Tag Info

New answers tagged

2

Lets say the application uses the id parameter (which is in your example 8) to create the following query: SELECT * FROM news WHERE id=8 and active=1 If the parameter id is injectable, you could for example in the URL instead of 8 enter the following: 8; UPDATE table_name SET filed=123456 -- That would turn the first query into: SELECT * FROM news ...


3

When talking about SQL injection, regardless of language, you should use parametrized queries. These construct a query plan ahead of time, rather than when the user provides input, so an attacker cannot easily modify how the query works. PHP supports this, but you need to use the PDO library rather than the mysqli functions. http://php.net/pdo for more ...


17

SQL is a programming language. The problem is not a lack of SQL about "sanitizing inputs"; SQL is the input, not something that receives inputs. The problem is applications that take it upon themselves to automatically generate some SQL based on an haphazard mixing of string elements of dubious origin. An application that suffers from a SQL injection ...


0

First, I don't see any benefit of encrypting the random string in step 3. (I don't see a difference between trying to guess a random string and an encrypted random string- which could be considered just another random string.) But I don't see how this hurts either... For your first question, is your algorithm secure enough? That depends on what sort of ...


0

I'm not quite sure what you are referring to when you say you are using "Hibernate" (NHibernate?) Either way - usually when you see the pattern of replacing a parameter with a ? it suggests that you are working with a parameterized query. If it is using parameterized queries then you will be protected from SQL Injection in your situation. If you can ...


0

You can test both manually and with tools.For manual analysis first determine the place where the SQL injection exist in the website. For finding sql injection insert ' or " into the URL of the requsted webpage if it returns an error message then the site and the parameter is vulnerable to SQL injection. You can also determine the platform in which the ...


0

SELECT @@VERSION should be enough.


7

Use the SQL Injection cheat sheet. Most databases have a way to query the version e.g. SELECT @@version. If you have already found an injectable point that returns data try a couple of those until you get data back. example methodology: SELECT @@version # fails. Then you know it is not MS SQL or MySQL. SELECT version() # fails. You know it is not PostGres ...


1

The error you get from the page has nothing directly to do with your SQL injection attempt. The site appears to employ a simple casting to ensure id is numeric, so your query becomes a valid query which returns nothing unless you send in a plain number: $id = (int)$_GET['id']; In other words, not all queries you can mess up from the URL line are ...


-1

The error you see is the result of a failed query. This is most likely due to incorrect data being fed to the query string, it's possible mysql_real_escape_string() is being used to escape SQL characters (that would be used in an attack) which would explain why your injection attempt failed. Though more likely would be your incorrect attack attempt. We would ...


1

If you are restricted to the current statement, the exploitation is also limited to the capabilities of the current statement type. In general, a SELECT statement allows: reading data from accessible tables and databases reading files using the LOAD_FILE function writing files using the INTO … syntax executing stored procedures Of course, the way the ...


4

Let's remove PHP entirely from the equation for a moment. SQL injection allows an attacker to manipulate the SQL query to be what he or she wants the query to execute. This can be dumping the contents of the database, modifying data, and even code execution. The example you provided is indeed vulnerable to SQL injection. For the purposes of demonstration, ...


0

OpenX Ad Server version 2.8.10 was shipped with an obfuscated backdoor since at least November 2012 through August 2013, remove and install a fresh version of OpenX.



Top 50 recent answers are included