SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database.

learn more… | top users | synonyms

0
votes
0answers
18 views

Error based injection in Insert query

I'm trying to test a challenge website using ModSecurity as a WAF. When I put ' in the user agent I got an error from MySQL. You have an error in your SQL syntax; check the manual that corresponds to ...
1
vote
2answers
77 views

SQL injection to login when there's no record in the database

I have a question to solve. Well there's no records of username and password in the database and so one cannot Log in without inserting any records. Is there anyway to exploit the following code and ...
0
votes
1answer
72 views

Detecting datasets that were affected by SQL injection

Assuming that I know that one of my applications was attacked by an SQL injection, how can I identify edited or selected data sets? On obvious source are webserver logs. This should allow us to ...
45
votes
2answers
8k views

Is this an attempted SQL injection?

Looking through error logs I found lots of requests to a web-app where the URL contains: /if(now()=sysdate(),sleep(10),0)/*'XOR(if(now()=sysdate(),sleep(10),0))OR'"XOR(if(now()=sysdate(),sleep(10),0))...
1
vote
1answer
91 views

Using user agent & inputs for SQL injection with ModSecurity WAF

I'm trying to test a challenge website using ModSecurity as a WAF. When I put ' in the user agent I got an error from MySQL. You have an error in your SQL syntax; check the manual that corresponds ...
6
votes
1answer
219 views

SQL Injection through addslashes

I'm trying to understand how a website can be hacked through using addslashes in PHP and MySQL for educational purpose. After reading this topic and this topic, I try to understand how it can bypass ...
-1
votes
2answers
86 views

Are these queries vulnerable to injection in mysql

The queries below show SQL injection in appscans for MySQL. Is there a way to do a proof of concept or otherwise to how can they be exploited? INSERT INTO cscart_sessions (session_id, expiry) values('...
4
votes
3answers
167 views

Is this PHP code vulnerable SQL injection?

Im given control over the $vote variable (in the "challenge" function) Is there any way to sql inject the query? (BTW I can see/read whatever the challenge function returns e.g. the sql errors. I ...
1
vote
0answers
25 views

Can you use null byte injection to exploit SQLi in Postgres?

While testing, I do get an error when passing the input asdf%00 to my applications username. The database in the backend spits an error, because Postgre can't handle 0x00 in text fields. <h4>...
0
votes
1answer
82 views

SQL queries using SQL Injections do not work as I think they should

I am trying to learn about SQL Injections. I have created a login form using PHP (I am quite new to PHP) as backend scripting language and MySQL as DBMS. Last day I asked a question about SQL ...
0
votes
2answers
93 views

Need help understanding OWASP Vulnerabilities [closed]

I am doing a whitepaper on simplifying OWASP 10 vulnerabilities based on an article our teachers suggested. Can you guys help or provide more resources here? What are your views? Will like to ...
227
votes
16answers
50k views

SQL injection is 17 years old. Why is it still around?

I'm no techie and would like your expertise in understanding this. I recently read a detailed article on SQLi for a research paper. It strikes me as odd. Why do so many data breaches still happen ...
1
vote
2answers
116 views

SQL Injection not working when I think it should

I am trying to learn about PHP and SQL Injections, so I have created a login form where users introduce their username and password and click the Login button. Later in the server I get the passed ...
-1
votes
1answer
60 views

SQL injection prevention by replacing ' with '' [duplicate]

I'm working on a web application which is vulnerable to SQL injection in its search box. It uses ASP.Net (C#) and Microsoft SQL Server. In the search box it queries like: Select Column1 from TBL ...
0
votes
1answer
47 views

Number of Column Enumeration in PHP / MySQL

I am currently studying SQLi from a book which I won't mention to avoid any copyright issues. The book contains many examples of strings / code from MSSQL, MySQL, Oracle etc. I am currently stumped ...
-1
votes
2answers
47 views

Launching SQL injection in MD5 with mysqli_real_escape_string()?

Can we exploit the MD5() and mysqli_real_escape_string() methods in this case to perform SQL injection? Here is the code snippet: $pwd = mysqli_real_escape_string($conn,MD5($_POST['pwd'])); $login = ...
2
votes
2answers
702 views

Security issues on allowing Special characters in input field

I am building a web application, in which I am required to let user enter any character(even special characters - ~!@#$%^&*()_-+=|\{}[];:'"<,.>) in an input field. To mitigate the problems ...
3
votes
1answer
51 views

Possibility of SQLI in the following request?

