Questions tagged [mysql]

MySQL is an open-source relational database management system.

Filter by
Sorted by
Tagged with
1
vote
0answers
31 views

SQL Injection bypass UNION filter/restriciton

I've recently had an interesting interview exercise I haven't completed and it does puzzle me what kind of filter/protection they've used. The vuln app is a PHP with simple MariaDB (5.5.56) back-end, ...
-1
votes
1answer
59 views

mysql_query | Why " breaks query but ' does not?

I ran across an opportunity for SQL injection the other day in some legacy code ... // input: email@email.com" $email = $_POST['email']; mysql_query('SELECT * FROM users WHERE email = "'.$email.'" ');...
-1
votes
0answers
43 views

Exploiting SQL-Injection Vulnerability in Oxid eShop CE 6.0.2 with SQLMAP [closed]

I installed Oxid eShop CE 6.0.2 on my local webserver to analyze the last SQL-injection vulnerability in this webapp. I found out that it is possible to inject SQL via the sorting parameter (GET). So ...
0
votes
1answer
50 views

Exploiting incorrectly escaped `mysql_query() or die(mysql_error())` to exfiltrate data?

I ran across some legacy code that uses mysql_query($sql) or die(mysql_error()) Was curious and noticed that with a correctly placed " in the email input ... I am shown output from mysql_error() as a ...
1
vote
4answers
100 views

Can application connect to database without exposing password to anyone?

I have a web application. The application needs to connect to the database to read/write information. The database can be accessed with username/password or certificate. Is it possible, somehow, to ...
0
votes
1answer
107 views

Hack a website using database username and password [closed]

Is it possible that someone could hack a website if they have the database name, database username, and database password? If so, how do they do it? The database connection is mysql.
3
votes
2answers
148 views

Mysql injection with a single `USE` statement

I know you need prepared statements and such to avoid SQL injection, and I've seen that there are different questions about exploits for SELECT, INSERT, UPDATE injectable queries. But I couldn't come ...
2
votes
1answer
260 views

Why exactly is this MySQL query vulnerable to SQL injections?

This is the query: $mysqli->query("UPDATE `users` SET `user_age` = '$my_age', `user_sex` = '$my_gender', `user_description` = '$my_description' , `user_sound` = $my_sound, `country` = '...
1
vote
0answers
36 views

How can I log access and usage of a MySQL database?

I am currently looking for an existing implementation method to generate logging of accesses and of usage of a series of MySQL databases by developers (not services) for further auditing. My current ...
10
votes
2answers
178 views

Understanding SQLMAP payload

I was participating in a CTF and there was a SQL Injection challenge. There is a Wordpress page with a vulnerable plugin parameter (let's call the website https://vulnerable.com/), and the solution ...
1
vote
1answer
72 views

Create a new database + user with php script — Secure

I have a web application that should manage a multi client solution. Due to the complexity of the solution, each client would require 4 database to store data. The portal itself is another database ...
-1
votes
1answer
180 views

SQLI Login Bypass Cheat-sheets Question [duplicate]

Assuming you are authorized to pentest a live website that's login page is vulnerable to SQL Injection. Lets say your backpack has only 2 crafted queries by you which is admin' -- and '=' 'OR'. Your ...
0
votes
0answers
133 views

'=' 'OR' SQL Injection Login Bypass Question [duplicate]

I was testing SQLI Cheatsheets on a vulnerable test site. This particular injection '=' 'OR' seems to work on the login page. Why does that injection work? What's the back-end SQL code, if I could ...
1
vote
1answer
116 views

Presistent XSS Filter Bypass Question

I was testing out a stored XSS on a test site I made which is vulnerable so the problem is when I tried executing the usual "><script>alert('XSS')</script> It did not work instead. But ...
2
votes
1answer
505 views

' OR 1=1/* SQL Injection Login Bypass Question

Recently I came across a SQL Injection Cheat Sheet which contains this particular cheat sheet which I am confused by ' or 1=1/* Assuming I am testing it on this server-side code below. SELECT * FROM ...
0
votes
1answer
188 views

SQL injection authentication bypass

I am testing a SQLi login bypass on the PHP code below: if(isset($_POST["login"]) && isset($_POST["password"])) { $sql="select * from users where login='{$_POST["login"]}' and password='{$...
0
votes
1answer
68 views

What MySQL information should be kept secret?

