New answers tagged

3

However if you took that search string update aTable set someColumn='JackedUpValue' where someColumn like and performed the operation shown in this question, wouldn't you get updateaTablesetsomeColumn='JackedUpValue'wheresomeColumnlike which should not execute, right? As others have pointed out there are other ways of getting whitespace into ...


6

No, injection with just hexadecimal characters is not possible. Another (better?) way to prevent SQL injection is to use prepared statements: $stmt = $mysqli->prepare("SELECT * FROM User WHERE Password=?"); $stmt->bind_param("s", $password); $stmt->execute(); Because you leave it to the database engine to correctly put your data in the SQL query,...


1

Firstly, I would recommend to use below function, that would be more efficient and stricter in my opinion. <?php function IsHexadecimal($pass) { return preg_match('/^[0-9a-f]{64}$/i', $pass); } // or as @martinstoeckli suggested function IsHexadecimal($pass) { return (ctype_xdigit($pass) && strlen($pass) ==...


1

Interesting video. In my opinion, to setup this kind on technique, you need to: 1) Own a domain name, say mysite.com 2) Each domain name has an "Authoritative name server". Usually the Authoritative name server are managed by the company that sold you the domain name. 3) You need to setup you own Authoritative DNS server on a public IP address, then ...


8

Is the injection in a NoSQL database architecture also called SQL injection... No, it is not called "SQL injection" but this is called a "NoSQL injection", you can read more about in an article titled "Testing for NoSQL injection", written by OWASP. ... and is it still part of the OWASP 2013 Top 10, category A1 Injection? Yes, this is a type of ...


15

Those are called NoSQL Injections instead of SQL injections. You can find more information about NoSQL injections, in the OWASP Testing Guide.


13

No. Let's say you have this as your SQL: "select * from people where last_name = '" + surname + "'" If I enter: 'OR(1=1)OR'a'=' into the input it turns into: select * from people where last_name = ''OR(1=1)OR'a'='' Which executes in Oracle and MySQL (at least) and returns all the rows from the table.


18

It would limit the problem, but not eliminate it. Consider the following situation: $un = str_replace(" ", "", $_POST["username"]); $pw = hash($_POST["password"]; $sql = "SELECT * FROM users WHERE username = '$un' AND password = '$pw'"; Lets say I post the username admin'--. That would log me in as admin, without using a single space. As wireghoul points ...


105

No. Removing spaces would not prevent SQL injection, as there are many other ways to make the parser process your input. Lets look at an example. Imagine that you had a url which used user supplied input unsafely in a query: http://example/index.php?id=1 => SELECT * from page where id = 1 In your example the attacker would use spaces: http://example/index....


46

We're in 2016! SQL injections are a thing of the past unless you use insecure code. Whatever language you use, if you want to prevent any and all SQL injections, use prepared statements or any other type of data binding. Prepared statements separate the query from the data, making it impossible for the data to affect the query. To directly answer your ...


0

They could easily substitute the actual table and column names with aliases. However, from a security perspective, even a completely unredacted SQL query is unlikely to release any information that would be useful to an attacker. Once an attacker gains dba level access to the database, querying the schema is trivial. The reverse is not true.


1

Generally when you are trying to secure an application you want to make sure that you aren't disclosing any information that could potentially be used as part of an attack. This is the same reason that it is more secure to display a generic error page instead of a stack trace. Even though seeing the stack trace probably isn't a vulnerability itself - it ...


0

Maybe would be better to just ask the agency "How the data was filtered and precisely how the agency defined each category?" While I agree that hiding SQL to add security is just "security by obscurity", I also fail to see why providing the SQL queries would be the best way to provide the information you need or claim to need.


2

From source code we can see that sqlinjection1 has four known columns username,password,welcomemessage,id. As people pointed in commnets,We can use error based Sql injection to get the usernames,passwords,welcomemessage,id etc. Post below parameters in sqli $user=1' or exp(~(select * from (select concat_ws(':',username,password,welcomemessage,id) from ...


0

Yes you can nullify the vote. The solution is as follows. The Mysql Database table for voting is instantiated as below. mysql> use test; Database changed mysql> create table sqlinjection2 (ALICE int,BOB int); Query OK, 0 rows affected (0.03 sec) mysql> INSERT INTO sqlinjection2 values (0,0); Query OK, 1 row affected (0.01 sec) mysql> select * ...


4

Removing comments helps against some injections, but by all means not all. In this case you can still zero any field by setting $vote to construct a logical sequence out of what was an assignment: variable : vote`=1 + `vote query : ... SET `vote`=1 + `vote`=`vote`=1 + `vote`+1; This will alternate vote between 0, if it is nonzero, and 1,...


0

I think the simplest, clearest and funniest example is from "The Simpsons": Bart's prank calls: https://en.wikiquote.org/wiki/List_of_Simpsons_Prank_Calls Example: Moe: [answering the phone] Moe's Tavern. Bart: Hello, is Al there? Moe: Al? Bart: Yes, Al. Last name: Coholic. Moe: Let me check... [calls] Phone call for Al. Al Coholic....


2

Perhaps inject a union? You will need to know what columns are returned by the base query. Say you determine that the original query is essentially returning: SELECT id, productName, productDescription, createdDate FROM Products where ID = 1 You can craft a UNION query that matches the same column structure but queries another table. Then if you pass ...


0

It completely depends on what characters are actually filtered. My first try would be an injection using: UNION SELECT You can test it quickly with: id=1 UNION ALL SELECT * FROM products. If It gets you all the products instead of only one, it works. You then have to guess the number of columns for products and their type (there are a lot of ways for ...


0

Maybe you used the option --risk with a value higher than 1. from the official doc: The default value is 1 which is innocuous for the majority of SQL injection points. Risk value 2 adds to the default level the tests for heavy query time-based SQL injections and value 3 adds also OR-based SQL injection tests. so if it's extremely necessary to run the ...



Top 50 recent answers are included