I was testing an web application which is written in Ruby, Rails framework, when I stumbled on the following request which was sent. I modified the request and now it displays me a part of the query ...
0
votes
1answer
92 views

SQL injection in find_by Active Record RoR 4

I was trying to understand the possibility of SQLi in a Rails Application, that I am currently auditing for a client, that uses Active Record 4.2.0. Now, I have limited experience with RoR so please ...
7
votes
2answers
22k views

How does SQL injection work through URL?

I wonder how SQL injection works through URL with SQL in the parameter. Assume I have a database with a table named mytable. When I get an ID from method POST I put it in this query: SELECT * FROM `...
0
votes
1answer
54 views

Adding conditions after LIMIT in MySQL

Is there any way to add any condition after LIMIT for example the OR or AND? I am wondering if we can add any query after LIMIT which returns nothing. for example the query is: SELECT * FROM table ...
1
vote
1answer
1k views

WAF SQL evasion using HPF technique

I was reading an article on WAF evasion techniques http://www.slideshare.net/devteev/methods-to-bypass-a-web-application-firewall-eng. The article discusses two techniques HPP (HTTP parameter ...
0
votes
1answer
200 views

Sqlmap doesn't exploit verified SQL injection

Right now I'm tinkering with the Hackxor VM (a pentesting training enviroment) and I'm trying to use sqlmap to exploit a vulnerability which I can exploit manually. The vulnerability is in the ...
16
votes
5answers
9k views

Would removing spaces in a string protect against SQL injection?

I was curious if it's possible to protect against an SQL injection attack by removing all spaces from an String input? I have been reading up on SQL Injection at OWASP, but they don't mention ...
5
votes
1answer
88 views

PHP SQL Injection Vulnerability In UPDATE Statements

Take the following SQL query as an example: UPDATE `sqlinjection2` SET `$vote`=`$vote`+1 Our goal is to increment the vote count by more than one, in one request. We cannot access the code itself. ...
2
votes
3answers
71 views

SQLMap deleted database items

While doing test on my website, SQLMap deleted data in my database tables. Everything is corrupt. What is a safe way of using this tool without touching other items on a live server? How do you use ...
47
votes
2answers
28k views

Are prepared statements 100% safe against SQL injection?

Are prepared statements actually 100% safe against SQL injection, assuming all user-provided parameters are passed as query bound parameters? Whenever I see people using the old mysql_ functions on ...
0
votes
2answers
121 views

Can an SQL injection attack happen if the input is only allowed to be hexadecimal characters?

I've set up a login system that works more or less like this: 1) The user enters the data 2) The data is hashed locally using SHA256 (To reduce the risk of someone stealing the password through a ...
3
votes
1answer
69 views

Blind SQL Injection using OOB DNS Practical Sniffing Help

I was looking at Excellent Article from Defcon 15's which was Data retrieval over DNS during SQL Injection Attacks. (https://www.youtube.com/watch?v=iQDw0hK_eFw). In this the speaker demonstrated the ...
13
votes
2answers
3k views

Is the injection in a NoSQL database architecture also called SQL injection?

Is the injection in a NoSQL database architecture also called SQL injection and is it still part of the OWASP 2013 Top 10, category A1 Injection? For example an injection in code that communicates ...
0
votes
0answers
23 views

Is there a way to check a CGI SQL Injection using sqlmap?

I got this finding from Nessus: 51973 - CGI Generic SQL Injection (Parameters Names) And the correspondent GET request: https://myhost/folder/b?'+convert(int,convert(varchar,0x7b5d))+'=1 As you ...
6
votes
4answers
109 views

How can releasing the text of an SQL query compromise security?

I have asked a government agency, under Freedom of Information legislation, to release two SQL queries they ran to produce a table which they published in a report. That is, the agency published ...
4
votes
1answer
132 views

Exploiting MD5/Salt Vulnerability in this PHP form?

