SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database.

learn more… | top users | synonyms

1
vote
3answers
216 views

Login required before SQLmap

I have a multipart form data where I am suspecting one of the multipart form fields (parameter named htmlbevt_id), to be vulnerable to SQLi. To test for the same I captured the request using Burp and ...
1
vote
1answer
56 views

Basic Website Protection (XSS,SQL-inject,hashing)

I have a very simple app that does allow unauthenticated users to leave comments (maybe later I will incorporate a capatcha). The app then stores the comments in a mysql db. I do my best to filter out ...
-1
votes
1answer
65 views

Where do I put the request data?

Now, I understand this might not be the right place to post about Acunetix but I'm searching my site for any exploits and a couple of SQL Injection exploits have shown up on a /Profile page, how would ...
2
votes
0answers
24 views

how to clear results from sqlmap

Using SQLMap, I have a sql injection location that has since been fixed, supposedly. I want to retest, but SQLMap has previous results cached. That is, when I run the same command, the results ...
2
votes
0answers
334 views

how to prevent ASCII Encoded / Binary String SQL injection in Codeigniter

I am using CodeIgniter for two years and I am digging into penetration testing nowadays. I think that ActiveRecord does good job for preventing sql injections, but i have following questions: I want ...
1
vote
0answers
93 views

Hacking attempts:in.js

A client of mine keeps getting hacked by seemingly SQL injection where a script tag containing a link to an "in.js" file is added. Sometimes from a domain called sportserve.co.uk, other times from ...
1
vote
0answers
198 views

MSSQL injection convert syntax error

I just setup a test bed and i disabled information_schema from being accessed (a weak waf) and i've been trying to extract the table list from the database by using convert to spit out a conversion ...
0
votes
0answers
68 views

SQLMap and Manage Engine Service Desk Plus Union Injection

Would like some assistance against this SQL injection: http://www.exploit-db.com/exploits/11793/ Proof of Concept: Microsoft Windows Environment with MySQL: ...
0
votes
0answers
59 views

Which enterprise-class DBMS allow forbiddance of (No)SQL comments?

This question could be renamed "Would forbidding SQL comments inside transactions prevent some SQL injections?", but I'd like to know if some DBMS allow this first. The goal is to reduce the attack ...
-1
votes
0answers
35 views

sqlmap and information_schema available

I'm testing sqlmap in a website that works with MySql > 5 and has "information_shema" available, however whenever I ask for tables or columns it needs to do bruteforce in order to retrieve names. ...