SQL injection is a technique used to take advantage of non-validated input vulnerabilities to pass SQL commands through a Web application for execution by a backend database.

learn more… | top users | synonyms

0
votes
1answer
58 views

Detecting datasets that were affected by SQL injection

Assuming that I know that one of my applications was attacked by an SQL injection, how can I identify edited or selected data sets? On obvious source are webserver logs. This should allow us to ...
0
votes
1answer
163 views

Sqlmap doesn't exploit verified SQL injection

Right now I'm tinkering with the Hackxor VM (a pentesting training enviroment) and I'm trying to use sqlmap to exploit a vulnerability which I can exploit manually. The vulnerability is in the ...
-1
votes
1answer
132 views

why database show vulnerable column when i give a wrong parameter in query?

When we try for inject a website for find vulnerable column then sometimes we need to give a wrong value in the website parameter. Like www.vhul-web.com/index.php?id=1 union select 1,2,3 -- - Now ...
-1
votes
1answer
230 views

Is there a way to bypass the inbuilt php functions for sqlinjection

If there is a way to bypass the built-in functions of PHP to protect against SQL injection or I should rely on some other filters rather than depending on built-in functions?
-1
votes
1answer
228 views

Blackbox testing for SQL injection

In my college, a security challenge event is going on for one whole month, Participants are expected to 'hack' into a website. The site has a login form, which accepts username and password and POSTs ...
-1
votes
1answer
75 views

Where do I put the request data?

Now, I understand this might not be the right place to post about Acunetix but I'm searching my site for any exploits and a couple of SQL Injection exploits have shown up on a /Profile page, how would ...
5
votes
0answers
60 views

PHP SQL Injection Vulnerability In UPDATE Statements

Take the following SQL query as an example: UPDATE `sqlinjection2` SET `$vote`=`$vote`+1 Our goal is to increment the vote count by more than one, in one request. We cannot access the code itself. ...
3
votes
0answers
254 views

Plugin for integrating SQLMAP and BURP SUITE

I am trying to do SQL Injection using the SQLMAP Burp Plugin which I downloaded from http://code.google.com/p/gason/downloads/list. I have followed the steps for windows provided in http://resources....
3
votes
0answers
143 views

Obtaining large data sets for research: MySQL, PHP, Apache, etc

I have been looking around the web for large data sets (specifically web related log files - MySQL, PHP, Apache, and so on) that contains data of attempted intrusions/exploits. I am doing some ...
2
votes
0answers
141 views

Is MySQL CONCAT with PDO enough to protect LIKEs from SQL injection?

I'm developing a user-facing, public-accessible website where the user can input an arbitrary, hostile search term. After that, the app must do something conceptually like this against a MySQL db ...
1
vote
0answers
72 views

Dumping Large table using Sqlmap

I am learning/working on sqlmap and I was trying to dump a large table with 11K entries on my localhost. The command I used is: python sqlmap.py -u "http://localhost/searchre.php" --data="search=' ...
1
vote
0answers
197 views

How to tell sqlmap to resume an exploit from results-*.csv file?

How to notify SQLMap to resume an exploit from results-*.csv file? Example: ~/.sqlmap/output/results-xxxxxxxxxx.csv Target URL,Place,Parameter,Techniques http://example.com:80/login.php,POST,...
1
vote
0answers
76 views

Double Query injection

I'm trying to learn about "Double Query Injections", but in the tutorials they write following the command but without any explanation: (select * from (select count(*), concat(0x3a,0x3a,(select ...
1
vote
0answers
247 views

How to identify column types during sql injection with “union all select” construct?

Situation is following: I have identified sql injection attack vector, and have following information about target table: It has six columns. (Identified using "order by"). I can see output of 3 of ...
1
vote
0answers
49 views

Why the column fields doesn't show up on injection of column names?

I'm practicing SQL injection. I've been able to get the column names and table names on a test environment. query 1. On executing below query, I see adminId, adminUsername, adminPassword http://...
1
vote
0answers
87 views

Which enterprise-class DBMS allow forbiddance of (No)SQL comments?

