Questions tagged [mysql]

MySQL is an open-source relational database management system.

Filter by
Sorted by
Tagged with
0
votes
3answers
103 views

Is my login script secure – how to improve it?

I have a login system for my website that works as follows: In the database I have a table called users with the fields user, password and authentication_token. user gets set manually by request in ...
0
votes
1answer
27 views

SQLi Filter Bypass with banned table/column names

I've studying and practicing different approach to SQLi filter bypass and I faced a challenge. What if the WAF filters look for specific strings rather than SQL keywords? Example: Filter: /UNION/ SQLi:...
12
votes
1answer
4k views

How can I secure MySQL against bruteforce attacks?

I use Fail2ban on a busy Debian-based database server to secure ssh against brute force attacks, but for performance reasons, I don't want to log every connection from the application server (it would ...
0
votes
0answers
23 views

Mysql SSL Type property for mysql.user

In Mysql database, I have a user for which in mysql.user table I have ssl_type set as X509 and there is no password. Is this a security risk? According to https://www2.navicat.com/manual/online_manual/...
0
votes
0answers
39 views

How do I connect using ssh tunnel to heroku's cleardb mysql database from some gui tools like mysql workbench or beekeeper studio, when run on ubuntu

Im currently trying to connect to the Heroku's mysql cleardb database from beekeeper studio. My connection works when done normally. But when I use the ssh tunnel Im facing some issue. Their ...
0
votes
1answer
58 views

Trying to do an SQL injection into a login field [closed]

I have an assignment to make an SQL injection - I found a login field that spits out an error, but I can't seem to make queries work inside of it. For your information it's an Mysql server. What is ...
0
votes
0answers
61 views

Execute sqlmap in a javaScript object cookie

I am studying sqli and I found a blind sqli vulnerability in a cookie and I have exploited manually, however, I would like to detect and exploit it with sqlmap. Cookie looks like javascript object ...
1
vote
1answer
110 views

Blind SQL injection in sort direction

I have an SQL injection in a query where I control the sort direction parameter i.e: SELECT * from x where y=y ORDER BY COLUMN_NAME [SORT_DIRECTION] When I control the SORT_DIRECTION, which is ...
0
votes
4answers
189 views

Can here be SQL Injection

i got till moment when i do not know if it is secure! If SQL injection is inserted into myTableTwo via safe PDO query will it make my query below SQL injection open? Is the query below safe? $mysfield ...
0
votes
1answer
88 views

Is it possible to locate web document root using SQL query/SQL Injection?

I have access to MySQL database which the current user has FILE privilege. I want to upload a web shell but I do not know the root directory of the web server. Is it possible to somehow locate the ...
1
vote
1answer
88 views

MySQL password rotation: Using a single user to change other user passwords

I'm currently working on setting up a password rotation strategy for an AWS Aurora/MySQL based application. My plan was to use a strategy like this... Application usernames/passwords stored in AWS ...
0
votes
1answer
111 views

SQLMap Only Returns information_schema

I run this command python sqlmap.py -u https://acme.com/post.php --data "id=1" --tamper="between,randomcase,space2comment" -v 3 --random-agent --dbs but SQLMap only returns ...
0
votes
0answers
150 views

Sqlmap not detects error based injection

I am working on Hack the VM (hard machine) for my OSCP preparation There is a web app with two drop down boxes.. Year and month.. both contain numbers and a submit to fetch data from DB based on year ...
1
vote
1answer
205 views

ORDER BY sort direction is exploitable in SQL Injection?

I am testing an internal application and come across a page where if I am able to make the application display a SQL error because it does not recognize the payload for ORDER BY sort direction. The ...
-1
votes
1answer
72 views

Stop UUID injection in MYSQL Database

I have a cordova app that logs users in based on their devices model+platform+uuid. For example: Pixel 2Android39798721218. The way this works when a user uses a new device is detailed in the ...
0
votes
1answer
108 views

Ways to detect CVE-2017-12419 intrusion

I have a free infinityfree.net web server that was vulnerable to CVE-2017-12419 for quite a big window of time. After fixing the gap and changing the passwords, what are some ways to detect if the ...
0
votes
1answer
82 views

