Questions tagged [mysql]

MySQL is an open-source relational database management system.

Filter by
Sorted by
Tagged with
-1
votes
0answers
64 views

@@ used in an SQL injection [closed]

What is he trying to do here? [06/Aug/2020:11:44:39 +0000] "GET /index.php HTTP/1.1" 200 8271 "@@e0EEY" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, ...
0
votes
0answers
26 views

Mysql Privilege Escalation [closed]

I have a mysql user (version 5.5). Role is only USAGE can't do load_file function, is possible to privilege escalation?
0
votes
1answer
47 views

SQLMap Only Returns information_schema

I run this command python sqlmap.py -u https://acme.com/post.php --data "id=1" --tamper="between,randomcase,space2comment" -v 3 --random-agent --dbs but SQLMap only returns ...
0
votes
0answers
46 views

Sqlmap not detects error based injection

I am working on Hack the VM (hard machine) for my OSCP preparation There is a web app with two drop down boxes.. Year and month.. both contain numbers and a submit to fetch data from DB based on year ...
1
vote
1answer
93 views

ORDER BY sort direction is exploitable in SQL Injection?

I am testing an internal application and come across a page where if I am able to make the application display a SQL error because it does not recognize the payload for ORDER BY sort direction. The ...
-1
votes
1answer
69 views

Stop UUID injection in MYSQL Database

I have a cordova app that logs users in based on their devices model+platform+uuid. For example: Pixel 2Android39798721218. The way this works when a user uses a new device is detailed in the ...
0
votes
1answer
98 views

Ways to detect CVE-2017-12419 intrusion

I have a free infinityfree.net web server that was vulnerable to CVE-2017-12419 for quite a big window of time. After fixing the gap and changing the passwords, what are some ways to detect if the ...
0
votes
1answer
70 views

Having problems with SQL injection with mysqli extension PHP

I am new to SQL injections, and people on Reddit asked me do the portswigger labs. Which I did up till before 2nd order ones. So I am pretty comfortable with usual SQL injections. Now I have myself ...
1
vote
0answers
38 views

Two persons-rule on MySQL databases for “manual fixes”

In order to "harden" our compliance, we wanted to enforce a two-persons rule on the MySQL production database for "manual fixes". Such "manual fixes" frequently arise due to: Bug in the application (...
0
votes
0answers
75 views

Sqlmap waf bypass

This is my first post here, sorry for my english. Im making some test around, because i want to learn more about sql injection. Im not really good as manual sql injection, so im using sqlmap. what ...
0
votes
1answer
132 views

SQL injection and XSS prevention

I would kindly ask you to review the following code and tell me if it's enough to prevent most of SQL injection and XSS attacks. SQL injection: treated via PDO prepared statements; XSS: All user's ...
1
vote
0answers
66 views

Possibility of dynamically generated prepared statements and stored procedure SQL injection?

I am working on Java application which generate SQL prepared statements and stored procedure query strings using user inputs and executes with PreparedStatement.execute() or CallableStatement.execute()...
0
votes
1answer
59 views

Pentesting Webserver Dead End (MySQL White Listing Bypass)

I am currently pentesting a webserver running MySQL, managed to obtain its db configuration (w/ login credentials) but the hostname is in a Local Area Network. The server has white listing enabled, so ...
0
votes
0answers
33 views

Unable to exploit SQL injection in the parameter

During my testing I have found a vulnerable parameter in an API (/api/v1/documents/?direction=desc&limit=30&mode=reports**&page=1**) and its parameter is page=1 at the end. Upon giving the ...
-1
votes
2answers
189 views

How secure is a 24 character mysql password?

I recently set up my WordPress blog and I changed the password of its mysql database to a 24 character randomly generated password. I have a few questions about the database: Is my database name ...
26
votes
12answers
7k views

Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql real escape string() function

Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql_real_escape_string() function?
136
votes
24answers
19k views

Why can't I just let customers connect directly to my database?

