Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [mysql]

MySQL is an open-source relational database management system.

-1
votes
0answers
36 views

SQL injection for Capture the Flag

So I am in CTF and I need to bypass login form. I only got this message so far: Traceback (most recent call last): File "./main.py", line 145, in do_login if cur.execute('SELECT password FROM ...
0
votes
1answer
64 views

What MySQL information should be kept secret?

I'm writing an open-source program interfacing with a protected MySQL server. I'd like to keep the development environment as close to the production environment as possible. Variables that must be ...
1
vote
1answer
57 views

Security risks of Read-only MySQL Database access behind firewall

Are there any obvious security risks to providing a none IT Staff member read-only Database access (through MySQL Workbench) to a Wordpress Database, if this is behind a firewall/VPN?
0
votes
0answers
15 views

Connect to amazon rds SQL server through spoofed ip address [duplicate]

I'm using amazon MySQL server and grant only my server IP to connect to the database, the question is can someone else access to the database through spoofed IP address and MySQL server credentials?
1
vote
2answers
258 views

Best way to know the algorithm used for a password encryption

I have the following password captured using sqlmap- $2a$08$9eaKUtKdFV8fuOAx0sfr4emrG1aHzGeNsn/rVdW243nw6Ktt.Uc0O Now, I don't know how to decrypt this password because I don't know which ...
1
vote
1answer
76 views

SQL Injection after Like Operator with continuing query

is it possible to add a new query like update in between this?: SELECT characters.id as charId FROM characters WHERE characters.name LIKE '%<User-Input-Here>%' ORDER BY `level` DESC, exp DESC ...
2
votes
1answer
104 views

How safe is it to open source access to MySQL database on github, only permitting SELECT query?

The Setup: Im building an app to model visually world data. A significant part of this project will be the database since that data is what is interesting. I should only need to allow SELECT queries,...
0
votes
1answer
118 views

SQL injection using union statement

I have a table with lots of user info - email, password and others. The server performs this query without using prepared statements: SELECT * FROM login where email = '$_POST'; I want to do an SQL ...
0
votes
2answers
71 views

Should I send the user ID of the user trying to authenticate in a HTTP header when using access token?

Im building a REST api for an ios application! Would it be a good idea to send the user id (primary autoincrementing token in my mySQL database) of an account when authenticating with user token? (...
0
votes
1answer
101 views

In a SQL server, passwords are hashed in chinese. What algorithm it might be using?

While performing the following query, passwords are displayed in Chinese. I'm wondering what hashing algorithm is being used here in order for me to carry out a brute-force attack.
0
votes
2answers
338 views

Getting the column names of a table by brute force blind SQL injection

Is there a way of getting the column names of a table by brute force blind SQL injection in MySQL. so the query would be: select column_name from information_schema.columns WHERE table_name = ‘...
0
votes
1answer
365 views

tamper scripts for bypassing waf sqlmap

I have tried the following tamper scripts in sqlmap but the connection is still getting dropped by the WAF: tamper=apostrophemask,apostrophenullencode,appendnullbyte,base64encode,between,bluecoat,...
0
votes
0answers
32 views

SQL Injection ORDER By not working MySQL Error Based [duplicate]

I've been learning different attack vectors using applications such as bWapp and others to further my practice and knowledge of cybersecurity. I've stumbled across a problem in one of them. If Order ...
0
votes
0answers
44 views

How to make --os-shell command work on UBUNTU 16.04 ( Digital Ocean )?

I have made a vulnerable SQLi website ( to teach students ). I am able to dump the database but I am not able to run os commands or upload os-shell. I want to show them how to use --os-shell option ...
4
votes
1answer
447 views

Is forbiding the ; char enough to prevent SQL injection?

Disclaimer: Parameterized queries are the way to go, no need to discuss about that :) I've seen the following code at a friends place: var query = "SELECT * FROM students WHERE name = " + name; ...
0
votes
1answer
68 views

MySQL vulnerability bind address 127.0.0.1

Am I safe from MySQL access from another host even if they know the credential of my database, including the port? As far as I know the bing port doesn't allow any remote access. Correct me if I'm ...
2
votes
2answers
139 views

Can hacker delete my server files and database where I am using below function?

I want to know how to protect my website from hackers. I am a php-mysql developer. For fetching data from databases I always use MySQLi. For preventing my website from SQL injection, I always use PHP'...
15
votes
5answers
6k views

Can I recover a lost AES key?

