Questions tagged [mysql]

MySQL is an open-source relational database management system.

Filter by
Sorted by
Tagged with
0 votes
0 answers
11 views

SQL Injection "Error 1 - Operand should contain 1 column(s)"

I am injecting: -35' and updatexml(null,concat(0x3a,(0x0a,(select database()))),null)-- - and I am receiving: Error 1 - Operand should contain 1 column(s) Any idea how to fix this? I am trying to ...
user avatar
0 votes
0 answers
13 views

Nessus Scan failed: 5.2 Ensure 'file_priv' Is Not Set to 'Y' for Non-Administrative Users

Taking a look at the failure Description: The File_priv privilege found in the mysql.user table is used to allow or disallow a user from reading and writing files on the server host. Any user with the ...
user avatar
0 votes
1 answer
25 views

What is the wisdom of using the ASCII function in exploit SQLi?

I mean, I can exploit the vulnerability using a substring function and without using an ASCII function like: SELECT username FROM users WHERE id = 1 AND (SELECT substring(password,1,1) FROM users ...
user avatar
0 votes
0 answers
62 views

Storing encrypted data inside a JSON array in MySQL?

I have the following the situation: I have some data structures which look like this: { id: int name: BLOB password: VARCHAR(80) ... } There it is easy to store the encrypted fields ...
user avatar
0 votes
0 answers
35 views

How to modify a database through SQL injection UNION?

I need help with an sqli exercise. I used sqlmap to find a UNION vulnerability. I managed to get the H2 version with this payload: string') UNION ALL SELECT NULL,H2VERSION(),NULL,NULL,NULL-- But I ...
user avatar
1 vote
2 answers
64 views

Securely storing password and encryption key on AWS

I have an EC2 Webserver on AWS which has a MYSQL database. The login data is stored on AWS using the Secret Manager. I have added an IAM role for the Server to get access to the password and an ...
user avatar
0 votes
2 answers
125 views

Should I update the way I handle authentication for my website?

For my website that is currently in development, I am trying to figure out a way to handle authentication. I am using mysql as my database and nodejs for my server. Currently, my website does the ...
user avatar
0 votes
0 answers
69 views

SQL injection into LIMIT in MySQL 8

Given a query such as: SELECT * FROM users limit 1,$limit Is there a way to exploit this when using MySQL 8 and the standard PHP MySQL functions (ie no multi_query)? What I have tried (unsuccessfully)...
user avatar
  • 29k
0 votes
2 answers
131 views

Is SQL Injection possible in ORDER BY before LIMIT?

I'm using MySQL with Mybatis library. And I found the code below: SELECT * FROM tableA WHERE xxx ORDER BY ${inputA} ${inputB} LIMIT #{inputC} I know there are many ways to inject the ORDER BY, but ...
user avatar
0 votes
0 answers
576 views

Is my MySQL Server (run by php/apache) affected by the Log4j vulnerability?

From an article for the new Log4j vulnerability, it reads here: A researcher working for Chinese tech firm Alibaba discovered the bug and privately informed the Apache Software Foundation, an all-...
user avatar
0 votes
0 answers
46 views

How to store and call MySQL's db credentials in production? Does it matter in my use case?

I have a system that uses MySQL's local connection for authenticating both me and clients. This system was actually an API system that acts as a database hosting. If I get the reasoning correct, each ...
user avatar
  • 1
0 votes
1 answer
71 views

Multiple user sessions at the same time in a backoffice

I am currently working on a project for a veterinary practice and one of its components is a web-based backoffice for general management. The practice already has a backoffice-style software, but it's ...
user avatar
  • 1
0 votes
1 answer
128 views

Nmap returns both, mysql and mariadb versions, how do I khow which one is actually running?

I ran nmap scan and output included following line: 3306/tcp open mysql MySQL 5.5.5-10.3.25-MariaDB-0+deb10u1 How do I know which one is actually running, MySQL or MariaDB?
user avatar
0 votes
2 answers
74 views

Is it possible to compromise a device by connecting to a database?

I have a relatively secure device with very limited internet connections and/or activity. One of those connections is to a AWS RDS database (MySQL) I'm wondering if it's possible that my secure device ...
user avatar
0 votes
0 answers
158 views

What's the alternative to storing plain-text passwords in a MySQL Database?

What's the alternative to storing plain-text passwords in a Database? For example, I'm using Node.js to get a POST request for signing up / logging in a user from a webpage. When signing up a user, I ...
user avatar
0 votes
0 answers
78 views

How could this SQL injection with a `SHOW` statement be exploited?

