Questions tagged [mysql]

MySQL is an open-source relational database management system.

Filter by
Sorted by
Tagged with
1
vote
2answers
65 views

Risk of getting MySQL database compromised with a client application

I want to make a client-side, Windows-based application that allows the user to register and it will store the registration details in an online MySQL server. However when i googled ways to do this, ...
0
votes
1answer
97 views

How can this sql query be injected?

I've a php code where I get the page number from a GET request and then run a sql query to select records from the database by the page number $maxPerPage = 20; $page = $_GET["p"]; $applicants = DB:...
2
votes
1answer
147 views

Server returns 403 when I try SQL injection

I am trying to pentest my friend's site. It is clearly vulnerable to SQL injection attack based on the error messages I get from entering different get parameters. Whenever I try very simple attacks ...
0
votes
2answers
207 views

How do you perform SQL injection on a login form that checks for email address format?

A recent employment test prompted me to perform an SQL injection to gain access into their website. Using manual and automated (Burp) methods, I was able to find out the form is definitely vulnerable ...
0
votes
0answers
38 views

user_roles getting deleted from wp_options table in wordpress

I would like some advice on how to troubleshoot a problem on Wordpress/Apache/PHP/MySQL I am looking at the following: select * from wp_options opt where option_name like '%wp_user_roles%' order by ...
1
vote
1answer
101 views

Is it safe to leave MySQL root user without a password if it uses auth_socket?

Since MySQL 5.7, the root user is configured to use the auth_socket authentication plugin instead of a password. Is it safe to leave the root user that way (without a password)?
2
votes
2answers
126 views

How does this SQLi statement work?

Hey i'm trying the hacker101 CTF's im still pretty new at this stuff The CTF answer to the flag i'm trying to understand is https://github.com/testerting/hacker101-ctf/tree/master/micro-cms_v2/flag0 ...
0
votes
1answer
130 views

Sql Injection ByPass problem [closed]

I don't know what if part of this command does. FROM table WHERE id = 1 AND IF(( Ascii(Lower(Substring((SELECT User()), $i, 1))) ) != $s, 1, Benchmark(200000, Md5(Now()))) ...
0
votes
1answer
51 views

what can you do in sql login details and encryption key is available

I am practicing pen testing in a protected box and I have a vulnerable Magento website and I managed to get its MySQL config file which is app/etc/local.xml. In this file there is information such as:...
2
votes
1answer
62 views

How does MariaDB's ed25519 auth scheme work?

Newer versions of MariaDB (a MySQL database server fork) have a new password based auth scheme called "ed25519". The docs are very sparse regarding how it works and what it does. https://mariadb.com/...
0
votes
0answers
39 views

Is whitelisting Google Apps Scripts Actually safe?

Google offers a way to connect it's apps (like google sheets) to a sql server. In order to do this, you need to whitelist their google apps scripts IPv4 subnets. I don't see how this could be secure ...
0
votes
1answer
80 views

MySQL brute force attempts from localhost

We have a Linux box (Ubuntu VERSION="18.04.2 LTS (Bionic Beaver)" that hosts MySQL. When I check the MySQL logs I see constant failed attempts to log in from root@localhost. does this imply that I ...
1
vote
1answer
203 views

Is sql injection possible on this websocket?

I was testing a websocket when i found an add to cart request like the following ["{\"ITEMS\":{\"ITEM\":[{\"package_id\":\"123\",\"customer_type\":\"3\",\"qty\":1,\"}"] I tried to edit the value of ...
1
vote
1answer
51 views

Does MySQL Router offer any protection of MySQL-DBs behind it?

I recently stumbled upon MySQL Router. Its documentation defines it's purpose as follows: MySQL Router is part of InnoDB cluster, and is lightweight middleware that provides transparent routing ...
0
votes
0answers
112 views

SQL Injection bypass UNION filter/restriciton

I've recently had an interesting interview exercise I haven't completed and it does puzzle me what kind of filter/protection they've used. The vuln app is a PHP with simple MariaDB (5.5.56) back-end, ...
-1
votes
1answer
72 views

mysql_query | Why " breaks query but ' does not?

I ran across an opportunity for SQL injection the other day in some legacy code ... // input: email@email.com" $email = $_POST['email']; mysql_query('SELECT * FROM users WHERE email = "'.$email.'" ');...
1
vote
1answer
68 views

Exploiting incorrectly escaped `mysql_query() or die(mysql_error())` to exfiltrate data?

