Tag Info

New answers tagged

0

Your solution would only work in a very narrow set of circumstances. It's rare that the database user and the person viewing your website have exactly the same set of permissions, which is the scenario you're imagining. Imagine this scenario: select passwordhash from usernamePasswordtable where username=$username; Even if you could limit this to a DB ...


1

An SQL injection adds a new SQL command to the command the website uses to retrieve / update / add data to the Database. Since nearly all websites that use a database need to have some tables to write in the attacker can always add data there. More importantly, most of the time the database holds information not available to all users of the website (like ...


0

SQLite supports prepared queries and bound parameters, so the issue is more with the use of the tool, rather than the tool itself. If query parameters are used it's impossible to inject SQL into the process because the data is handled separately from the statement. The issue only arises if the developer has done something like: SQLStatement = "select * ...


1

SQL injection attacks apply when an application uses SQL and carelessly assembles SQL requests with attacker-provided elements. Here, "carelessly" means "without using prepared statements". Prepared statements are the correct way to do SQL with externally provided data; many developers try to think of it in terms of "escaping quoting characters", which is a ...


-1

you put user input directly into a DB?... Bad idea (in general). You should sanitize all Input. (so input coming from the client and input coming from the Database). You are relying on the Client to make values safe in your example. something you should never fully trust as its outside of your control. for the rest I defer to @SilverlightFox as his ...


2

There's no such thing as special characters. It all depends on the context that input is used within your application. Protecting against SQLi and XSS is great, however if then input is then to be used in an operating system shell call it does you no good. Always encode or sanitize when the data is used - leave this as late as possible. For example when ...


1

This crafted query allows you to distinguish which fields resulting from the original query are actually displayed on the page. At a latter step, you will indeed replace some of these numbers by more specific requests in order to get some information. However you will obviously prefer that this information will be displayed by the vulnerable app and not ...


7

Well, let's dissect it: CONCAT_WS - Concatenate with separator. version() - Returns the version of MySQL. FLOOR(rand(0)*2) - Emits the following sequence of numbers: 0, 1, 1, 0, 1, ... having min(0) - By itself, this is illegal, as the HAVING clause requires a condition. This, and the fact that there's no ; -- on the end, implies that the injection is ...


2

This appears to be some type of what is known as Second Order SQL Injection. Even if Thread 1 writes to a queue instead of to a DB, as the injection does not happen as a direct result of it, sqlmap cannot be used to exploit the vulnerability. Sqlmap looks for error messages in responses or differences in timing (for blind SQL injection) to determine ...


0

This allows for (potentially malicious) actions that are contrary to the intended use of the application, so yes it is a security flaw that you should be worried about. Just because you have found limited use cases / attack vectors does not mean that others don't exist. Ideally you should take a "defense in depth" approach whereby you mitigate the concern ...


1

SQL injection works by skipping out from the "value" part of SQL syntax into the "command" part. String values (as in your example) are surrounded by quotes - to break out you would need to include a similar quote in your value (like ' WHERE 1; DROP TABLE ... or whatever the actual syntax would be). HTML encoding doesn't allow quotes, so that won't work. ...


1

There seems to be something wrong with the request you posted. Since the vulnerable parameter is the "cat" parameter the "&" in your request separates the payload from the vulnerable parameter thus resulting in no information being revealed. Let us do it right: A request for: ...


0

Finding SQL injections today it iss very easy, and anyone can do it. There have been many developers and researchers predicting the end of SQL Injection, however, year after year we see it still in the OWASP Top 10. SQL injection is everywhere and lack of education or knowledge (or maybe bad habits) how to write secure code is a problem. For example in ...


0

It depends on what platform an application is built on. I don't think that Drupal or Wordpress will be a mature developer's choice of tool to design an App. And you as an experienced software engineer in your analysis probably don't face low quality applications like that. I don't want to say that if one uses Wordpress he will get an SQL injection or XSS ...


4

I am not sure what exactly is meant by a modern application. Yes, many frameworks, ORMs, Entity Framework, etc. decompose queries and may apply some default filtering. However, in more complex scenarios that require custom coding, or where the ORM or library functions won't do exactly what you want, you will open up the door to SQL injection or other ...


2

Many applications have grown over the years. Unless the code is refactored once in a while to reflect current best practices (i. e., in case of SQL injections: parameterization), many applications contain quite much legacy code that hasn’t been touched in years. And chances are that it won’t be touched as other parts depend on it. Refactoring costs time and ...


2

Now, is this the case for other security enthusiasts? In my experiences, No - SQL injection is still prevalent. I perform on average 30-50 web application assessments per quarter and I can vouch that SQL injection is still an issue with modern applications. With that being said my assessments are approximately 85% automated with 15% manual followup / ...


0

The classic, old-school 'or 1=1 # SQL injections are long gone; but sophisticated ones will creep up once in while. That's one way that TrustWaves makes money by keeping its ModSecurity rulesets updated. Most modern web apps go through a 'security deployment checklist' and are usually also tested for known vulnerabilities before production deployment. ...


4

SQL injection is definitely not something I would skip over when testing for security. According to the Ponemon Institute Breach Report, SQL injection accounts for 30% of malicious or criminal breaches, the most of any attack vector that resulted in a breach. My company uses a variety of methods to find SQL injection vulnerabilities in our proprietary ...


18

Actually according to OWASP, SQL Injection is on top of the top 10 Vulnerabilities through Web applications. https://www.owasp.org/index.php/Top_10_2013-Top_10 and there are many papers, article, news about concerns in this subject and every day there is a news about SQL injection attack against famous web applications such as for example Joomla,Wordpress ...


3

OWASP has some information about how to fins SQL inhections, as to not beeing present. A recent Drupal SQL injection shows that that is simply not true (even in a mature environment as Drupal.) The way you find these things is often simply employing fuzzers and sending random garbage to the web app.



Top 50 recent answers are included