Questions tagged [mysql]
MySQL is an open-source relational database management system.
517
questions
0
votes
0
answers
17
views
MySQLi On 3 Separate Queries At Once
I'm trying to check whether or not an injectable parameter I found is actually exploitable in a bug bounty contest my college is holding. The code base is open source so I have access to the exact SQL ...
- 1
0
votes
0
answers
37
views
What are password encryption schemes that result in variable length common in MySQL and PHP?
I have stumbled across passwords on a MySQL database behind a PHP webapp. Here are some examples.
753a524d56b48d825328ce27
789e0ad30d15
7ba0868c23e0a2
d327e265ca2abcd7c
48276b3d5618850
...
- 1
0
votes
0
answers
47
views
sql injection query error in bwapp?
I am getting this error in mysql Server version: 5.0.96-0ubuntu3 -
Error SQL query: Documentation
SELECT * FROM bWAPP.movies UNION ALL SELECT 1 , 2, 3, schema_name FROM information_schema.schemata, 6,...
- 1
0
votes
1
answer
82
views
Can my local MySQL server be accessed without permission
I have hosted a MySQL database server on a VPS to connect to a flask web app on the same VPS. It only has users with host as local ip address. Can it be accessed by anyone else remotely, except me? If ...
1
vote
2
answers
73
views
Valid SQL Injection Syntax where same vulnerable parameter used in both a SELECT and a UPDATE statement
I have a problem and I'm hoping someone could help with a POC.
In a web application, attacker controlled parameter X is used is used unsanitized in two separate SQL queries within the same function.
...
- 11
0
votes
0
answers
66
views
store strings in db with asymmetric encryption for a python app keeping the data secure
I'm designing an app that receives sensitive data input from a user and that data needs to be saved securely in a database.
As far as I understand it needs asymmetric encryption but since this app has ...
- 1
1
vote
1
answer
72
views
Need help deciphering these logs regarding YASSL attack on MySQL [closed]
I am getting the occasional message from our Fortigate Fortinet firewall, indicating that there is a yaSSL.Buffer.Overflow attack. The log from the Fortinet is:
Description: Subject: attack:MySQL....
- 111
0
votes
1
answer
87
views
Why can I not sql inject this piece of code? [duplicate]
This is the code:
$stmt = $db->prepare("SELECT DISTINCT * FROM kurssit WHERE BINARY id=? AND BINARY avain=?");
$stmt->bind_param("is", $kurssi, $avain);
// prepare and bind
$...
1
vote
4
answers
459
views
Is this a safe system to authenticate users by phone number?
I'm making a Actix-web/Rust web-application where users are solely allowed to register and login with their mobile phone number. The login-screen consists of one input asking for the phone number. If ...
- 2,770
0
votes
1
answer
59
views
mysql client app sends more ciphers than I specify via command line
There is a server app that supports TLSv1...TLSv1.3 with OpenSSL 3.
I'm connecting to it with mysql client app, version mysql Ver 15.1 Distrib 10.5.15-MariaDB, for debian-linux-gnu (x86_64) using ...
2
votes
1
answer
326
views
Is encryption with MySQL Aes_encrypt() + stored procedure ok?
I would like to do encryption with MySQL AES_ENCRYPT() function used in a stored procedure on the database.
Firstly, I changed the encryption block mode from aes-128-ecb to aes-256-cbc in the MySQL ...
1
vote
0
answers
233
views
MySQL encrypt fields and decrypt them with a password
I'm trying to figure out the best approach to store some information into a DB that will only be accessible by specific users through a password.
So let's say I've got user X that stores something ...
- 11
1
vote
1
answer
49
views
Changing openssl key/IV when encrypting diffrent rows of data in database?
I'm looking for a way to encrypt data in MySQL database securely. The data come from a web interface from a POST form and each POST request from the user insert a new line in the database.
Right now, ...
- 11
1
vote
0
answers
463
views
SQL injection into IN('[injection]') without parentheses or comma
I have the following injection:
DELETE FROM table WHERE id IN('[injection]');
And I can use these characters: !#$%&'*+/=?^_`{|}~.- . So I can exit the single-quoted string via ', but I can't exit ...
- 29.4k
0
votes
0
answers
82
views
SQL injection question
I'm doing blackbox testing on a website vulnerable to SQL injection.
I put a ' on the search bar, and for some reason it didn't show an error.
I put a ' on the search bar this time with a SQL ...
- 1
0
votes
0
answers
42
views
Find why mysqld is trying to reach a blacklisted IP
On a server of mine, its local ESET firewall is blocking MariaDB's mysql process from accessing a blacklisted IP 154.12.54.163:1277. MariaDB is installed and expected on the server.