I had encrypted 2 MySQL databases with AES_ENCRYPT in ECB 128 bit mode. Now I forgot my encryption key, but I have plain text (I have one database without encryption and same with encryption). How to ...
27
votes
1answer
7k views

Why should we sometimes use --+ instead of — in SQL injection to comment the rest of the query?

I have encountered some websites that when I used -- to comment the rest of the query it didn't work, but when I tried --+ it worked. In the MySQL official documentation there is no such thing as --+ ...
0
votes
2answers
183 views

Blind SQL Injection on Amazon RDS

I found a vulnerability which allows me to run any query on an Amazon RDS server. I was able to extract the user hashes by using the --passwords parameter of sqlmap, and one of the hashes was cracked ...
1
vote
1answer
131 views

Is it safe to concatenate non-input session variables into a SQL string?

I have a php application where the function "makeSessionVar" creates a session variable from application defined data, then concatenates it into the SQL string. function makeSessionVar($A,$B){ // (&...
1
vote
1answer
124 views

Is using JSON a secure way of handling sql queries in python?

The question I will try to articulate this as clearly and best I can: Suppose that I have a python program which connects to a database on a server. Next I ask you to consider that this python ...
1
vote
1answer
78 views

Why are SQL servers not attacked as frequently as ssh servers?

I have a server running with both SSH and MySQL accessible to the public internet. Both run on default ports (22 and 3306). The ssh server is attacked by bots all the time. This is the output of ...
2
votes
0answers
30 views

Why is MySQL 8.0 AES_ENCODE unsafe for statement-based replication?

I read this interesting note in the MySQL 8.0 documentation that seemed a bit confusing to me: Statements that use AES_ENCRYPT() or AES_DECRYPT() are unsafe for statement-based replication. As I ...
21
votes
5answers
3k views

Is password information dumped from the MySQL user table sensitive?

Assume I have dumped MySQL user list using SELECT user, host, password, ssl_type FROM mysql.user; The result looks like this: +------------------+-----------+----------------------------------------...
1
vote
1answer
300 views

How this Unique SQL injection works?

I found a challenge which was vulnerable to SQL injection and it was very very pretty hard to find So, How this unique SQL works? I found this on login form where when I send user=\&pass=||1# as ...
-1
votes
1answer
385 views

Using SQL to compare hashed passwords

Setup A LAMP system (Linux, Apache, MySQL, PHP). Access to db is over the loopback interface (maybe not in the future - dependent on hosting solution). The db contains a table with the username, ...
0
votes
1answer
167 views

Is it SQL Injection Vuln? [closed]

Today my friend asking help to test and prevent his website from sql injection.. After i tried basic sql injection like 1 OR 1=1, ' OR 1--',' '1'='1 There is no mysql error displayed.. But After i ...
0
votes
1answer
193 views

Protect MySQL against brute-force attacks on dedicated CentOS 7 server

I have a database in a dedicated server (CentOS 7) setup by an external provider. I see a disgusting amount of brute-force attempts in MySQL log file every day. I know the best option would be to not ...
1
vote
2answers
46 views

Is there a point to set up passwords for services like MySQL, Redis etc. if we disable their related ports?

Redis' default port is 6379 and MySQL's default port is 3306. Let's say we disable these ports to outside of the world with ufw. And let's say only I have access to the servers. Is there still a point ...
6
votes
2answers
567 views

How dangerous is disclosing a table's structure to users?

I apologize if this is a dumb question. I recently came across a website that embedded its error log out in a JSON response if the request to the website failed. In this case, it appeared there was a ...
0
votes
1answer
61 views

Possibility of SQL injection by static or predefined values

Using direct variables is vulnerable to sql injection. So to prevent attacks we use parameters. $result->bindParam(":id",$_POST['id'],PDO::PARAM_INT) but I am confused regarding the following ...
1
vote
2answers
2k views

MySQL AES_ENCRYPT string key length

In MySQL there are builtin AES_ENCRYPT() and AES_DECRYPT() functions which take the form of: AES_ENCRYPT(str, key_str) What length is required for the key_str argument? Can it be variable? What is ...
0
votes
4answers
148 views

Is it possible to verify if a website is vulnerable to SQLi by viewing its source code?