I'm writing an open-source program interfacing with a protected MySQL server. I'd like to keep the development environment as close to the production environment as possible. Variables that must be ...
1
vote
1answer
64 views

Security risks of Read-only MySQL Database access behind firewall

Are there any obvious security risks to providing a none IT Staff member read-only Database access (through MySQL Workbench) to a Wordpress Database, if this is behind a firewall/VPN?
0
votes
0answers
17 views

Connect to amazon rds SQL server through spoofed ip address [duplicate]

I'm using amazon MySQL server and grant only my server IP to connect to the database, the question is can someone else access to the database through spoofed IP address and MySQL server credentials?
1
vote
2answers
392 views

Best way to know the algorithm used for a password encryption

I have the following password captured using sqlmap- $2a$08$9eaKUtKdFV8fuOAx0sfr4emrG1aHzGeNsn/rVdW243nw6Ktt.Uc0O Now, I don't know how to decrypt this password because I don't know which ...
1
vote
1answer
242 views

SQL Injection after Like Operator with continuing query

is it possible to add a new query like update in between this?: SELECT characters.id as charId FROM characters WHERE characters.name LIKE '%<User-Input-Here>%' ORDER BY `level` DESC, exp DESC ...
2
votes
1answer
114 views

How safe is it to open source access to MySQL database on github, only permitting SELECT query?

The Setup: Im building an app to model visually world data. A significant part of this project will be the database since that data is what is interesting. I should only need to allow SELECT queries,...
0
votes
1answer
416 views

SQL injection using union statement

I have a table with lots of user info - email, password and others. The server performs this query without using prepared statements: SELECT * FROM login where email = '$_POST'; I want to do an SQL ...
1
vote
3answers
171 views

Should I send the user ID of the user trying to authenticate in a HTTP header when using access token?

Im building a REST api for an ios application! Would it be a good idea to send the user id (primary autoincrementing token in my mySQL database) of an account when authenticating with user token? (...
0
votes
1answer
104 views

In a SQL server, passwords are hashed in chinese. What algorithm it might be using?

While performing the following query, passwords are displayed in Chinese. I'm wondering what hashing algorithm is being used here in order for me to carry out a brute-force attack.
0
votes
2answers
840 views

Getting the column names of a table by brute force blind SQL injection

Is there a way of getting the column names of a table by brute force blind SQL injection in MySQL. so the query would be: select column_name from information_schema.columns WHERE table_name = ‘...
0
votes
1answer
2k views

tamper scripts for bypassing waf sqlmap

I have tried the following tamper scripts in sqlmap but the connection is still getting dropped by the WAF: tamper=apostrophemask,apostrophenullencode,appendnullbyte,base64encode,between,bluecoat,...
0
votes
0answers
37 views

SQL Injection ORDER By not working MySQL Error Based [duplicate]

I've been learning different attack vectors using applications such as bWapp and others to further my practice and knowledge of cybersecurity. I've stumbled across a problem in one of them. If Order ...
0
votes
0answers
54 views

How to make --os-shell command work on UBUNTU 16.04 ( Digital Ocean )?

I have made a vulnerable SQLi website ( to teach students ). I am able to dump the database but I am not able to run os commands or upload os-shell. I want to show them how to use --os-shell option ...
4
votes
1answer
453 views

Is forbiding the ; char enough to prevent SQL injection?

Disclaimer: Parameterized queries are the way to go, no need to discuss about that :) I've seen the following code at a friends place: var query = "SELECT * FROM students WHERE name = " + name; ...
0
votes
1answer
78 views

MySQL vulnerability bind address 127.0.0.1

Am I safe from MySQL access from another host even if they know the credential of my database, including the port? As far as I know the bing port doesn't allow any remote access. Correct me if I'm ...
2
votes
2answers
152 views

Can hacker delete my server files and database where I am using below function?

I want to know how to protect my website from hackers. I am a php-mysql developer. For fetching data from databases I always use MySQLi. For preventing my website from SQL injection, I always use PHP'...
15
votes
5answers
6k views

Can I recover a lost AES key?

I had encrypted 2 MySQL databases with AES_ENCRYPT in ECB 128 bit mode. Now I forgot my encryption key, but I have plain text (I have one database without encryption and same with encryption). How to ...
27
votes
1answer
7k views

Why should we sometimes use --+ instead of — in SQL injection to comment the rest of the query?

