Tag Info

New answers tagged

2

Error and Problems in your injection The problem is that you cannot execute multiple queries with mysql_query, and as you are injecting a ; you have multiple queries. The first one is SELECT * FROM users WHERE id = '2' ORDER BY 1 and the second one is --''. The first one is the one that gives you the actual result in the command line, and the second one ...


1

There are possibly two issues with your attempt that cause it to fail: Syntax for MySQL comments to the end of the line --  requires a whitespace or control character following the double-dash: From a “-- ” sequence to the end of the line. In MySQL, the “-- ” (double-dash) comment style requires the second dash to be followed by at least one whitespace ...


0

As others have said, please, please change all your passwords. You don't want to take a chance here. Now might be a good time to think about using some sort of solid password keeper as well. There are a few out there with varying levels of quality but even using something that's closed source, but easy to use like LastPass is better than using the same ...


3

In short, you have NO idea what he downloaded, so change ALL PASSWORDS. I would also be interested to know if it was possible to upload.


1

There are two ways to answer this. The first way follows your line of thinking, the other does not. While it's hard to be sure for any specific database, due to slack space (i.e. not shrinking the data file when stuff is deleted), journaling, and other database features, I'd suspect that the following is reasonably sufficient for a system like InnoDB: Do ...


0

If you use userName: ' OR 1=1 -- . password: whatever You this query SELECT * FROM users WHERE userName='' OR 1=1 -- .' AND password='whatever' ' closes the string OR 1=1 makes it ignore that userName='' does not match anything With -- . you create a comment so it does not matter what comes afterwords. The . is just in case you use this not in a form ...


1

Depending on the privileges the mysql user (the system-level account used to run MySQL) has and how MySQL is configured, the traces could be anything from a full audit trail in the MySQL log files, to no trace whatsoever. Assuming the mysql user can't do anything but read and write files, your bet bet is to search the drive for files owned by that user. ...



Top 50 recent answers are included