Tag Info

New answers tagged

0

group_concat is the wrong function. Try this: 'UNION ALL SELECT CONCAT_WS(0x3a,username,password) FROM users-- (note also the order of the arguments. If you want more columns, you can just append them: CONCAT_WS(0x3a,username,password, moreColumns, canBeHere)). This works for MySQL and PostgreSQL. SQL Server doesn't have CONCAT_WS, but it does have ...


1

Sqlmap (http://sqlmap.org/) enables you to test injection by cookie with the switch ./sqlmap.py --cookie="" In addition to the other switches you would otherwise use. Note, you will likely need to enter the cookie in full in the value mentioned above and dictate which parameter sqlmap will need to use. ...


0

If the signature parameter is based on user input, it may be possible for a user to insert an & in it and break this functionality. I don't see how this could be exploited, however the best practice is to sanitize the value of parameters affected by user input.


1

The ampersand character is used to separate arguments supplied to the url when multiple argments are used. In your first example the script receives the following arguments signature=xxxxxxxxxxxxxxxxxxxxxxxxxxxx url=http%3A%2F%google.com%2F In your second example the script receives the following arguments: signature=xxxxxxxxxxxxxxxxxxxxxxxxxxxx ...


1

It looks like the server has php configured with magic quotes on. Since the example query provided doesn't contain any quotes you won't need to inject any quotes. Something like 1 union select @@version from shop -- - should give you an error about unions needing the same number of columns, proving the injection.


2

Error and Problems in your injection The problem is that you cannot execute multiple queries with mysql_query, and as you are injecting a ; you have multiple queries. The first one is SELECT * FROM users WHERE id = '2' ORDER BY 1 and the second one is --''. The first one is the one that gives you the actual result in the command line, and the second one ...


1

There are possibly two issues with your attempt that cause it to fail: Syntax for MySQL comments to the end of the line --  requires a whitespace or control character following the double-dash: From a “-- ” sequence to the end of the line. In MySQL, the “-- ” (double-dash) comment style requires the second dash to be followed by at least one whitespace ...


0

Any input to the user, whose content may be used in a database query is a possible vector of SQL injection. For example, with your example URL, depending on your server implementation this might work: https://testurl.com:1234/webservicename?parameter=DROP TABLE users;SELECT The key to preventing SQL injection is simple and we'll understood, always use ...


1

SQL injections have nothing to do with whether or not your application accepts URL parameters. They work with any input, be it the URL, the request body, a cookie, an HTTP header or even data from your own application (e. g. a string stored in your database). It doesn't matter. So it's not about the origin of the input. It's what you do with the input. If ...


0

No, because SQL Injection and Insecure Direct Object References includes the case of 'ability to run SQL that the user has access to but the application was designed to not allow'. Your method will limit the ability to get at stuff outside their permissions, but in most cases that includes things that aren't intended to be open, as well as system ...


1

Not effectively, no. You're always going to have cases where row-level security can't properly emulate the business processes. You'd also need to have a lot of "general purpose" accounts for things like user signup. The whole thing would be convoluted, difficult to maintain, and largely ineffective. Keep in mind, also, that SQL injection potentially does ...



Top 50 recent answers are included