackexchange's data/tables using arbitrary SQL queries, including parametrization. What program do they use to do this and is it ...
2
votes
4answers
396 views

Generic defense againt SQL injection

This is a little bit of a rant, but there's a real question at the end. I recently installed a new perl script on a site (which will remain nameless) which failed mysteriously with an error 403. ...
4
votes
5answers
4k views

Are there any tools for scanning for SQL injection vulnerabilities while logged in?

Some pages of my website were vulnerable to SQL injection. The injection worked only when the user was logged in. I have now fixed this problem, and now I want to make sure that no similar problems ...
2
votes
1answer
386 views

SqlMap bypasses OWASP ModSecurity Core Rule Set for SQL Injection

I am trying to perform a simple penetration test on the DVWA (the web application that has been specifically designed to be vulnerable to some of the most common web application attacks). I want to ...
0
votes
2answers
202 views

What kind of attack is this?

This past week, my traffic logs are showing many hits (usually with repeated tries) for a URL from perhaps 30+ different IP addresses all over the world. This is not a URL that should garner more than ...
1
vote
0answers
76 views

Hacking attempts:in.js

A client of mine keeps getting hacked by seemingly SQL injection where a script tag containing a link to an "in.js" file is added. Sometimes from a domain called sportserve.co.uk, other times from ...
0
votes
3answers
152 views

String sql injection vs sql injection

What's the difference between normal sql injection and string based sql injection? An example would be appreciated. As far as I understand from the few readings around the net, string based sql ...
7
votes
2answers
210 views

How can this input-sanitizer function be defeated?

There's a Classic ASP application at my job that is (I believe) highly vulnerable to SQL injection. I want to prove to management that this code isn't secure, but all I'm able to do is insert "SQLINJ" ...
1
vote
1answer
147 views

Recognize site vulnerable for SQL injection

Although I understand the concept of a SQL injection and have done simple exploits (simple hack challenge sites and stuff) I'm wondering if one of the site run by my employer is vulnerable. Unlike ...
0
votes
3answers
622 views

SQL injection explanation

I just found in logs that someone try to exectue this SQL injection ...
0
votes
2answers
244 views

sqlmap: testing javascript or json parameters

I have a parameter in a POST request which is in the following format: ParamName= < r username="123" password="456" x="" y=""/> and I want to test username and password which are two HTML ...
1
vote
0answers
67 views

MSSQL injection convert syntax error

I just setup a test bed and i disabled information_schema from being accessed (a weak waf) and i've been trying to extract the table list from the database by using convert to spit out a conversion ...
0
votes
1answer
75 views

MSSQL injection help [closed]

If information_schema is not allowed in MSSQL , what is another method i can use to list the tables inside a database and ultimately the columns so i can dump them without using information_schema? ...
-1
votes
1answer
61 views

True/false statements in MSSQL without < > and = [closed]

How can i make a true/false statements in MSSQL without the following symbols: <,>,= ? Everything i can think of, e.g: or 1=1-- (true) or 1>1 (false) and 2<>3 (true) Makes use of ...
362
votes
18answers
45k views

How can I explain SQL injection without technical jargon?

I need to explain SQL injection to someone without technical training or experience. Can you suggest any approaches that have worked well?
0
votes
1answer
99 views

Is ASP.net More Secure than PHP in GENERAL? [closed]

In other words, my (long version) question is: Are developers able to get away with, more using ASP.net than PHP in terms of writing secure code for their apps? I ask this because ASP.net has many ...
3
votes
0answers
89 views

Weird condition in blind SQL injection point, substr() is valid for exactly two chars

I'm exploiting a blind SQL injection point, which takes a variable as username then check if the username exists in a table. (It's running MySQL 5.X with PHP) So I'm using this to retrieve all ...
0
votes
2answers
58 views

Any residual effects after SQLMAP has been run?