This question could be renamed "Would forbidding SQL comments inside transactions prevent some SQL injections?", but I'd like to know if some DBMS allow this first. The goal is to reduce the attack ...
1
vote
0answers
118 views

Hacking attempts:in.js

A client of mine keeps getting hacked by seemingly SQL injection where a script tag containing a link to an "in.js" file is added. Sometimes from a domain called sportserve.co.uk, other times from ...
0
votes
0answers
21 views

Is there a way to check a CGI SQL Injection using sqlmap?

I got this finding from Nessus: 51973 - CGI Generic SQL Injection (Parameters Names) And the correspondent GET request: https://myhost/folder/b?'+convert(int,convert(varchar,0x7b5d))+'=1 As you ...
0
votes
0answers
24 views

SQLite table discovery by injection

Background: Simple SQL Injection For an injection exercise i need to get the password of a person out of a database. I've got one input field which accepts most of the chars (expect from ',", OR, ...
0
votes
0answers
58 views

SQL injection in find_by Active Record RoR 4

I was trying to understand the possibility of SQLi in a Rails Application, that I am currently auditing for a client, that uses Active Record 4.2.0. Now, I have limited experience with RoR so please ...
0
votes
0answers
74 views

What does this injected query achieve?

On this very good link you can see some SQL injection expressions for MySQL. Quick Detection Error Based SQLi For integer inputs: (select 1 and row(1,1)>(select count(*),concat(...
0
votes
0answers
20 views

Can someone provide some examples of boolean based SQLi tests?

I've seen tests ' or 1=1-- or ' and '1'='1. I was looking for some more boolean based tests. One of the sites I'm testing has WAF blocking a lot of tests, but simple boolean tests, like above, have ...
0
votes
0answers
53 views

MySQL SQL Injection - Get User Password

I've used SQLMAP to check for SQL injection. I've managed to retrieve the name of just one database (dbInfo) However, using SQLMAP I can't enumerate anything else - where it is tables within the DB ...
0
votes
0answers
41 views

Fortify scan flagging “SQL Injection: MyBatis Mapper for <if> tags”

A Fortify SCA scan has flagged 8 instances of SQL Injection: MyBatis Mapper in our code. The following query get's flagged at the <if> line: <select id="getByBusinessId" ...
0
votes
0answers
36 views

Oracle PL/SQL SQL Injection Test from Unicode to Windows-1252

I have a DB using windows-1252 character encoding and dynamic SQL that does simple single quote escaping like this... l_str := REPLACE(TRIM(someUserInput),'''',''''''); Because the DB is windows-...
0
votes
0answers
44 views

sqlmap receiving corrupt/garbage data for password column only

sqlmap is receiving corrupt/garbage data for the password column. The rest of the columns extract just fine. Example: Đ\x9eđ\x98Ú I did a bit of research and a few people have experienced the ...
0
votes
0answers
47 views

Encoding payloads for GWT version 7

I'm auditing a website built with Google Web Toolkit. It uses serialization version 7, so the tools from GDS Security won't work (they only work till version 5). Using this technique I got all classes,...
0
votes
0answers
197 views

Insert Command in SQLMap causes Error

I have tried testing SQL injection using SQLMap using the below query sqlmap -u http://localhost/abc.php?id=1 -D datab --sql-shell When i drop into the SQL shell the following command select * from ...
0
votes
0answers
44 views

How to protect against SQL Injection in Jaggeryjs?

I am working with Jaggeryjs now which is a server side JavaScript like Nodejs. When I tried the example mentioned in the documentation, They have provided simple example just like Statement in Java. ...
0
votes
0answers
79 views

How to allow INFORMATION_SCHEMA.TABLES to pass through in the query?

I'm practicing SQL injection on a test bed where 'OR' and 'AND' keywords are blacklisted. So on using Logical operators such as || and &&, I'm able to proceed however when trying the query (...
0
votes
0answers
2k views

SQLMap and Manage Engine Service Desk Plus Union Injection

Would like some assistance against this SQL injection: http://www.exploit-db.com/exploits/11793/ Proof of Concept: Microsoft Windows Environment with MySQL: http://x.x.x.x:8080/WorkOrder.do?woMode=...
-1
votes
0answers
95 views

How can a WHERE clause with an SQLi vulnerability be exploited?

We will assume that we have an SQL injection relative to: http://mysite.com/?id=3 We could also assume that DB system is MySQL. The SQL request could look like this well known example: SELECT * ...