I ran across some legacy code that uses mysql_query($sql) or die(mysql_error()) Was curious and noticed that with a correctly placed " in the email input ... I am shown output from mysql_error() as a ...
1
vote
4answers
120 views

Can application connect to database without exposing password to anyone?

I have a web application. The application needs to connect to the database to read/write information. The database can be accessed with username/password or certificate. Is it possible, somehow, to ...
0
votes
1answer
237 views

Hack a website using database username and password [closed]

Is it possible that someone could hack a website if they have the database name, database username, and database password? If so, how do they do it? The database connection is mysql.
3
votes
2answers
184 views

Mysql injection with a single `USE` statement

I know you need prepared statements and such to avoid SQL injection, and I've seen that there are different questions about exploits for SELECT, INSERT, UPDATE injectable queries. But I couldn't come ...
2
votes
1answer
269 views

Why exactly is this MySQL query vulnerable to SQL injections?

This is the query: $mysqli->query("UPDATE `users` SET `user_age` = '$my_age', `user_sex` = '$my_gender', `user_description` = '$my_description' , `user_sound` = $my_sound, `country` = '...
2
votes
1answer
47 views

How can I log access and usage of a MySQL database?

I am currently looking for an existing implementation method to generate logging of accesses and of usage of a series of MySQL databases by developers (not services) for further auditing. My current ...
11
votes
2answers
552 views

Understanding SQLMAP payload

I was participating in a CTF and there was a SQL Injection challenge. There is a Wordpress page with a vulnerable plugin parameter (let's call the website https://vulnerable.com/), and the solution ...
1
vote
1answer
74 views

Create a new database + user with php script — Secure

I have a web application that should manage a multi client solution. Due to the complexity of the solution, each client would require 4 database to store data. The portal itself is another database ...
-1
votes
1answer
549 views

SQLI Login Bypass Cheat-sheets Question [duplicate]

Assuming you are authorized to pentest a live website that's login page is vulnerable to SQL Injection. Lets say your backpack has only 2 crafted queries by you which is admin' -- and '=' 'OR'. Your ...
0
votes
0answers
136 views

'=' 'OR' SQL Injection Login Bypass Question [duplicate]

I was testing SQLI Cheatsheets on a vulnerable test site. This particular injection '=' 'OR' seems to work on the login page. Why does that injection work? What's the back-end SQL code, if I could ...
1
vote
1answer
125 views

Presistent XSS Filter Bypass Question

I was testing out a stored XSS on a test site I made which is vulnerable so the problem is when I tried executing the usual "><script>alert('XSS')</script> It did not work instead. But ...
2
votes
1answer
2k views

' OR 1=1/* SQL Injection Login Bypass Question

Recently I came across a SQL Injection Cheat Sheet which contains this particular cheat sheet which I am confused by ' or 1=1/* Assuming I am testing it on this server-side code below. SELECT * FROM ...
0
votes
1answer
215 views

SQL injection authentication bypass

I am testing a SQLi login bypass on the PHP code below: if(isset($_POST["login"]) && isset($_POST["password"])) { $sql="select * from users where login='{$_POST["login"]}' and password='{$...
0
votes
2answers
80 views

Does choice of DBMS matter for protection against XSS and other injection attacks?

I am choosing between the three most used databases, MySQL, Microsoft SQL Server and MongoDB. I have to choose the most secure database from these three. Does my choice of DBMS has a role in ...
0
votes
1answer
69 views

What MySQL information should be kept secret?

I'm writing an open-source program interfacing with a protected MySQL server. I'd like to keep the development environment as close to the production environment as possible. Variables that must be ...
1
vote
1answer
69 views

Security risks of Read-only MySQL Database access behind firewall

Are there any obvious security risks to providing a none IT Staff member read-only Database access (through MySQL Workbench) to a Wordpress Database, if this is behind a firewall/VPN?
0
votes
0answers
18 views

Connect to amazon rds SQL server through spoofed ip address [duplicate]

I'm using amazon MySQL server and grant only my server IP to connect to the database, the question is can someone else access to the database through spoofed IP address and MySQL server credentials?
1
vote
2answers
624 views

Best way to know the algorithm used for a password encryption

I have the following password captured using sqlmap- $2a$08$9eaKUtKdFV8fuOAx0sfr4emrG1aHzGeNsn/rVdW243nw6Ktt.Uc0O Now, I don't know how to decrypt this password because I don't know which ...
1
vote
1answer
331 views

SQL Injection after Like Operator with continuing query

is it possible to add a new query like update in between this?: SELECT characters.id as charId FROM characters WHERE characters.name LIKE '%<User-Input-Here>%' ORDER BY `level` DESC, exp DESC ...
2
votes
1answer
116 views

How safe is it to open source access to MySQL database on github, only permitting SELECT query?