Some time ago, penetration testing was done on our website, and one of the tools used was SQLMap It was executed by a security consultancy, but unfortunately they did not notify us beforehand. So, ...
1
vote
1answer
61 views

Base Programming for vulnerabilities

Hello, I am a beginner looking for some information. My question is the following: In order to understand certain security concepts is it essential that I understand the underlying languages? For ...
8
votes
3answers
4k views

How to patch against RefRef's DOS attack

Overview Anonomous claimed responsibility today for the Denial of Service attack against wikileaks. They are using a new software called RefRef. It seems to exploit MySQL using the server's ...
2
votes
2answers
70 views

Is sqlmap tracable?

The question is simple. For example, we access a database of any website. And looked up for datas. So, is the website owner can see me? If he/she can see, how can i protect? [These are for security ...
0
votes
1answer
40 views

How can we get the second id for sqlmap [closed]

I'm trying to find some vulnerable points in my website. My website like, www.example.com/index.php?menu_id=1002&news_id=5. When i trying to find these points with sql map, it tries for menu id. ...
0
votes
1answer
75 views

Sql Injection - Possible exploitations on a real case [duplicate]

This is a snippet of a PHP script: $useragent = isset($_SERVER['HTTP_USER_AGENT']) ? $_SERVER['HTTP_USER_AGENT'] : NULL; $query = "SELECT `id` FROM `browser` WHERE name = '".$useragent."' LIMIT ...
3
votes
4answers
101 views

Are these SQL injection checks a bad idea?

Reading Preventing SQL Injection Attacks in Stored Procedures started this debate between my partner and I---and looking for the right approach is not as straight forward. I'm no security expert--but ...
1
vote
1answer
65 views

Am I right by changing the default algorithm on a web app?

Numerous clients have told me that my suggestion on changing the algorithm on a web app does not increase security. I've tried reasoning that if the files have not been exposed, the attacker has to ...
0
votes
2answers
148 views

Is there an open source runtime enforcement tool?

I have been looking for open source runtime enforcement tools that I can use my own policies to prevent input validation vulnerabilities, in web applications. The web applications that I want to ...
-3
votes
1answer
505 views

Wordpress - cleartext admin credentials disclosure

I am testing my own wordpress blog against security issues with wpscan. Honestly I have never done that before and was shocked after I saw the result. One vulnerability of my wordpress site is: [+] ...
0
votes
1answer
68 views

Can a sql query with both user input and parameter be prone to sql injection?

I've stumbled over some code in an application where (certain) users are allowed to input where conditions. In addition to this there is a part of the where condition that is set as a parameterized ...
16
votes
3answers
31k views

How do I test for SQL injection vulnerabilities on a site with input fields?

What methods are available for testing SQL injection vulnerabilities?
3
votes
1answer
199 views

is 'mysql_real_escape_string' enough

Recently on stackoverflow I've seen many discussions that mysql_*_escape_string is deprecated and instead recommending PDO. The way I've been doing it was to allow only letters and ' in the name field ...
0
votes
1answer
167 views

Are cross site scripting attacks and sql injection a good topic for my thesis? [closed]

So I'm doing my undergraduate thesis, I would like to explore how cross site scripting sql injections occur. And for the purpose of the thesis I'd also like to create a fictional website that is ...
0
votes
1answer
243 views

SQLMap extracts weird chars in one column

I saw this behaviour many times but I never solved it. Sometimes using sqlmap after retrieving good data from columns it fails retrieving only one of them. I can't figure out why this happens for just ...
17
votes
7answers
1k views

How to exploit the “PHP_MAGIC_QUOTES ON” vulnerability in order to cause max damage?

I've found a whole lot of SQL injection exploits in some systems I maintain. I know how to prevent the injection, but I would like to demonstrate to my CEO and CTO how dangerous it is if we don't have ...
3
votes
2answers
379 views

Regarding SQL Injection at Back End?

I have logged into SQL Server 2008 Database and executed following query: select * from USER_Main_INFO_Name where userid ='' or 'x'='x' After executing the query Database has given total user list. ...