I've also tried ...
1
vote
1
answer
89
views
The server acts as a database server , but there is no open port regarding that why?
I've taken a pen-testing course and for the final certificate, I have to analyze a server and make a report regarding the vulnerabilities.
The server does multiple functionalities, It acts as a web ...
- 31
0
votes
1
answer
566
views
Blind SQLi - guessing column name
I am learning Blind SQLi with Port Swigger Academy but I am stuck on this lab: https://portswigger.net/web-security/sql-injection/blind/lab-conditional-responses.
In this lab I have to get the user '...
0
votes
0
answers
1k
views
Best practices for storing passwords for PHP and MySQL applications [duplicate]
I am creating a simplified lead and call management system for a friend's small business.
I would like to know the best practices for hardening password storage and verification using PHP 7.4 and ...
0
votes
1
answer
121
views
Why are MySQL injections more limited than MS-SQL attacks?
I was watching the DEFCON 17: Advanced SQL Injection video here.
At 15:00, when discussing the various classes and types of SQL injection attackS, the speaker stated
With MySQL you really only have ...
- 181
1
vote
1
answer
3k
views
sqlmap is encountering 403 forbidden
I am trying to complete an SQL injection CTF here.
I confirmed just adding a single ' mark at the end of the URL caused a MySQL syntax error, and following this tutorial, I could complete this ...
- 181
1
vote
1
answer
341
views
SQL Injection "Error 1 - Operand should contain 1 column(s)"
I am injecting:
-35' and updatexml(null,concat(0x3a,(0x0a,(select database()))),null)-- -
and I am receiving:
Error 1 - Operand should contain 1 column(s)
Any idea how to fix this?
I am trying to ...
0
votes
1
answer
118
views
What is the wisdom of using the ASCII function in exploit SQLi?
I mean, I can exploit the vulnerability using a substring function and without using an ASCII function like:
SELECT username FROM users WHERE id = 1 AND (SELECT substring(password,1,1) FROM users ...
0
votes
0
answers
341
views
Storing encrypted data inside a JSON array in MySQL?
I have the following the situation: I have some data structures which look like this:
{
id: int
name: BLOB
password: VARCHAR(80)
...
}
There it is easy to store the encrypted fields ...
- 121
0
votes
0
answers
345
views
How to modify a database through SQL injection UNION?
I need help with an sqli exercise. I used sqlmap to find a UNION vulnerability.
I managed to get the H2 version with this payload:
string') UNION ALL SELECT NULL,H2VERSION(),NULL,NULL,NULL--
But I ...
- 11
1
vote
2
answers
85
views
Securely storing password and encryption key on AWS
I have an EC2 Webserver on AWS which has a MYSQL database. The login data is stored on AWS using the Secret Manager. I have added an IAM role for the Server to get access to the password and an ...
- 121
0
votes
2
answers
167
views
Should I update the way I handle authentication for my website?
For my website that is currently in development, I am trying to figure out a way to handle authentication. I am using mysql as my database and nodejs for my server. Currently, my website does the ...
- 123
0
votes
0
answers
204
views
SQL injection into LIMIT in MySQL 8
Given a query such as:
SELECT * FROM users limit 1,$limit
Is there a way to exploit this when using MySQL 8 and the standard PHP MySQL functions (ie no multi_query)?
What I have tried (unsuccessfully)...
- 29.4k
1
vote
2
answers
581
views
Is SQL Injection possible in ORDER BY before LIMIT?
I'm using MySQL with Mybatis library. And I found the code below:
SELECT *
FROM tableA
WHERE xxx
ORDER BY ${inputA} ${inputB}
LIMIT #{inputC}
I know there are many ways to inject the ORDER BY, but ...
- 11
0
votes
0
answers
683
views
Is my MySQL Server (run by php/apache) affected by the Log4j vulnerability?
From an article for the new Log4j vulnerability, it reads here:
A researcher working for Chinese tech firm Alibaba discovered the bug and privately informed the Apache Software Foundation, an all-...
- 269
1
vote
2
answers
389
views
Multiple user sessions at the same time in a backoffice
I am currently working on a project for a veterinary practice and one of its components is a web-based backoffice for general management.
The practice already has a backoffice-style software, but it's ...
user271185
0
votes
1
answer
429
views
Nmap returns both, mysql and mariadb versions, how do I khow which one is actually running?
I ran nmap scan and output included following line:
3306/tcp open mysql MySQL 5.5.5-10.3.25-MariaDB-0+deb10u1
How do I know which one is actually running, MySQL or MariaDB?
- 119
0
votes
2
answers
83
views
Is it possible to compromise a device by connecting to a database?
