Questions tagged [mysql]

MySQL is an open-source relational database management system.

Filter by
Sorted by
Tagged with
0
votes
0answers
23 views

How MySQL keyring_aws plugin stores the master key securely?

From MySQL internal doc, I am presuming that keys of keyring_aws are stored locally after generation. All the mandatory information like master key needed to decrypt table is configured locally using ...
0
votes
0answers
5 views

Running mysqld with root privilege [migrated]

As we know running mysql with root privilege is not recommended which leads to privilege escalation using UDF's. I'm trying to setup a machine to demonstrate this and I wanted to run mysqld as root ...
0
votes
3answers
55 views

Is it secure to put a mysqldumped file online?

I made a database table of emoji country codes. I exported the data via mysqldump into a file called countries.sql. I want to share it because it was a hassle finding anything like this, so I want to ...
1
vote
1answer
59 views

Can I use my HTTP/SSL certificate for mysql?

I would like to know if I can use my SSL certificates that I use on my website (based on nodejs and express) for access to mysql database remotely, or if it is better to create new certificate. My ...
1
vote
1answer
178 views

Sqlmap Sleepy User-Agent

I was testing Burp Suite Crawl on some old php sites I made and it found Sleepy User-Agent SQL injection vulnerability User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, ...
0
votes
1answer
66 views

public MySQL via XAMPP - security - whitelisting IP's versus VPN

I'm working on app that uses MySQL database on XAMPP Control Panel on Windows. I am concerned about security part. I received advice about connecting to MySQL through VPN so it won't be accessible so ...
0
votes
2answers
56 views

How to connect to a MariaDB database after collecting data about users and passwords with a SQLI? [closed]

I'm trying to breach a dummy MariaDB database which is vulnerable to SQLI and is storing sensitive data about its users and their passwords. I've collected all the data I could collect, but now how am ...
0
votes
1answer
146 views

How to know whether mysql connection is using SSL or TLS connection?

I want to verify whether mysql remote connection is using tls/ssl connection for security purposes. I ran status command to check initially: mysql> status -------------- mysql Ver 8.0.19 for osx10....
0
votes
0answers
63 views

Is that SQL query exploitable for really malicious things

I have following SQL query in my WordPress plugin, SELECT `ID`, `post_content` FROM `wp_posts` WHERE `post_type` = 'movie' AND `post_status` = 'publish' OR `post_status` = 'private' AND `ID` NOT ...
2
votes
1answer
69 views

one-way hash with PhP onto MySQL database (NOT for password)

My users (researchers) will be storing where their website is on a mysql database on my server. Ideally I want to hash the locations so that when the researchers' participants submit their data to my ...
0
votes
1answer
71 views

Using parametrized queries in PHP

I am currently developing a Slack app in PHP. I'm trying to make the app as secure as possible, that's for sure. So far, I have done the following: Verified the requests using signing secrets Making ...
0
votes
3answers
157 views

Is my login script secure – how to improve it?

I have a login system for my website that works as follows: In the database I have a table called users with the fields user, password and authentication_token. user gets set manually by request in ...
0
votes
1answer
101 views

SQLi Filter Bypass with banned table/column names

I've studying and practicing different approach to SQLi filter bypass and I faced a challenge. What if the WAF filters look for specific strings rather than SQL keywords? Example: Filter: /UNION/ SQLi:...
12
votes
1answer
4k views

How can I secure MySQL against bruteforce attacks?

I use Fail2ban on a busy Debian-based database server to secure ssh against brute force attacks, but for performance reasons, I don't want to log every connection from the application server (it would ...
0
votes
0answers
49 views

Mysql SSL Type property for mysql.user

In Mysql database, I have a user for which in mysql.user table I have ssl_type set as X509 and there is no password. Is this a security risk? According to https://www2.navicat.com/manual/online_manual/...
0
votes
0answers
104 views

How do I connect using ssh tunnel to heroku's cleardb mysql database from some gui tools like mysql workbench or beekeeper studio, when run on ubuntu

Im currently trying to connect to the Heroku's mysql cleardb database from beekeeper studio. My connection works when done normally. But when I use the ssh tunnel Im facing some issue. Their ...
0
votes
1answer
68 views