I'm pretty sure this is a stupid idea but I'd like to know why, so bear with me for a moment. Lots of the work backend developers do is providing CRUD access to customers via HTTP, essentially mapping ...
1
vote
1answer
122 views

SQL injection with no output

So I found this section of a webpage, which is a basic "feedback box". It had all the characteristics of an SQL injectable element. Scanned it with OWASP, it was true. Tried SQLmap, it gave me ...
3
votes
1answer
51 views

Sql map Manual Vulnerability Assessment

I am trying to do penetration testing for one of my client. The platform is Code ignitor. There is an endpoint /find/1 The function queries the vehicle table where vehicle ID is 1 with no sanity check....
0
votes
1answer
85 views

A New Blog Post is showing on top of my home page from Unknown user cyberanon - How to Remove the post? [closed]

I have just launched our brand new blog website (php/mysql). I don't have any idea about cyber security. Yesterday we published a topic on coronavirus vaccine. I just noticed a new post is sitting on ...
4
votes
0answers
143 views

Whats the meaning of ] symbol in a SQL query?

I have come across a CTF challenge that has a part with an SQL injection (MySQL DB). I have completed it, but I do not know why or how the injection works. The query in the PHP application would ...
0
votes
1answer
63 views

If I seperate VPS into WebApp/MySQL VPS & separating WebApp projects into Admin/User projects. Is It more secure?

If I want to deploy Laravel WebApp using MySQL DB on VPS like DigitalOcean, Vultr or similar platforms, should I separate VPS into WebApp VPS & MySQL VPS? Is it more secure? And what if I ...
1
vote
0answers
165 views

SQLMAP with single URL application

I have a local application which will be accessible only after login. Its single URL application, URL of application won't change, just it use 'XMLHttpRequest' to refresh the content of screen based ...
1
vote
1answer
117 views

It this a safe way to filter input into an SQL query

Is this a safe way to filter strings into an SQL query in java or could this be bypassed? I understand that I should just parameterize everything but this is an ancient code base where it makes more ...
0
votes
0answers
148 views

Is this SQLMap query is correct?

I am practicing on some vulnerable application, and I am asked to find an injection vulnerability with a payload. it states there is a common and simple filter in place. Then I need to extract the ...
2
votes
1answer
50 views

Is there a way to access the local DB from external webapp?

I found a Django app running on http://test.com that is running on debug mode. After trying some wrong paths I got with the django error screen showing the stacktrace and the credentials used to ...
3
votes
1answer
319 views

Is SQL Injection possible in this case (REGEXP)?

I'm on a website which have a program, there is a search input for keywords. When I input & or < or > and search, it returns Got error 'empty (sub)expression' from regexp error and when I ...
1
vote
2answers
93 views

Risk of getting MySQL database compromised with a client application

I want to make a client-side, Windows-based application that allows the user to register and it will store the registration details in an online MySQL server. However when i googled ways to do this, ...
0
votes
1answer
115 views

How can this sql query be injected?

I've a php code where I get the page number from a GET request and then run a sql query to select records from the database by the page number $maxPerPage = 20; $page = $_GET["p"]; $applicants = DB:...
2
votes
1answer
995 views

Server returns 403 when I try SQL injection

I am trying to pentest my friend's site. It is clearly vulnerable to SQL injection attack based on the error messages I get from entering different get parameters. Whenever I try very simple attacks ...
0
votes
2answers
1k views

How do you perform SQL injection on a login form that checks for email address format?

A recent employment test prompted me to perform an SQL injection to gain access into their website. Using manual and automated (Burp) methods, I was able to find out the form is definitely vulnerable ...
1
vote
1answer
273 views

Is it safe to leave MySQL root user without a password if it uses auth_socket?

Since MySQL 5.7, the root user is configured to use the auth_socket authentication plugin instead of a password. Is it safe to leave the root user that way (without a password)?
2
votes
2answers
848 views

How does this SQLi statement work?

Hey i'm trying the hacker101 CTF's im still pretty new at this stuff The CTF answer to the flag i'm trying to understand is https://github.com/testerting/hacker101-ctf/tree/master/micro-cms_v2/flag0 ...
0
votes
1answer
136 views

Sql Injection ByPass problem [closed]

I don't know what if part of this command does. FROM table WHERE id = 1 AND IF(( Ascii(Lower(Substring((SELECT User()), $i, 1))) ) != $s, 1, Benchmark(200000, Md5(Now()))) ...
0
votes
1answer
56 views

what can you do in sql login details and encryption key is available

I am practicing pen testing in a protected box and I have a vulnerable Magento website and I managed to get its MySQL config file which is app/etc/local.xml. In this file there is information such as:...
4
votes
1answer
185 views

How does MariaDB's ed25519 auth scheme work?

