New answers tagged

1

The variable @@version returns the current SQL Server version. Examples here: Microsoft SQL Server 2008 R2 (RTM) - 10.50.1600.1 (X64) Apr 2 2010 15:48:46 Copyright (c) Microsoft Corporation Enterprise Edition (64-bit) on Windows NT 6.0 (Build 6002: Service Pack 2) Going back to basics, to manually find a SQL injection ...


3

This is an empty SQL comment, and is treated the same as a space. This trick can be used to get around filters that strip out spaces. It may also be introduced to bypass a WAF or IDS.


0

I am not sure to understand what you are calling vulnerable column. But I'll try to answer your question. First of all, in order to locate such SQL injection, the easiest way is to inject mathematical operations, for instance: www.vhul-web.com/index.php?id=1 Displays result 1 www.vhul-web.com/index.php?id=2 Displays result 2 ...


1

This is by default disabled on those particular versions. For your exploit to work your database user would need access to the xp_configure command to enable the xp_cmdshell after which you can actually add your user.


1

Short Answer: No. (at least not in the versions I have worked with) Longer Answer: ZAP is not an exploitation tool, it is a vulnerability detection tool. You can however fuzz with ZAP to determine if SQL injection is possible but as it already detected a possible SQL injection the next step is exploiting it in order to verify if it is a true / false ...


0

This URL is https://example.com/login" AND "1"="1. You can not use like that for this parameter. SqlMap has an option that you can use '*' char. ;


0

The "Custom Injection Payload" section of the SQLMap Documentation explains how to add a bypass like this. It seems to me you would use --suffix followed by the AND clause you pasted above. Here is the text from the docs: Custom injection payload Options: --prefix and --suffix In some circumstances the vulnerable parameter is exploitable ...


-2

It always depends on the person listening to you but this is how I would explain it to him/her - Imagine when you're sending a telegram with a message like -- "Happy new year! Please take care. - Fred " and someone who has no good intentions that was able to access your telegram would intercept and replace the highlighted words with -- "Happy new ...


0

Are PreparedStatements sufficient? PreparedStatements are not sufficient on their own. You should step through your code and ask yourself what is necessary, and what is possible. Step through on both the client and the server side, and see what data gets sent, if it's possible to modify it, and what it does. See what things you can do. I can't see the ...


0

Your code handles the SQL insertion correctly. I have two guesses about the attack: The attacker could have repeated the request several times, and your code doesn't check if it has already downvoted the post. The attacker have sent a lot of downvote requests in a very short period of time, allowing him/her to exploit a time of check / time of use race ...


2

Whether you could pursue legal action depends on the contract and terms of service you have established, however that's probably not the right way to go as it will cost you money and lose you at least one customer. You might also discourage your customers from having penetration testing done, which would be a bad thing. I would recommend educating all ...


1

What kind of service are you providing? It depends on your TOS what users can and can not do, if you have a hosting service it depends on your TOS if a user can scan his hosting account for exploits with automated means without your prior consent. Most secure aware people DO test their production scripts/programs not only on localhost, because configuration ...



Top 50 recent answers are included