Trying to do an SQL injection into a login field [closed]

I have an assignment to make an SQL injection - I found a login field that spits out an error, but I can't seem to make queries work inside of it. For your information it's an Mysql server. What is ...
0
votes
0answers
116 views

Execute sqlmap in a javaScript object cookie

I am studying sqli and I found a blind sqli vulnerability in a cookie and I have exploited manually, however, I would like to detect and exploit it with sqlmap. Cookie looks like javascript object ...
1
vote
1answer
259 views

Blind SQL injection in sort direction

I have an SQL injection in a query where I control the sort direction parameter i.e: SELECT * from x where y=y ORDER BY COLUMN_NAME [SORT_DIRECTION] When I control the SORT_DIRECTION, which is ...
0
votes
4answers
203 views

Can here be SQL Injection

i got till moment when i do not know if it is secure! If SQL injection is inserted into myTableTwo via safe PDO query will it make my query below SQL injection open? Is the query below safe? $mysfield ...
0
votes
1answer
288 views

Is it possible to locate web document root using SQL query/SQL Injection?

I have access to MySQL database which the current user has FILE privilege. I want to upload a web shell but I do not know the root directory of the web server. Is it possible to somehow locate the ...
1
vote
1answer
246 views

MySQL password rotation: Using a single user to change other user passwords

I'm currently working on setting up a password rotation strategy for an AWS Aurora/MySQL based application. My plan was to use a strategy like this... Application usernames/passwords stored in AWS ...
0
votes
1answer
322 views

SQLMap Only Returns information_schema

I run this command python sqlmap.py -u https://acme.com/post.php --data "id=1" --tamper="between,randomcase,space2comment" -v 3 --random-agent --dbs but SQLMap only returns ...
0
votes
0answers
404 views

Sqlmap not detects error based injection

I am working on Hack the VM (hard machine) for my OSCP preparation There is a web app with two drop down boxes.. Year and month.. both contain numbers and a submit to fetch data from DB based on year ...
2
votes
1answer
1k views

ORDER BY sort direction is exploitable in SQL Injection?

I am testing an internal application and come across a page where if I am able to make the application display a SQL error because it does not recognize the payload for ORDER BY sort direction. The ...
-1
votes
1answer
94 views

Stop UUID injection in MYSQL Database

I have a cordova app that logs users in based on their devices model+platform+uuid. For example: Pixel 2Android39798721218. The way this works when a user uses a new device is detailed in the ...
0
votes
1answer
122 views

Ways to detect CVE-2017-12419 intrusion

I have a free infinityfree.net web server that was vulnerable to CVE-2017-12419 for quite a big window of time. After fixing the gap and changing the passwords, what are some ways to detect if the ...
0
votes
1answer
124 views

Having problems with SQL injection with mysqli extension PHP

I am new to SQL injections, and people on Reddit asked me do the portswigger labs. Which I did up till before 2nd order ones. So I am pretty comfortable with usual SQL injections. Now I have myself ...
1
vote
0answers
42 views

Two persons-rule on MySQL databases for “manual fixes”

In order to "harden" our compliance, we wanted to enforce a two-persons rule on the MySQL production database for "manual fixes". Such "manual fixes" frequently arise due to: Bug in the application (...
0
votes
0answers
576 views

Sqlmap waf bypass

This is my first post here, sorry for my english. Im making some test around, because i want to learn more about sql injection. Im not really good as manual sql injection, so im using sqlmap. what ...
0
votes
1answer
248 views

SQL injection and XSS prevention

I would kindly ask you to review the following code and tell me if it's enough to prevent most of SQL injection and XSS attacks. SQL injection: treated via PDO prepared statements; XSS: All user's ...
1
vote
0answers
70 views

Possibility of dynamically generated prepared statements and stored procedure SQL injection?

I am working on Java application which generate SQL prepared statements and stored procedure query strings using user inputs and executes with PreparedStatement.execute() or CallableStatement.execute()...
0
votes
0answers
76 views

Unable to exploit SQL injection in the parameter

During my testing I have found a vulnerable parameter in an API (/api/v1/documents/?direction=desc&limit=30&mode=reports**&page=1**) and its parameter is page=1 at the end. Upon giving the ...
-1
votes
2answers
356 views

How secure is a 24 character mysql password?