Having problems with SQL injection with mysqli extension PHP

I am new to SQL injections, and people on Reddit asked me do the portswigger labs. Which I did up till before 2nd order ones. So I am pretty comfortable with usual SQL injections. Now I have myself ...
1
vote
0answers
38 views

Two persons-rule on MySQL databases for “manual fixes”

In order to "harden" our compliance, we wanted to enforce a two-persons rule on the MySQL production database for "manual fixes". Such "manual fixes" frequently arise due to: Bug in the application (...
0
votes
0answers
199 views

Sqlmap waf bypass

This is my first post here, sorry for my english. Im making some test around, because i want to learn more about sql injection. Im not really good as manual sql injection, so im using sqlmap. what ...
0
votes
1answer
175 views

SQL injection and XSS prevention

I would kindly ask you to review the following code and tell me if it's enough to prevent most of SQL injection and XSS attacks. SQL injection: treated via PDO prepared statements; XSS: All user's ...
1
vote
0answers
68 views

Possibility of dynamically generated prepared statements and stored procedure SQL injection?

I am working on Java application which generate SQL prepared statements and stored procedure query strings using user inputs and executes with PreparedStatement.execute() or CallableStatement.execute()...
0
votes
1answer
91 views

Pentesting Webserver Dead End (MySQL White Listing Bypass)

I am currently pentesting a webserver running MySQL, managed to obtain its db configuration (w/ login credentials) but the hostname is in a Local Area Network. The server has white listing enabled, so ...
0
votes
0answers
44 views

Unable to exploit SQL injection in the parameter

During my testing I have found a vulnerable parameter in an API (/api/v1/documents/?direction=desc&limit=30&mode=reports**&page=1**) and its parameter is page=1 at the end. Upon giving the ...
-1
votes
2answers
236 views

How secure is a 24 character mysql password?

I recently set up my WordPress blog and I changed the password of its mysql database to a 24 character randomly generated password. I have a few questions about the database: Is my database name ...
26
votes
12answers
7k views

Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql real escape string() function

Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql_real_escape_string() function?
137
votes
24answers
20k views

Why can't I just let customers connect directly to my database?

I'm pretty sure this is a stupid idea but I'd like to know why, so bear with me for a moment. Lots of the work backend developers do is providing CRUD access to customers via HTTP, essentially mapping ...
1
vote
1answer
181 views

SQL injection with no output

So I found this section of a webpage, which is a basic "feedback box". It had all the characteristics of an SQL injectable element. Scanned it with OWASP, it was true. Tried SQLmap, it gave me ...
3
votes
1answer
59 views

Sql map Manual Vulnerability Assessment

I am trying to do penetration testing for one of my client. The platform is Code ignitor. There is an endpoint /find/1 The function queries the vehicle table where vehicle ID is 1 with no sanity check....
0
votes
1answer
88 views

A New Blog Post is showing on top of my home page from Unknown user cyberanon - How to Remove the post? [closed]

I have just launched our brand new blog website (php/mysql). I don't have any idea about cyber security. Yesterday we published a topic on coronavirus vaccine. I just noticed a new post is sitting on ...
4
votes
0answers
158 views

Whats the meaning of ] symbol in a SQL query?

I have come across a CTF challenge that has a part with an SQL injection (MySQL DB). I have completed it, but I do not know why or how the injection works. The query in the PHP application would ...
0
votes
1answer
72 views

If I seperate VPS into WebApp/MySQL VPS & separating WebApp projects into Admin/User projects. Is It more secure?

If I want to deploy Laravel WebApp using MySQL DB on VPS like DigitalOcean, Vultr or similar platforms, should I separate VPS into WebApp VPS & MySQL VPS? Is it more secure? And what if I ...
1
vote
0answers
218 views

SQLMAP with single URL application

I have a local application which will be accessible only after login. Its single URL application, URL of application won't change, just it use 'XMLHttpRequest' to refresh the content of screen based ...
1
vote
1answer
154 views

It this a safe way to filter input into an SQL query

Is this a safe way to filter strings into an SQL query in java or could this be bypassed? I understand that I should just parameterize everything but this is an ancient code base where it makes more ...
0
votes
0answers
261 views

Is this SQLMap query is correct?