I have the following scenario: The mysql request looks like SHOW INDEX FROM `<table>` from `<database>` The <database> is a user input and is vulnerable to injection. For example I ...
user avatar
18 votes
1 answer
3k views

CRM with Client Side Encryption

The company I'm working in wants to develop a CRM that is cloud-based and we will need to store the data safely. I've been searching for a way to create a strategy to save and secure data but I don't ...
user avatar
1 vote
1 answer
194 views

Is MariaDB Server obsolete for PHP and Wordpress projects?

PHP (and by extension WordPress) only supports MySQL native & sha256 password authentication. MariaDB Server only supports MySQL native & ed25519 password authentication. Since MySQL native ...
user avatar
0 votes
0 answers
114 views

manual SQL injection syntax error on MySQL

I am doing a SQL injection training with TryHackMe as shown below. https://tryhackme.com/room/ccpentesting task 18 I am trying to do it the manual way. From the guide online I know that to get the SQL ...
user avatar
0 votes
0 answers
66 views

How MySQL keyring_aws plugin stores the master key securely?

From MySQL internal doc, I am presuming that keys of keyring_aws are stored locally after generation. All the mandatory information like master key needed to decrypt table is configured locally using ...
user avatar
0 votes
3 answers
91 views

Is it secure to put a mysqldumped file online?

I made a database table of emoji country codes. I exported the data via mysqldump into a file called countries.sql. I want to share it because it was a hassle finding anything like this, so I want to ...
user avatar
1 vote
1 answer
155 views

Can I use my HTTP/SSL certificate for mysql?

I would like to know if I can use my SSL certificates that I use on my website (based on nodejs and express) for access to mysql database remotely, or if it is better to create new certificate. My ...
user avatar
2 votes
1 answer
993 views

Sqlmap Sleepy User-Agent

I was testing Burp Suite Crawl on some old php sites I made and it found Sleepy User-Agent SQL injection vulnerability User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, ...
user avatar
  • 31
0 votes
1 answer
211 views

public MySQL via XAMPP - security - whitelisting IP's versus VPN

I'm working on app that uses MySQL database on XAMPP Control Panel on Windows. I am concerned about security part. I received advice about connecting to MySQL through VPN so it won't be accessible so ...
user avatar
0 votes
2 answers
105 views

How to connect to a MariaDB database after collecting data about users and passwords with a SQLI? [closed]

I'm trying to breach a dummy MariaDB database which is vulnerable to SQLI and is storing sensitive data about its users and their passwords. I've collected all the data I could collect, but now how am ...
user avatar
0 votes
2 answers
444 views

How to know whether mysql connection is using SSL or TLS connection?

I want to verify whether mysql remote connection is using tls/ssl connection for security purposes. I ran status command to check initially: mysql> status -------------- mysql Ver 8.0.19 for osx10....
user avatar
0 votes
0 answers
103 views

Is that SQL query exploitable for really malicious things

I have following SQL query in my WordPress plugin, SELECT `ID`, `post_content` FROM `wp_posts` WHERE `post_type` = 'movie' AND `post_status` = 'publish' OR `post_status` = 'private' AND `ID` NOT ...
user avatar
2 votes
1 answer
143 views

one-way hash with PhP onto MySQL database (NOT for password)

My users (researchers) will be storing where their website is on a mysql database on my server. Ideally I want to hash the locations so that when the researchers' participants submit their data to my ...
user avatar
  • 133
0 votes
1 answer
139 views

Using parametrized queries in PHP

I am currently developing a Slack app in PHP. I'm trying to make the app as secure as possible, that's for sure. So far, I have done the following: Verified the requests using signing secrets Making ...
user avatar
0 votes
3 answers
208 views

Is my login script secure – how to improve it?

I have a login system for my website that works as follows: In the database I have a table called users with the fields user, password and authentication_token. user gets set manually by request in ...
user avatar
  • 101
0 votes
1 answer
377 views

SQLi Filter Bypass with banned table/column names

I've studying and practicing different approach to SQLi filter bypass and I faced a challenge. What if the WAF filters look for specific strings rather than SQL keywords? Example: Filter: /UNION/ SQLi:...
user avatar
  • 133
12 votes
1 answer
4k views

How can I secure MySQL against bruteforce attacks?