I've been practicing security-related subjects and this challenge has befuddled me. Note: I can't access any PHP source code, nor can I edit it. I'm only able to view it. The following is given: I ...
476
votes
20answers
62k views

How can I explain SQL injection without technical jargon?

I need to explain SQL injection to someone without technical training or experience. Can you suggest any approaches that have worked well?
0
votes
0answers
30 views

SQLite table discovery by injection

Background: Simple SQL Injection For an injection exercise i need to get the password of a person out of a database. I've got one input field which accepts most of the chars (expect from ',", OR, ...
1
vote
2answers
86 views

Simple SQL Injection

I'm training my SQLInjection knowledge on a training tool made by my university. In a certain lvl there is this simple product viewer which gets a row based on a id. So the query should me something ...
2
votes
2answers
148 views

PHP security hacking question, may be more than just PHP

I have an input box for for INSERTing into the database. It is written in PHP PDO. Some one typed in: <"'> and also: ' onClick='alert(1); I'm assuming they were in two different input ...
-4
votes
1answer
87 views

Safest SQL database [closed]

I am going to run a Tor Hidden Service on a Linux server. My site will have an SQL database. This DB contains user login, and a few other basic details. If it makes a difference depending on the ...
0
votes
0answers
76 views

What does this injected query achieve?

On this very good link you can see some SQL injection expressions for MySQL. Quick Detection Error Based SQLi For integer inputs: (select 1 and row(1,1)>(select count(*),concat(...
6
votes
4answers
388 views

Why is using SQL injection to extract passwords or password hashes from a login database (that should never legitimately disclose them) even possible?

(Okay, so I'll confess upfront that while I'm trying to educate myself the current state of my knowledge on web applications security is still pretty shallow. So I appreciate your patience if the way ...
1
vote
1answer
46 views

SQLi with comment filter: dumping the database

The following SQLi (MySQL) filter is from SQLi-Labs: ... $reg = "/#/" $reg1 ="/--/" $replace ="" $id=preg_replace($reg,$replace,$id); $id=preg_replace($reg1,$replace,$id); .... $sql = "SELECT *...
1
vote
1answer
62 views

How do I exploit with vunerability in special format with sqlmap?

I used ZAP proxy to determine that login was injectable with GET request as login" AND "1"="1 was injectable, but it returned the url to me in this format: https://example.com/login%22%20AND%20%221%...
5
votes
2answers
370 views

SQL Injection query error with backslash

I have a sql injection vulnerable site which works well if i input query like this qq' -- // or qq' -- ; . But when i inject without slash or semi-colon it throws following error "You have an error in ...
6
votes
2answers
272 views

What's the best way to test for SQL Injection vulnerabilities? Manual or SQLMap?

As part of my job I test for web application vulnerabilities regularly. When it comes to SQL Injection, my methodology is to start by manually browsing the website and spidering it, then, sending the ...
0
votes
1answer
45 views

mySQL into outfile strange behaviour

I have sql-injection with file_priv=Y (root user) but I can only create file in /tmp and /var/tmp directories even when i have 777 permissions to destination folder - mysql server just won't create ...
2
votes
2answers
106 views

Explaining information leak to Lead dev

Our lead dev tells me that this information leak from our website is "no vulnerability. Just an ugly error UI." It looks to me that the leaked information could be used to aid an attack. Does it ...
5
votes
1answer
7k views

Understanding Boolean Based SQL Injection

I am trying to understand the concept of Boolean Based Blind SQL Injection. I have gone through OWASP Guide To SQLi to understand it. However I am confused with how exactly does it work. Below id ...
1
vote
2answers
12k views

1'or'1'='1 help

When I put Username:anything and Password : 1'or'1'='1 Then my database retrieves the first row in the mysql table. But I want to retrieve the row corresponding to Username:anything row. How should I ...
0
votes
1answer
120 views

What SQL payloads can be injected for a numeric field?

I have a parameter (pi_apk_version_code) that seems to be vulnerable to SQL Injection (the team is divided on this). The database column corresponding to this parameter accepts only numeric values. ...
1
vote
1answer
64 views

Does fuzz testing produce different output compared to manual testing?

I am testing an API and one parameter is vulnerable to SQL injection. When I run OWASP ZAP's fuzzer on this parameter, the input "; or 1=1" results in a successful exploit of SQL injection. However, ...