Tag Info

New answers tagged

1

If this form is hackable, others are likely to be also. Getting the content of the database is problematic, but bypassing normal user authentication, altering other users accounts, or just plain trashing the database are all on the table. I doubt your client would want you to try these things on their live database.


1

How can I obtain the database's content using the SQL injection technique? Whether or not you can do this will depend greatly on how the information is used after it is pulled from the database. For example, if the information pulled from the database is only used to see if you have valid credentials, but never displays any of the database content that ...


6

You should ensure that you have the right skill set before offering to perform work for a client. This means that you looking at the website will be worthwhile and you won't give the client a false sense of security. This will be better for you as you will know how to take the correct steps to perform a test legally and won't get sued by the client if you ...


1

There are cases of SQL Injections leveraging the implicit conversion of Unicode homoglyphs from Unicode character string types (NCHAR, NVARCHAR) to character string types (CHAR, VARCHAR). A character such as ΚΌ (U+02BC) in NVARCHAR may slip through the escaping routine and get translated to ' (U+0027) in VARCHAR, which may result in an SQL Injection when such ...


2

Please, please, please, please do not use a handmade regex for preventing SQL injection. You should never be writing your own escaping, filtering, or sanitizing functions to prevent SQL injection, XSS, shell injection or the like. These are things you rely on built in and vetted libraries for. Where you can avoid it, don't even use a standard library ...


2

If you're looking at how unicode can be exploited, see this question, if you're looking for a solution, there are really only two that can be considered really secure: parameterized queries and encoding all of your input into hex or base64 or some other encoding that doesn't leave open the possibility changing the context of the value. I would seriously ...


2

The one thing you need most to stop SQL injection is a semi-colon (;). However, it isn't always simple to just eliminate them. You will have situations where a semi-colon is used in a text field as a character, not as a SQL command terminator. There are plenty of articles that go into detail about how to both inject and prevent SQL in your queries. ...


8

Here is an example of a PHP mail-generating script that is vulnerable to a CRLF-injection attack. In essence, the problematic code was: $email=$_POST['email']; $headers="From: {$email}\r\nReply-To: {$email}"; //create headers mail('opps@example.com',$subject,$content,$headers); //mails it In that case, a poorly designed PHP API was difficult to use ...


11

Depending on how your application creates the actual RAW email request, it may be possible to insert line feeds to modify the recipients, CC, BCC etc. Check out this example: In this context, the target is to be able to send anonymous emails to other recipients. There are numerous additional fields that can be specified in the mail headers (see [ ...


1

While you may never run the code locally on your server, it may be possible to upload malicious JavaScript code. Then the attacker can point to your site when he needs to reference the code in other attacks (e.g., XSS). There may also be rare situations where PHP or other server side code may be consumed from this image. There may be misconfigurations in ...



Top 50 recent answers are included