Tag Info

New answers tagged

1

Short answer: Yes! Implement security best practices in any application storing sensitive data, or capable of accessing other servers with sensitive data, regardless of it being public-facing or not. Explanation It is an all too common practice for companies to invest in securing their perimeter only. This means that access from and even to the internet ...


1

I don't allow SQL injection flaws on our internal web pages. The reasons I offer are: Protect your web sites from malicious insiders. There is no such thing as an internal web site. When a user of the internal web site has a browser that also is used for external web sites, you can't say the internal web site is segmented from the outside internet. My ...


2

Protections are in place to address risk - protections have a cost (time/effort to code, in your case) and those costs need to be compared to the benefits/costs of implementing them. If the cost of the realized risk is lower than the cost to implement protections, then it doesn't make sense to to implement protections.


1

Generally if you find an SQLi you don't need to map the whole database to prove the vulnerability, actually very little information is needed as proof. SQLmap is a great tool for what it's meant for, mapping databases, but it does have some limitations in usability. Generally I'd advice to use a web application scanner to look for SQLi vectors, for example ...


0

Error based SQL injection is useful when you have a page that runs a query where the output is not shown, but will display a database error if there is one. While you could also exploit this using blind SQLi the error based on offers a significant speed increase. Exploitation is based upon injection a condition that will cause an error, type casting is ...


1

Error based sql injection takes advantage of poor error handling in an application. When the application is returning you the mysql error, you find a way (usually it's with group by) to have the interesting data returned by mysql in the error. In your example I can't see what information you are trying to obtain but look at this site, there are good ...


2

It's possible to perform a SQL injection attack anywhere that the system places user defined data (in this case the username) directly into a SQL query without first sanitising it. So, the answer to your question is yes, it is possible, depending on the behaviour of the system in question.



Top 50 recent answers are included