Tag Info

New answers tagged

0

As others have commented, you need to pay attention to the resulting SQL statement. With a SQLi you're typically only needing/wanting to inject on one field. As @schroeder noted, your example input ends up essentially with SELECT * FROM users WHERE userName='' OR '1' = '1' AND password='' OR '1' = '1' being sent to the SQL server. The AND and OR ...


2

If you are injecting both fields at the same time: Think about the SQL string with the replaced text: "SELECT * FROM users WHERE userName='$usr' AND password='$psw' " becomes "SELECT * FROM users WHERE userName='' OR '1' = '1' AND password='' OR '1' = '1' " Can you run that query from a SQL prompt and get a response? I think you might find that the ...


1

Confirmed that it works as intended with an asterisk, using the sqlmap from Backtrack 5r2, but should behave the same with Kali. The following example doesn't work as I'm running it against a static html file, but it shows the injections occuring at the correct place. First I saved the request to a file and added the asterisk: ...


1

When it comes to Cross-site scripting, the most important thing is context. The context in which it gets reflected or stored.I will demonstrate this with a real example from my experience. Once while bug-hunting i noted that a URL parameter was getting reflected inside a variable: http://www.example.com/blah.php?id=test&var=101011 The value of var was ...


1

By looking at the MySQL select syntax, you can see that it support into outfile at the end of a query. If you look at MySQL Insert Syntax, you'll see that there is no reference to into outfile. There is a good reason for this, insert is modifying the database, and a select is obtaining data, and the into outfile is a modifier of where that data goes. ...


10

Oh yes it is! Consider this HTML: <a href="{{str}}"> and consider an input like: " onmouseover="alert('GOTCHA')" You get the picture. If your javascript is being injected within a tag then you don't need the angle brackets. I borrowed this off this similar S/O post: http://stackoverflow.com/questions/5696244/xss-is-escaping-and-sufficient ...


1

At the moment I think I'm safe from the generic '); DROP TABLE table; -- exploit but there are more I'm not too sure about. You will be save from this most of the time, as you have to explicitly use multi_query in PHP + MySQL to allow stacked queries (multiple queries separated by a semicolon) What you are not save from are SQL injections that do not ...


7

The proper way to prevent SQL injections is to use Prepared Statements. Here is an abbreviated example taken from the PHP documentation: $stmt = $mysqli->prepare("INSERT INTO test(id) VALUES (?)"); $stmt->bind_param("i", $id); $stmt->execute(); Instead of literally substituting the value of a variable in your query, which will always be ...


0

There's absolutely no guarantee that every application will run stacked queries. In fact, the old ext/mysql extension (which is still commonly used in PHP) never supported them. So a “naive” attack where you just append your own queries may not work here. You'll probably have to work with the original query itself. However, there are still plenty of attack ...


2

I'm not a PHP programmer, but I believe most people use mysql_query() when executing MySQL queries in PHP and this will only allow you to execute one SQL statement at a time. It is possible to execute multiple statements in PHP, but specific steps need to be taken. It's possible that whoever wrote this code is using mysql_query which would mean that you ...


3

The second version of the website escapes single quotes to two single quotes. Is there a way I can log in as the user hello_world? Yes, because this kind of protection is not secure at all (I also would not call it escaping). Attack Imagine an attack like this: Username: hello_world Password: \' OR 1=1 # Which would be transformed to: ...


0

This depends on your understanding of "special characters". If you filter out every character that's not alphanumeric, you might be safe, but I can't answer a "yes" on this for sure. Generally, it is not a good idea to implement your own security checks for database queries. Instead, use built-in functions like mysql_real_escape_string() (if you're using ...


0

should I rely on some other filters to protect against the sql injection No. Any other filters you might write are not going to be as good as the inbuilt protection (prepared statements, either with mysqli or PDO), so you should not rely on it at all. If you want an extra layer of security just in case (not a bad idea, you can never be too save), I ...


0

All you need access to is any page on the site. There is a blog post of some advanced proof-of-concept code from the person who originally found the vulnerability. These proofes of concept show: Using the cookie contents to get a session for an arbitrary user. Using the form api in a cookie to execute arbitrary php (while leaving no traces in the logs) ...


