Tag Info

New answers tagged

0

This is the condition that causes the warning to be shown: if kb.columnExistsChoice is None and not any(_ for _ in kb.injection.data if _ not in (PAYLOAD.TECHNIQUE.TIME, PAYLOAD.TECHNIQUE.STACKED)) and not conf.direct: The individual conditions mean: kb.columnExistsChoice is None – previous answer to the subsequent question "are you sure you want to ...


0

You aren't giving us much information to go off of, but I will try to give a basic example. It helps to have working knowledge of how a MySQL query would be used in an application. This allows you to predict what is happening on the server side which allows you to craft a SQL Injection attack. For example, say you are on a page that updates a record and ...


0

I am coming from your post from the null group. Glad you got almost closer to 0wn the system;) in sqlmap's parlance LEVEL could mean two things. I am responding to your edit on Sept 4 12.58. -v (1-6) is the verbosity level, which is used to output specify the amount of messages sqlmap spits to the screen. --level (1-5) is the sqli detected level. If the ...


3

Yes, illegal because you are attempting to access information that you shouldn't have access to. Checkout the Computer Misuse Act 1990. Sections 1-3 of the Act introduced three criminal offences unauthorised access to computer material, punishable by 6 months' imprisonment or a fine "not exceeding level 5 on the standard scale" (currently £5000); ...


0

Are you able to replay the request in burp? (Send To Repeater => Go) If so the easy way to get this into SQLMap is to use the CO2 extension which adds "Send to SQLMap" in the right-click menu this gives you the command-line to give to SQLMap with all your cookies and any data in the request.


0

What it looks like you are trying to do is to run SQLmap on a static text file. The Request file is designed to capture requests to REPLAY against the server. Your command needs the proxy or URL you need to test.


2

Can you remove the brakes of your car to save weight? Well, if you only drive on an isolated site and keep the speed at a minimum and ensure that nothing extraordinary will ever happen (like an uninformed person using the car), probably. Your method “works” as long as you control every single aspect of the system and don't overlook anything. You've already ...


1

Escaping in general has had issues. Please use prepared statements, instead of escaping anything. It's the only sane way to pass parameters to SQL queries. I'm pretty sure it's also the fastest, since it's just passing the values to the sql server.


-1

Using own sanitizer is not a good choice when there exists default function for that. secondly for avoiding sql injection you can use application level firewall or filter. for example you can load mod_security in Apache server for preventing sqli attacks.


4

Your code fails: if the default connection charset on the MySQL server is not a strict ASCII superset, for example if it is Shift-JIS (which can smuggle the byte for backslash in the second byte of a multibyte sequence); if the MySQL server is configured to use the no_backslash_escape sql_mode option (as it may be for interoperability because backslash ...


10

Regarding your sanitization function - while I can't produce an exploit for the exact example you provided, if we change your example to something like this: $sql = "UPDATE ipsum SET price=$str WHERE id=1337"; If a value of 10, otherColumn=1234 or maybe 10;-- was passed in for $str you could see problems. If you roll your own sanitization function and ...


6

Firstly, PHP already has your second function and it's called addslashes(). The docs explicitly say: To escape database parameters, DBMS specific escape function (e.g. mysqli_real_escape_string() for MySQL or pg_escape_literal(), pg_escape_string() for PostgreSQL) should be used for security reasons. If your DBMS doesn't have an escape ...


3

You can exploit the != comparison of strpos’s return value and false as 0 != false is false: var_dump(0 != false); // bool(false) This is due to implicit type conversion to boolean, where 0 is converted to false. So you only need to ensure one of the strpos returns 0, which means $id has to start with either union or select, for example: id=union' union ...


1

SQL Injection does not require the use of union or select . SQL injection means that the query structure itself has been altered by user input. How about where $id is ' OR '1'='1? This will make your query become SELECT username,password FROM admin WHERE username='' OR '1'='1' ORDER BY 1 which means all records will be returned. The solution is to use ...


2

Theoretically, I think this can be bypassed using HPP (HTTP Parameter pollution), for example ?id=union select&id=union select ... counter==2 will be bypassed this way. One other way I think could be using comments like un/**/ion+se/**/lect One other thing to note that to bypass this, we can proof the counter false using legitimate union select ...


1

I would demonstrate a simple SQL injection, it's always nice to see the look on people's faces when you attack a website with a browser as your only weapon. Setup a simple site with a login page and then show them how you can expose the admins password by simply adding few characters to the url. After you get the admin's password delete the entire site. ...


0

There's no need to reconstruct the URL. SQLMAP accepts the following variations: www.target1.com/vuln1.php?q=foobar www.target2.com/vuln2.asp?id=1 www.target3.com/vuln3/id/1* Source: https://github.com/sqlmapproject/sqlmap/wiki/Usage


7

This looks like a fully automatic attack which is performed by bots on random websites they find. The attack is trying to get your database to output the string &~! (ASCII values 38, 126 and 33). They likely parse your websites response for that string and when they find it, the bot assumes that it was the result of its injection and reports it to a ...



Top 50 recent answers are included