I am practicing on some vulnerable application, and I am asked to find an injection vulnerability with a payload. it states there is a common and simple filter in place. Then I need to extract the ...
2
votes
1answer
51 views

Is there a way to access the local DB from external webapp?

I found a Django app running on http://test.com that is running on debug mode. After trying some wrong paths I got with the django error screen showing the stacktrace and the credentials used to ...
3
votes
1answer
423 views

Is SQL Injection possible in this case (REGEXP)?

I'm on a website which have a program, there is a search input for keywords. When I input & or < or > and search, it returns Got error 'empty (sub)expression' from regexp error and when I ...
1
vote
1answer
101 views

Risk of getting MySQL database compromised with a client application

I want to make a client-side, Windows-based application that allows the user to register and it will store the registration details in an online MySQL server. However when i googled ways to do this, ...
0
votes
1answer
119 views

How can this sql query be injected?

I've a php code where I get the page number from a GET request and then run a sql query to select records from the database by the page number $maxPerPage = 20; $page = $_GET["p"]; $applicants = DB:...
2
votes
1answer
1k views

Server returns 403 when I try SQL injection

I am trying to pentest my friend's site. It is clearly vulnerable to SQL injection attack based on the error messages I get from entering different get parameters. Whenever I try very simple attacks ...
0
votes
2answers
3k views

How do you perform SQL injection on a login form that checks for email address format?

A recent employment test prompted me to perform an SQL injection to gain access into their website. Using manual and automated (Burp) methods, I was able to find out the form is definitely vulnerable ...
1
vote
1answer
344 views

Is it safe to leave MySQL root user without a password if it uses auth_socket?

Since MySQL 5.7, the root user is configured to use the auth_socket authentication plugin instead of a password. Is it safe to leave the root user that way (without a password)?
2
votes
2answers
1k views

How does this SQLi statement work?

Hey i'm trying the hacker101 CTF's im still pretty new at this stuff The CTF answer to the flag i'm trying to understand is https://github.com/testerting/hacker101-ctf/tree/master/micro-cms_v2/flag0 ...
0
votes
1answer
137 views

Sql Injection ByPass problem [closed]

I don't know what if part of this command does. FROM table WHERE id = 1 AND IF(( Ascii(Lower(Substring((SELECT User()), $i, 1))) ) != $s, 1, Benchmark(200000, Md5(Now()))) ...
0
votes
1answer
57 views

what can you do in sql login details and encryption key is available

I am practicing pen testing in a protected box and I have a vulnerable Magento website and I managed to get its MySQL config file which is app/etc/local.xml. In this file there is information such as:...
4
votes
1answer
248 views

How does MariaDB's ed25519 auth scheme work?

Newer versions of MariaDB (a MySQL database server fork) have a new password based auth scheme called "ed25519". The docs are very sparse regarding how it works and what it does. https://mariadb.com/...
0
votes
1answer
165 views

MySQL brute force attempts from localhost

We have a Linux box (Ubuntu VERSION="18.04.2 LTS (Bionic Beaver)" that hosts MySQL. When I check the MySQL logs I see constant failed attempts to log in from root@localhost. does this imply that I ...
1
vote
1answer
566 views

Is sql injection possible on this websocket?

I was testing a websocket when i found an add to cart request like the following ["{\"ITEMS\":{\"ITEM\":[{\"package_id\":\"123\",\"customer_type\":\"3\",\"qty\":1,\"}"] I tried to edit the value of ...
1
vote
1answer
89 views

Does MySQL Router offer any protection of MySQL-DBs behind it?

I recently stumbled upon MySQL Router. Its documentation defines it's purpose as follows: MySQL Router is part of InnoDB cluster, and is lightweight middleware that provides transparent routing ...
0
votes
0answers
998 views

SQL Injection bypass UNION filter/restriciton

I've recently had an interesting interview exercise I haven't completed and it does puzzle me what kind of filter/protection they've used. The vuln app is a PHP with simple MariaDB (5.5.56) back-end, ...
-1
votes
1answer
84 views

mysql_query | Why " breaks query but ' does not?

I ran across an opportunity for SQL injection the other day in some legacy code ... // input: email@email.com" $email = $_POST['email']; mysql_query('SELECT * FROM users WHERE email = "'.$email.'" ');...

1
2 3 4 5
10