Tag Info

New answers tagged

0

Error based SQL injection is useful when you have a page that runs a query where the output is not shown, but will display a database error if there is one. While you could also exploit this using blind SQLi the error based on offers a significant speed increase. Exploitation is based upon injection a condition that will cause an error, type casting is ...


1

Error based sql injection takes advantage of poor error handling in an application. When the application is returning you the mysql error, you find a way (usually it's with group by) to have the interesting data returned by mysql in the error. In your example I can't see what information you are trying to obtain but look at this site, there are good ...


2

I have a MySQL and Apache web server (both are installed on the same machine). Users will interact with it by a VB.NET application and the web. The server is accessible by the Internet. ... The information is not super critical, it's just stats/benchmarks (especially since anyone in the world is allowed to view it) These two statements seem to ...


2

You basically answered your own question by stating anyone in the world can read this information. This makes me believe it is not necessary. However, from a security point of view it is always recommended to use best practices, meaning: use transport layer protection. Web based Clients Since the web server and database server run on the same machine, ...



Top 50 recent answers are included