I've heard the eval() function is vulnerable to SQLi. Can I check for vulnerabilities by simply viewing the website source code?
1
vote
1answer
69 views

Is the hosting OS safe to sql injection hackers by hiding admin ID?

We are 1-3 guys maintaining a fairly large but clumsy developed-in-house website. With around 900+ mysql tables, and a lot of data access code in PHP. Let's say it is huge amount of code for just 1 or ...
2
votes
2answers
117 views

Can root user have access to MySQL data?

Having MySQL using auth_socket as default authentication mechanism for the root user scares me, so I change it to password authentication with rigid controls on password quality and documentation. If ...
0
votes
1answer
129 views

About SQL Injection Mysql

I'm trying to test SQL injection on a site (PHP, uses MySQL Database). When I put an apostrophe in the username field and leave the password box blank, after submitting, the form reloads and the ...
34
votes
11answers
10k views

How to limit the impact of and reduce the risk of SQL injection for existing website?

Our website is 100% API based (with an SPA client). Recently, a hacker managed to get our admin's password (hashed with SHA-256) through SQL injection (and cracking pwd) like this: https://example....
4
votes
1answer
319 views

Possible SQL injection vulnerability?

I'm a developer and I'm creating a script to interface with game servers to update player stats. I was sending a POST request with multipart form data and on the last boundary accidentally had the ...
5
votes
1answer
164 views

Blind SQL Injection and HTTP Version Dependency?

I Recently came across a Virtual Machine that has Blind SQL Injection in the X-Forwarded-For header. I used sleep() to detect the vulnerability. The Payload worked in HTTP/1.0 and not in HTTP/1.1 . ...
7
votes
2answers
587 views

How to store nonce and key when working with libsodium secretbox?

Why am I asking? I am very new to cryptography (so please be patient with me...) and I want to avoid making unnecessary mistakes. I did a lot of research, but - other than with most other programming ...
0
votes
2answers
385 views

How to extract data using SQL injection on a vulnerable ASP.NET application?

I managed to find a vulnerability in a so-called friend of mines website and I want to show him that his website is vulnerable to data extraction. When I use something like yes')-- as post I get the ...
0
votes
2answers
84 views

What can be done with MySQL password

Let's say there's a simple website hosted on the web, based on Flask + MySQL. The website's functionality is secure and does not allow arbitrary queries to be run against the database. However, let's ...
3
votes
1answer
231 views

protection from Backdoor hacks from disgruntled developer/ employee

I created a ecommerce site with a developer. He completed almost all his work but in the end we had some financial disagreements so our partnership ended in a bitter dispute. That developer threatened ...
-1
votes
1answer
315 views

What does pseudonymization mean in the context of web development?

In readiness for the new GDPR legislation that is coming in on May 25th, I am trying to understand what pseudonymization means in the context of web development. The info I've read infers that it is ...
3
votes
2answers
2k views

Is PHP OpenSSL safer than just using MySQL AES_ENCRYPT/DECRYPT alone?

I wish to encrypt/decrypt data in my MySQL database stored on my server. I use a salted hash for my passwords. All encryption/decryption would occur on the server. I use PHP end points which my remote ...
2
votes
0answers
135 views

Does MySQL error “Illegal mix of collations” imply an SQL injection vulnerability?

The user input of a given query is being sanitized (PHP, real_escape_string), yet the query fails with "Illegal mix of collations". This query is below: SELECT * FROM `table` WHERE `column` = "�½��ļ��...
3
votes
1answer
511 views

Are MariaDB's encryption and compression functions secure?

MariaDB [(none)]> SET @key_str = SHA2('Is it secure?',512); Query OK, 0 rows affected (0.00 sec) MariaDB [(none)]> SET @crypt_str = AES_ENCRYPT('cleartext',@key_str); Query OK, 0 rows affected (...
0
votes
0answers
396 views

Port forwarding mysql when it's bound to localhost

I am a pentesting n00b, working my way through vulnhub VMs. I am stuck trying to figure out how to make portforwarding work with a mysql instance bound to address of 127.0.0.1. Can someone give me ...
0
votes
2answers
261 views

SQL injection evasion

I know that filtering bad keyword is not a good approach to preventing SQL injection. However, when I couldn't answer why this is not a good approach, here is my rule: 1) When I see ;, I make it to '...