The Setup: Im building an app to model visually world data. A significant part of this project will be the database since that data is what is interesting. I should only need to allow SELECT queries,...
0
votes
1answer
581 views

SQL injection using union statement

I have a table with lots of user info - email, password and others. The server performs this query without using prepared statements: SELECT * FROM login where email = '$_POST'; I want to do an SQL ...
1
vote
4answers
439 views

Should I send the user ID of the user trying to authenticate in a HTTP header when using access token?

Im building a REST api for an ios application! Would it be a good idea to send the user id (primary autoincrementing token in my mySQL database) of an account when authenticating with user token? (...
0
votes
1answer
107 views

In a SQL server, passwords are hashed in chinese. What algorithm it might be using?

While performing the following query, passwords are displayed in Chinese. I'm wondering what hashing algorithm is being used here in order for me to carry out a brute-force attack.
0
votes
2answers
2k views

Getting the column names of a table by brute force blind SQL injection

Is there a way of getting the column names of a table by brute force blind SQL injection in MySQL. so the query would be: select column_name from information_schema.columns WHERE table_name = ‘...
0
votes
1answer
4k views

tamper scripts for bypassing waf sqlmap

I have tried the following tamper scripts in sqlmap but the connection is still getting dropped by the WAF: tamper=apostrophemask,apostrophenullencode,appendnullbyte,base64encode,between,bluecoat,...
0
votes
0answers
41 views

SQL Injection ORDER By not working MySQL Error Based [duplicate]

I've been learning different attack vectors using applications such as bWapp and others to further my practice and knowledge of cybersecurity. I've stumbled across a problem in one of them. If Order ...
0
votes
0answers
105 views

How to make --os-shell command work on UBUNTU 16.04 ( Digital Ocean )?

I have made a vulnerable SQLi website ( to teach students ). I am able to dump the database but I am not able to run os commands or upload os-shell. I want to show them how to use --os-shell option ...
4
votes
1answer
453 views

Is forbiding the ; char enough to prevent SQL injection?

Disclaimer: Parameterized queries are the way to go, no need to discuss about that :) I've seen the following code at a friends place: var query = "SELECT * FROM students WHERE name = " + name; ...
0
votes
1answer
88 views

MySQL vulnerability bind address 127.0.0.1

Am I safe from MySQL access from another host even if they know the credential of my database, including the port? As far as I know the bing port doesn't allow any remote access. Correct me if I'm ...
2
votes
2answers
165 views

Can hacker delete my server files and database where I am using below function?

I want to know how to protect my website from hackers. I am a php-mysql developer. For fetching data from databases I always use MySQLi. For preventing my website from SQL injection, I always use PHP'...
15
votes
5answers
6k views

Can I recover a lost AES key?

I had encrypted 2 MySQL databases with AES_ENCRYPT in ECB 128 bit mode. Now I forgot my encryption key, but I have plain text (I have one database without encryption and same with encryption). How to ...
27
votes
1answer
7k views

Why should we sometimes use --+ instead of — in SQL injection to comment the rest of the query?

I have encountered some websites that when I used -- to comment the rest of the query it didn't work, but when I tried --+ it worked. In the MySQL official documentation there is no such thing as --+ ...
0
votes
2answers
411 views

Blind SQL Injection on Amazon RDS

I found a vulnerability which allows me to run any query on an Amazon RDS server. I was able to extract the user hashes by using the --passwords parameter of sqlmap, and one of the hashes was cracked ...
1
vote
1answer
197 views

Is it safe to concatenate non-input session variables into a SQL string?

I have a php application where the function "makeSessionVar" creates a session variable from application defined data, then concatenates it into the SQL string. function makeSessionVar($A,$B){ // (&...