I recently set up my WordPress blog and I changed the password of its mysql database to a 24 character randomly generated password. I have a few questions about the database: Is my database name ...
27
votes
12answers
8k views

Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql real escape string() function

Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql_real_escape_string() function?
138
votes
24answers
22k views

Why can't I just let customers connect directly to my database?

I'm pretty sure this is a stupid idea but I'd like to know why, so bear with me for a moment. Lots of the work backend developers do is providing CRUD access to customers via HTTP, essentially mapping ...
1
vote
1answer
321 views

SQL injection with no output

So I found this section of a webpage, which is a basic "feedback box". It had all the characteristics of an SQL injectable element. Scanned it with OWASP, it was true. Tried SQLmap, it gave me ...
3
votes
1answer
85 views

Sql map Manual Vulnerability Assessment

I am trying to do penetration testing for one of my client. The platform is Code ignitor. There is an endpoint /find/1 The function queries the vehicle table where vehicle ID is 1 with no sanity check....
0
votes
1answer
88 views

A New Blog Post is showing on top of my home page from Unknown user cyberanon - How to Remove the post? [closed]

I have just launched our brand new blog website (php/mysql). I don't have any idea about cyber security. Yesterday we published a topic on coronavirus vaccine. I just noticed a new post is sitting on ...
4
votes
0answers
181 views

Whats the meaning of ] symbol in a SQL query?

I have come across a CTF challenge that has a part with an SQL injection (MySQL DB). I have completed it, but I do not know why or how the injection works. The query in the PHP application would ...
0
votes
1answer
92 views

If I seperate VPS into WebApp/MySQL VPS & separating WebApp projects into Admin/User projects. Is It more secure?

If I want to deploy Laravel WebApp using MySQL DB on VPS like DigitalOcean, Vultr or similar platforms, should I separate VPS into WebApp VPS & MySQL VPS? Is it more secure? And what if I ...
1
vote
0answers
370 views

SQLMAP with single URL application

I have a local application which will be accessible only after login. Its single URL application, URL of application won't change, just it use 'XMLHttpRequest' to refresh the content of screen based ...
1
vote
1answer
254 views

It this a safe way to filter input into an SQL query

Is this a safe way to filter strings into an SQL query in java or could this be bypassed? I understand that I should just parameterize everything but this is an ancient code base where it makes more ...
0
votes
0answers
599 views

Is this SQLMap query is correct?

I am practicing on some vulnerable application, and I am asked to find an injection vulnerability with a payload. it states there is a common and simple filter in place. Then I need to extract the ...
2
votes
1answer
58 views

Is there a way to access the local DB from external webapp?

I found a Django app running on http://test.com that is running on debug mode. After trying some wrong paths I got with the django error screen showing the stacktrace and the credentials used to ...
3
votes
1answer
607 views

Is SQL Injection possible in this case (REGEXP)?

I'm on a website which have a program, there is a search input for keywords. When I input & or < or > and search, it returns Got error 'empty (sub)expression' from regexp error and when I ...
1
vote
1answer
122 views

Risk of getting MySQL database compromised with a client application

I want to make a client-side, Windows-based application that allows the user to register and it will store the registration details in an online MySQL server. However when i googled ways to do this, ...
0
votes
1answer
124 views

How can this sql query be injected?

I've a php code where I get the page number from a GET request and then run a sql query to select records from the database by the page number $maxPerPage = 20; $page = $_GET["p"]; $applicants = DB:...
2
votes
1answer
2k views

Server returns 403 when I try SQL injection

I am trying to pentest my friend's site. It is clearly vulnerable to SQL injection attack based on the error messages I get from entering different get parameters. Whenever I try very simple attacks ...
0
votes
2answers
6k views

How do you perform SQL injection on a login form that checks for email address format?

A recent employment test prompted me to perform an SQL injection to gain access into their website. Using manual and automated (Burp) methods, I was able to find out the form is definitely vulnerable ...

1
2 3 4 5
10