New answers tagged

0

As @Neil said in his comment, you should not do pentests on production systems. If this should be necessary for some reason, make sure that there are backups available... Regarding SQLmap, read the documentation. There are more and less "secure" operations available. There is no guarantee though that the "secure" operations won't cause any troubles.


0

They probably have a DBA who has been told that you shouldn't let people know the structure of the database due to SQL injection risks. As you mention though that doesn't make a ton of sense for an internal database. There's no obvious risks to releasing a query from a security standpoint. What was their exact wording of the reason they refused it?


4

The "common solution" you mentioned has one glaring and obvious flaw: it can't use salt. If your hash has a salt (it should), then you need to fetch the salt before performing the hash operation. And if you're fetching the salt, you should just fetch the hash result at the same time. In fact, the two are typically stored in the same string. Ideally, you ...


3

Assuming that your stored procedure uses something like bcrypt with a secure salt and many rounds, I see no problem with what you are implementing. Your basically treating the database as an identity provider in a federated identity system where the applications are PHP applications. That said, I see no reason why you would do this. PHP has builtin ...


-1

Is the stored procedure doing salting, and multiple rounds of secure hashing? If you don't implement this right, it could effect DB performance and your security. There's a LOT of libraries out there in pretty much every web language to handle secure authentication. Using a stored procedure is a good idea when authenticating the user or interacting with ...


3

You need to figure out if the parameter is being parsed as an integer or a string (most probably as string). If the query is balanced and successful, It won't die(). try .. 1' order by 1-- - or .. 1 order by 1-- - If the first one returns an error, that means the parameter is being parsed as an integer so you don't need a quote (') to perform the ...


1

http://hackyourselffirst.troyhunt.com/CarsByCylinders?Cylinders=V12' AND 1=(select top 1 password from UserProfile where UserId=(select top 1 UserId from(select top 1 UserId from userprofile order by UserId) sq order by UserId DESC))-- http://hackyourselffirst.troyhunt.com/CarsByCylinders?Cylinders=V12' AND 1=(select top 1 Email from UserProfile where ...


5

Should I escape input when using prepared statements? No. You really don't need to escape input if you use prepared statements. If you want an additional layer of security, use some kind of input filter (eg get me only integers, get me only valid emails, get me only alphanum, etc). And you obviously should not escape your password, as it doesn't even go ...


6

Is this SQL injection? Yes. Why? Let's look at what's happening here. $query = "SELECT pass FROM social WHERE email = '$id'"; This passes $id directly to the query. If $id is not sanitized, SQL injection will occur. if($_POST && isset($_POST['submit'], $_POST['password'], $_POST['id'])) { $pass = ($_POST["password"]); $id ...


0

Security of a database system, or any system for that matter, is about more than simply which type you use. Who has access, is remote access possible, can root login remotely, is there a web interface, and if so, is it secure against injection attacks? There's hundreds of factors. You could try asking a more specific question.


5

Try appending a UNION SELECT to the SQL query. A union-select allows the attacker to add a completely new select-statement. The results of that second select are appended to those of the first. When the first request returns no result, the union-select allows the attacker complete control over the result-set. Remember that a select-statement doesn't even ...



Top 50 recent answers are included