2

I'm assuming data is entered by some sort of front end, with a list of fields? For arguments sake I'll assume 4 fields. In the first field do this: ''',(SELECT @@version), (SELECT @@version), (SELECT @@version))-- In the other fields put anything you want because they're commented out by the double dash anyway. This should return the server version to you ...


0

The SQL injection required a Drupal form. The login form is ubiquitous. It's placed on the Drupal site by default, so it's most likely to show up in targets. If there was another form on the website, it could be used for the attack as well.


3

SQLi is not about the underlying DBMS but about the application code. Any DBMS will execute commands sent to it because that is what they are designed to do. It's up to the application developers that connect to those DBMS to ensure they are doing it correctly.


4

All of these database platforms give developers the ability to execute parameterized queries, which is the industry standard for preventing SQL Injection. Based on this - I would say none are more vulnerable than the others.


0

I have participated in Live and online CTF competitions. It depends what sort of CTF you would like to organize, and what sort of challenges there will be, I mainly categorize them into two categories. Web Application System/Network Now if you want to organize a CTF involving web applications only that has vulnerabilities and users are required to ...


0

As far as I got your question, you need to know if your code is secure to sql injection or not. For that you need to use tools like sqlmap or havij or you can try vulnerability assessment tools like Acunetix,OWASP ZAP or burp-suite, so with them you can inject check if your database is vulnerable to this attack. Read more about secure coding on OWASP and ...


0

Not sure if this covers exactly what you ask for, but here is something at least. Using a vulerability discovery tool like Nikto, Nessus, Nexpose, MSF or others to scan for injections will probably discover some injectable pages, but it's likely it won't be able to detect security issues as well. Using tools + manuel testing seem to be the best option for ...


1

Not sure I understand the question completely, but I'll try to answer. How to check for sql injection attack The de-facto standard tool is sqlmap. It is a very powerful tool and is thoroughly documented. which IDE or tool we used? bcoz netbeans and other type of IDE are more secured? NetBeans (or any other IDE) has absolutely nothing to do with ...


1

The query takes two parameters, $user and $pass. As you can see, the $user variable is properly quoted, while the $pass variable is used as-is, which makes it vulnerable to Sql Injection. From the code it is evident that all we need to do is to return any value from the query in order to get access: if ($result->num_rows == 0) { $error = ...


0

Did you google this? Here is your answer http://hackertarget.com/sqlmap-post-request-injection/


0

In your specific case, it's not vulnerable. However, in a case with no quotes, it would be: $comment_id = mysql_real_escape_string($_GET['id']); $query = "SELECT id, title, message FROM comments WHERE id = " . $comment_id . " AND published = 1"; // ... mysql_query($query); Since there's no quote to escape from, an attacker can simply put 1 OR 1=1 -- - to ...


-1

If you can still use the char function and () insert into users values(666,char(0x63)+char(0x65)…)


1

You can find a lot of CTF event in this website as a reference about how they organize it, their CTF's type, and what kind of challenges offered. For a more detailed and technical stuff about CTF challenges, I recommend you to read some CTF writeup by active CTF teams. As an example, Dragon Sector is an active team and usually make some writeup after ...


0

There are a lot of detailed accounts available of Capture the Flag at DEF CON which might provide the insight you're looking for, and you can try asking specific questions about organization in the DEF CON Community Forums. They do it up.


1

You're syntax is a little off in both of your attempts at this. Since you mention you're using DVWA I'll provide the source here (so that we can rule out PHP/DB errors on your side) <?php if(isset($_GET['Submit'])){ // Retrieve data $id = $_GET['id']; $getid = "SELECT first_name, last_name FROM users WHERE user_id = '$id'"; $result = ...


-1

The first thing when playing around security is to hide yourself :) You would not go to rob the bank just for testing ? lol And yes, they MAY have seen something wrong : - with a remote control and view software that they would have installed - by analyzing the network traffic and seeing connection attempts to their databases - by having received alerts ...


4

Yes, they can see what you did. They will be able to see what sites you were hitting and that you were sending SQL injection code. You have likely violated your Acceptable Use policies at a minimum, and possibly committed a crime (depending on your jurisdiction). Be very open and honest and ask for help in trying to understand how you can stay in ...



Top 50 recent answers are included