I have encountered some websites that when I used -- to comment the rest of the query it didn't work, but when I tried --+ it worked. In the MySQL official documentation there is no such thing as --+ ...
0
votes
2answers
293 views

Blind SQL Injection on Amazon RDS

I found a vulnerability which allows me to run any query on an Amazon RDS server. I was able to extract the user hashes by using the --passwords parameter of sqlmap, and one of the hashes was cracked ...
1
vote
1answer
156 views

Is it safe to concatenate non-input session variables into a SQL string?

I have a php application where the function "makeSessionVar" creates a session variable from application defined data, then concatenates it into the SQL string. function makeSessionVar($A,$B){ // (&...
1
vote
1answer
207 views

Is using JSON a secure way of handling sql queries in python?

The question I will try to articulate this as clearly and best I can: Suppose that I have a python program which connects to a database on a server. Next I ask you to consider that this python ...
1
vote
1answer
80 views

Why are SQL servers not attacked as frequently as ssh servers?

I have a server running with both SSH and MySQL accessible to the public internet. Both run on default ports (22 and 3306). The ssh server is attacked by bots all the time. This is the output of ...
2
votes
0answers
48 views

Why is MySQL 8.0 AES_ENCODE unsafe for statement-based replication?

I read this interesting note in the MySQL 8.0 documentation that seemed a bit confusing to me: Statements that use AES_ENCRYPT() or AES_DECRYPT() are unsafe for statement-based replication. As I ...
21
votes
5answers
3k views

Is password information dumped from the MySQL user table sensitive?

Assume I have dumped MySQL user list using SELECT user, host, password, ssl_type FROM mysql.user; The result looks like this: +------------------+-----------+----------------------------------------...
1
vote
1answer
351 views

How this Unique SQL injection works?

I found a challenge which was vulnerable to SQL injection and it was very very pretty hard to find So, How this unique SQL works? I found this on login form where when I send user=\&pass=||1# as ...
-1
votes
1answer
446 views

Using SQL to compare hashed passwords

Setup A LAMP system (Linux, Apache, MySQL, PHP). Access to db is over the loopback interface (maybe not in the future - dependent on hosting solution). The db contains a table with the username, ...
0
votes
1answer
182 views

Is it SQL Injection Vuln? [closed]

Today my friend asking help to test and prevent his website from sql injection.. After i tried basic sql injection like 1 OR 1=1, ' OR 1--',' '1'='1 There is no mysql error displayed.. But After i ...
0
votes
2answers
261 views

Protect MySQL against brute-force attacks on dedicated CentOS 7 server

I have a database in a dedicated server (CentOS 7) setup by an external provider. I see a disgusting amount of brute-force attempts in MySQL log file every day. I know the best option would be to not ...
1
vote
2answers
48 views

Is there a point to set up passwords for services like MySQL, Redis etc. if we disable their related ports?

Redis' default port is 6379 and MySQL's default port is 3306. Let's say we disable these ports to outside of the world with ufw. And let's say only I have access to the servers. Is there still a point ...
6
votes
2answers
575 views

How dangerous is disclosing a table's structure to users?

I apologize if this is a dumb question. I recently came across a website that embedded its error log out in a JSON response if the request to the website failed. In this case, it appeared there was a ...
0
votes
1answer
64 views

Possibility of SQL injection by static or predefined values

Using direct variables is vulnerable to sql injection. So to prevent attacks we use parameters. $result->bindParam(":id",$_POST['id'],PDO::PARAM_INT) but I am confused regarding the following ...
1
vote
2answers
3k views

MySQL AES_ENCRYPT string key length

In MySQL there are builtin AES_ENCRYPT() and AES_DECRYPT() functions which take the form of: AES_ENCRYPT(str, key_str) What length is required for the key_str argument? Can it be variable? What is ...
0
votes
4answers
169 views

Is it possible to verify if a website is vulnerable to SQLi by viewing its source code?

I've heard the eval() function is vulnerable to SQLi. Can I check for vulnerabilities by simply viewing the website source code?
1
vote
1answer
69 views

Is the hosting OS safe to sql injection hackers by hiding admin ID?

We are 1-3 guys maintaining a fairly large but clumsy developed-in-house website. With around 900+ mysql tables, and a lot of data access code in PHP. Let's say it is huge amount of code for just 1 or ...