New answers tagged

0

If you already experienced an sql injection attack: MySQL by default doesn't log all queries[1], as it would impact performance significantly. It's also not enough to just consider the tables your webapplication directly accessed. If you don't have logging or auditing enabled, determine what tables would be considered "high value" in the main database. ...


0

Opening it to static public IP in firewall or MySQL settings does not mean that only packets from that IP can access it. It means that only packets claiming to be from that IP can access it. See: IP Address Spoofing I understand UDP packets have another angle on this. I would also only use SSL, for obvious reasons if going this route. Disclaimer: I am not ...


0

I figured out that the following injection dumped the database(not through outfile though): ' union select null,group_concat(username),group_concat(password) from users group by '


1

I think you should check for SQL Injection vulnerabilities manually, because you have more probabilities to detect a vulnerability, also you adquire more experience as information security professional. On the other hand, it isn't good to trust tools like SQLMap; firstly, a tool doesn't have the experience and knowledge than a human has, a tool is limited to ...


3

This isn't a security issue, it's a data management issue. Usernames can, and do change. That's why you use a meaningless identifier and foreign key relationship to ensure database integrity when you have a role table. Any UI that adds or manages roles should hide the complexity of the ID vs the username inside it.


5

Using SQLMap will be helpuf, since it scan for most well-known vulnerabilities and will save you some time and efford. But, the greatest threat is a hackers' imagination and ability to exploit something more complex and unusual than SQLMap can find. For me, the best way to check for sql injection vulnerabilities - and even more types of vulnerabilities - is ...


0

Things to check: the secure_file_priv variable The server must have read access to the whole path, and might need to have scan access also (e.g. to write in /a/b/c, you need r-- access to both a and b, and -w- access to c, at least. Those could be r-x and -wx respectively).


3

You are correct to be concerned about the scenarios you presented: If a MITM attack occurs, it cannot be thwarted unless you use SSL. The IP filter will not help because the attack is already "in the middle" of the connection, so all traffic will pass through it in plain text. Once the user/pass is grabbed, the attacker can do whatever those credentials ...


4

If you look at the MySQL Internals Documentation, you can see that the protocol initialises SSL/TLS after the initial handshake packet, but before the authentication step:   The two paths shown from the first state are based on whether SSL/TLS is enabled or not. As such, if SSL/TLS is enabled, the authentication occurs after the secure channel is ...


2

Depends on the permissions given to the database user who you are acting as. If they have command execution privileges, it would be possible to use those to run a command such as id. Without that privilege, though, it is not supposed to be possible, but could be if the MySQL user was also a valid system user. In that case, it is possible to obtain the MySQL ...



Top 50 recent answers are included