I use Fail2ban on a busy Debian-based database server to secure ssh against brute force attacks, but for performance reasons, I don't want to log every connection from the application server (it would ...
user avatar
  • 277
0 votes
1 answer
133 views

Trying to do an SQL injection into a login field [closed]

I have an assignment to make an SQL injection - I found a login field that spits out an error, but I can't seem to make queries work inside of it. For your information it's an Mysql server. What is ...
user avatar
1 vote
1 answer
512 views

Blind SQL injection in sort direction

I have an SQL injection in a query where I control the sort direction parameter i.e: SELECT * from x where y=y ORDER BY COLUMN_NAME [SORT_DIRECTION] When I control the SORT_DIRECTION, which is ...
user avatar
0 votes
4 answers
245 views

Can here be SQL Injection

i got till moment when i do not know if it is secure! If SQL injection is inserted into myTableTwo via safe PDO query will it make my query below SQL injection open? Is the query below safe? $mysfield ...
user avatar
  • 103
0 votes
1 answer
627 views

Is it possible to locate web document root using SQL query/SQL Injection?

I have access to MySQL database which the current user has FILE privilege. I want to upload a web shell but I do not know the root directory of the web server. Is it possible to somehow locate the ...
user avatar
1 vote
1 answer
509 views

MySQL password rotation: Using a single user to change other user passwords

I'm currently working on setting up a password rotation strategy for an AWS Aurora/MySQL based application. My plan was to use a strategy like this... Application usernames/passwords stored in AWS ...
user avatar
0 votes
1 answer
801 views

SQLMap Only Returns information_schema

I run this command python sqlmap.py -u https://acme.com/post.php --data "id=1" --tamper="between,randomcase,space2comment" -v 3 --random-agent --dbs but SQLMap only returns ...
user avatar
0 votes
0 answers
574 views

Sqlmap not detects error based injection

I am working on Hack the VM (hard machine) for my OSCP preparation There is a web app with two drop down boxes.. Year and month.. both contain numbers and a submit to fetch data from DB based on year ...
user avatar
  • 43
2 votes
1 answer
3k views

ORDER BY sort direction is exploitable in SQL Injection?

I am testing an internal application and come across a page where if I am able to make the application display a SQL error because it does not recognize the payload for ORDER BY sort direction. The ...
user avatar
  • 1,297
-1 votes
1 answer
247 views

Stop UUID injection in MYSQL Database

I have a cordova app that logs users in based on their devices model+platform+uuid. For example: Pixel 2Android39798721218. The way this works when a user uses a new device is detailed in the ...
user avatar
0 votes
1 answer
197 views

Ways to detect CVE-2017-12419 intrusion

I have a free infinityfree.net web server that was vulnerable to CVE-2017-12419 for quite a big window of time. After fixing the gap and changing the passwords, what are some ways to detect if the ...
user avatar
  • 3,253
0 votes
1 answer
194 views

Having problems with SQL injection with mysqli extension PHP

I am new to SQL injections, and people on Reddit asked me do the portswigger labs. Which I did up till before 2nd order ones. So I am pretty comfortable with usual SQL injections. Now I have myself ...
user avatar
1 vote
0 answers
82 views

Two persons-rule on MySQL databases for "manual fixes"

In order to "harden" our compliance, we wanted to enforce a two-persons rule on the MySQL production database for "manual fixes". Such "manual fixes" frequently arise due to: Bug in the application (...
user avatar
0 votes
0 answers
871 views

Sqlmap waf bypass

This is my first post here, sorry for my english. Im making some test around, because i want to learn more about sql injection. Im not really good as manual sql injection, so im using sqlmap. what ...
user avatar
0 votes
1 answer
368 views

SQL injection and XSS prevention

I would kindly ask you to review the following code and tell me if it's enough to prevent most of SQL injection and XSS attacks. SQL injection: treated via PDO prepared statements; XSS: All user's ...
user avatar
1 vote
0 answers
139 views

Possibility of dynamically generated prepared statements and stored procedure SQL injection?

I am working on Java application which generate SQL prepared statements and stored procedure query strings using user inputs and executes with PreparedStatement.execute() or CallableStatement.execute()...
user avatar
0 votes
0 answers
215 views

Unable to exploit SQL injection in the parameter

During my testing I have found a vulnerable parameter in an API (/api/v1/documents/?direction=desc&limit=30&mode=reports**&page=1**) and its parameter is page=1 at the end. Upon giving the ...
user avatar
-1 votes
2 answers
468 views

How secure is a 24 character mysql password?

I recently set up my WordPress blog and I changed the password of its mysql database to a 24 character randomly generated password. I have a few questions about the database: Is my database name ...
user avatar
27 votes
12 answers
9k views

Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql real escape string() function

Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql_real_escape_string() function?
user avatar

1
2 3 4 5
10