I have a relatively secure device with very limited internet connections and/or activity. One of those connections is to a AWS RDS database (MySQL)
I'm wondering if it's possible that my secure device ...
- 533
0
votes
0
answers
457
views
What's the alternative to storing plain-text passwords in a MySQL Database?
What's the alternative to storing plain-text passwords in a Database?
For example, I'm using Node.js to get a POST request for signing up / logging in a user from a webpage.
When signing up a user, I ...
- 269
18
votes
1
answer
3k
views
CRM with Client Side Encryption
The company I'm working in wants to develop a CRM that is cloud-based and we will need to store the data safely.
I've been searching for a way to create a strategy to save and secure data but I don't ...
- 291
1
vote
1
answer
512
views
Is MariaDB Server obsolete for PHP and Wordpress projects?
PHP (and by extension WordPress) only supports MySQL native & sha256 password authentication.
MariaDB Server only supports MySQL native & ed25519 password authentication.
Since MySQL native ...
0
votes
0
answers
209
views
manual SQL injection syntax error on MySQL
I am doing a SQL injection training with TryHackMe as shown below. https://tryhackme.com/room/ccpentesting task 18
I am trying to do it the manual way. From the guide online I know that to get the SQL ...
- 103
0
votes
3
answers
97
views
Is it secure to put a mysqldumped file online?
I made a database table of emoji country codes. I exported the data via mysqldump into a file called countries.sql.
I want to share it because it was a hassle finding anything like this, so I want to ...
1
vote
1
answer
244
views
Can I use my HTTP/SSL certificate for mysql?
I would like to know if I can use my SSL certificates that I use on my website (based on nodejs and express) for access to mysql database remotely, or if it is better to create new certificate.
My ...
1
vote
1
answer
3k
views
Sqlmap Sleepy User-Agent
I was testing Burp Suite Crawl on some old php sites I made and it found Sleepy User-Agent
SQL injection vulnerability
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, ...
- 11
0
votes
1
answer
379
views
public MySQL via XAMPP - security - whitelisting IP's versus VPN
I'm working on app that uses MySQL database on XAMPP Control Panel on Windows.
I am concerned about security part.
I received advice about connecting to MySQL through VPN so it won't be accessible so ...
0
votes
2
answers
130
views
How to connect to a MariaDB database after collecting data about users and passwords with a SQLI? [closed]
I'm trying to breach a dummy MariaDB database which is vulnerable to SQLI and is storing sensitive data about its users and their passwords. I've collected all the data I could collect, but now how am ...
0
votes
2
answers
1k
views
How to know whether mysql connection is using SSL or TLS connection?
I want to verify whether mysql remote connection is using tls/ssl connection for security purposes.
I ran status command to check initially:
mysql> status
--------------
mysql Ver 8.0.19 for osx10....
0
votes
0
answers
124
views
Is that SQL query exploitable for really malicious things
I have following SQL query in my WordPress plugin,
SELECT `ID`, `post_content`
FROM `wp_posts`
WHERE `post_type` = 'movie'
AND `post_status` = 'publish'
OR `post_status` = 'private'
AND `ID` NOT ...
- 1
2
votes
1
answer
284
views
one-way hash with PhP onto MySQL database (NOT for password)
My users (researchers) will be storing where their website is on a mysql database on my server.
Ideally I want to hash the locations so that when the researchers' participants submit their data to my ...
user171545
0
votes
1
answer
193
views
Using parametrized queries in PHP
I am currently developing a Slack app in PHP.
I'm trying to make the app as secure as possible, that's for sure.
So far, I have done the following:
Verified the requests using signing secrets
Making ...
0
votes
3
answers
269
views
Is my login script secure – how to improve it?
I have a login system for my website that works as follows:
In the database I have a table called users with the fields user, password and authentication_token.
user gets set manually by request in ...
- 101
0
votes
1
answer
783
views
SQLi Filter Bypass with banned table/column names
I've studying and practicing different approach to SQLi filter bypass and I faced a challenge. What if the WAF filters look for specific strings rather than SQL keywords?
Example:
Filter: /UNION/
SQLi:...
- 133
12
votes
1
answer
4k
views
How can I secure MySQL against bruteforce attacks?
I use Fail2ban on a busy Debian-based database server to secure ssh against brute force attacks, but for performance reasons, I don't want to log every connection from the application server (it would ...
- 277
0
votes
1
answer
181
views
Trying to do an SQL injection into a login field [closed]
I have an assignment to make an SQL injection - I found a login field that spits out an error, but I can't seem to make queries work inside of it. For your information it's an Mysql server. What is ...