Newer versions of MariaDB (a MySQL database server fork) have a new password based auth scheme called "ed25519". The docs are very sparse regarding how it works and what it does. https://mariadb.com/...
0
votes
0answers
77 views

Is whitelisting Google Apps Scripts Actually safe?

Google offers a way to connect it's apps (like google sheets) to a sql server. In order to do this, you need to whitelist their google apps scripts IPv4 subnets. I don't see how this could be secure ...
0
votes
1answer
144 views

MySQL brute force attempts from localhost

We have a Linux box (Ubuntu VERSION="18.04.2 LTS (Bionic Beaver)" that hosts MySQL. When I check the MySQL logs I see constant failed attempts to log in from root@localhost. does this imply that I ...
1
vote
1answer
471 views

Is sql injection possible on this websocket?

I was testing a websocket when i found an add to cart request like the following ["{\"ITEMS\":{\"ITEM\":[{\"package_id\":\"123\",\"customer_type\":\"3\",\"qty\":1,\"}"] I tried to edit the value of ...
1
vote
1answer
70 views

Does MySQL Router offer any protection of MySQL-DBs behind it?

I recently stumbled upon MySQL Router. Its documentation defines it's purpose as follows: MySQL Router is part of InnoDB cluster, and is lightweight middleware that provides transparent routing ...
0
votes
0answers
750 views

SQL Injection bypass UNION filter/restriciton

I've recently had an interesting interview exercise I haven't completed and it does puzzle me what kind of filter/protection they've used. The vuln app is a PHP with simple MariaDB (5.5.56) back-end, ...
-1
votes
1answer
82 views

mysql_query | Why " breaks query but ' does not?

I ran across an opportunity for SQL injection the other day in some legacy code ... // input: email@email.com" $email = $_POST['email']; mysql_query('SELECT * FROM users WHERE email = "'.$email.'" ');...
1
vote
1answer
107 views

Exploiting incorrectly escaped `mysql_query() or die(mysql_error())` to exfiltrate data?

I ran across some legacy code that uses mysql_query($sql) or die(mysql_error()) Was curious and noticed that with a correctly placed " in the email input ... I am shown output from mysql_error() as a ...
1
vote
4answers
388 views

Can application connect to database without exposing password to anyone?

I have a web application. The application needs to connect to the database to read/write information. The database can be accessed with username/password or certificate. Is it possible, somehow, to ...
0
votes
1answer
496 views

Hack a website using database username and password [closed]

Is it possible that someone could hack a website if they have the database name, database username, and database password? If so, how do they do it? The database connection is mysql.
3
votes
2answers
240 views

Mysql injection with a single `USE` statement

I know you need prepared statements and such to avoid SQL injection, and I've seen that there are different questions about exploits for SELECT, INSERT, UPDATE injectable queries. But I couldn't come ...
2
votes
1answer
286 views

Why exactly is this MySQL query vulnerable to SQL injections?

This is the query: $mysqli->query("UPDATE `users` SET `user_age` = '$my_age', `user_sex` = '$my_gender', `user_description` = '$my_description' , `user_sound` = $my_sound, `country` = '...
2
votes
2answers
91 views

How can I log access and usage of a MySQL database?

I am currently looking for an existing implementation method to generate logging of accesses and of usage of a series of MySQL databases by developers (not services) for further auditing. My current ...
11
votes
2answers
2k views

Understanding SQLMAP payload

I was participating in a CTF and there was a SQL Injection challenge. There is a Wordpress page with a vulnerable plugin parameter (let's call the website https://vulnerable.com/), and the solution ...
2
votes
1answer
103 views

Create a new database + user with php script — Secure

I have a web application that should manage a multi client solution. Due to the complexity of the solution, each client would require 4 database to store data. The portal itself is another database ...

1
2 3 4 5
10