New answers tagged injection
group_concat is the wrong function. Try this: 'UNION ALL SELECT CONCAT_WS(0x3a,username,password) FROM users-- (note also the order of the arguments. If you want more columns, you can just append them: CONCAT_WS(0x3a,username,password, moreColumns, canBeHere)). This works for MySQL and PostgreSQL. SQL Server doesn't have CONCAT_WS, but it does have ...
If the signature parameter is based on user input, it may be possible for a user to insert an & in it and break this functionality. I don't see how this could be exploited, however the best practice is to sanitize the value of parameters affected by user input.
The ampersand character is used to separate arguments supplied to the url when multiple argments are used. In your first example the script receives the following arguments signature=xxxxxxxxxxxxxxxxxxxxxxxxxxxx url=http%3A%2F%google.com%2F In your second example the script receives the following arguments: signature=xxxxxxxxxxxxxxxxxxxxxxxxxxxx ...
What the report shows is not the uniqueness of the attack vector, but the systemization of the attack vector as a part of a national defence strategy. GC is an in-path system, capable of not only injecting traffic but also directly suppressing traffic, acting as a full “man-in-the-middle” for targeted flows. ... In addition, in contrast to ...
Yes, you are completely open to SQL injection, eg via validUsername' injectionPayload %23, which would give you this query (the # (encoded as %23 cuts of the remaining '): SELECT * FROM users WHERE name='validUsername' injectionPayload #' Into Outfile depending on the rights of the user, you could write content into a file with this payload: -1' UNION ...
Have you tried including quotes to break this? From what I see here, it should actually cause a horrible error if a quote is passed in. Sometimes you have to fiddle around a little before the crash happens. $query = mysqli_query($con,"SELECT * FROM users WHERE name='$user'"); Here is my attempt to break this: 'OR 1=1-- It appears you have not used ...
To start with, if you can whitelist instead of blacklisting you can save a lot of efforts. You can get a list from ModSecurity, it is not simple to parse on your own but this is probably the most comprehensive you will get publicly.
Top 50 recent answers are included