Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [mysql]

MySQL is an open-source relational database management system.

0
votes
0answers
20 views

How to decrypt an openssl_encrypt() encrypted value using MySQL query? [on hold]

If I am using the following php script to encrypt a field in my database: <?php require_once('../api.php'); $newApi = new api(); $conn = $newApi->connection(); //$key previously generated ...
4
votes
1answer
350 views

Is forbiding the ; char enough to prevent SQL injection?

Disclaimer: Parameterized queries are the way to go, no need to discuss about that :) I've seen the following code at a friends place: var query = "SELECT * FROM students WHERE name = " + name; ...
0
votes
1answer
57 views

MySQL vulnerability bind address 127.0.0.1

Am I safe from MySQL access from another host even if they know the credential of my database, including the port? As far as I know the bing port doesn't allow any remote access. Correct me if I'm ...
2
votes
2answers
121 views

Can hacker delete my server files and database where I am using below function?

I want to know how to protect my website from hackers. I am a php-mysql developer. For fetching data from databases I always use MySQLi. For preventing my website from SQL injection, I always use PHP'...
15
votes
5answers
5k views

Can I recover a lost AES key?

I had encrypted 2 MySQL databases with AES_ENCRYPT in ECB 128 bit mode. Now I forgot my encryption key, but I have plain text (I have one database without encryption and same with encryption). How to ...
0
votes
0answers
41 views

SQLi : How to extract Info about tables if the user doesn't have access to Information_Schema and Mysql.user?

So lets say you got the access to a database using SQLi, (get method) the problem here is that this 'database user' has no access to Information_Schema or mysql.user to learn about the table names ...
27
votes
1answer
7k views

Why should we sometimes use --+ instead of — in SQL injection to comment the rest of the query?

I have encountered some websites that when I used -- to comment the rest of the query it didn't work, but when I tried --+ it worked. In the MySQL official documentation there is no such thing as --+ ...
0
votes
2answers
104 views

Blind SQL Injection on Amazon RDS

I found a vulnerability which allows me to run any query on an Amazon RDS server. I was able to extract the user hashes by using the --passwords parameter of sqlmap, and one of the hashes was cracked ...
1
vote
1answer
91 views

Is it safe to concatenate non-input session variables into a SQL string?

I have a php application where the function "makeSessionVar" creates a session variable from application defined data, then concatenates it into the SQL string. function makeSessionVar($A,$B){ // (&...
1
vote
1answer
48 views

Is using JSON a secure way of handling sql queries in python?

The question I will try to articulate this as clearly and best I can: Suppose that I have a python program which connects to a database on a server. Next I ask you to consider that this python ...
0
votes
1answer
72 views

Why are SQL servers not attacked as frequently as ssh servers?

I have a server running with both SSH and MySQL accessible to the public internet. Both run on default ports (22 and 3306). The ssh server is attacked by bots all the time. This is the output of ...
2
votes
0answers
20 views

Why is MySQL 8.0 AES_ENCODE unsafe for statement-based replication?

I read this interesting note in the MySQL 8.0 documentation that seemed a bit confusing to me: Statements that use AES_ENCRYPT() or AES_DECRYPT() are unsafe for statement-based replication. As I ...
21
votes
5answers
3k views

Is password information dumped from the MySQL user table sensitive?

Assume I have dumped MySQL user list using SELECT user, host, password, ssl_type FROM mysql.user; The result looks like this: +------------------+-----------+----------------------------------------...
0
votes
1answer
193 views

How this Unique SQL injection works?

I found a challenge which was vulnerable to SQL injection and it was very very pretty hard to find So, How this unique SQL works? I found this on login form where when I send user=\&pass=||1# as ...
-1
votes
1answer
293 views

Using SQL to compare hashed passwords

Setup A LAMP system (Linux, Apache, MySQL, PHP). Access to db is over the loopback interface (maybe not in the future - dependent on hosting solution). The db contains a table with the username, ...
0
votes
1answer
139 views

Is it SQL Injection Vuln? [closed]

Today my friend asking help to test and prevent his website from sql injection.. After i tried basic sql injection like 1 OR 1=1, ' OR 1--',' '1'='1 There is no mysql error displayed.. But After i ...
0
votes
1answer
136 views

Protect MySQL against brute-force attacks on dedicated CentOS 7 server

I have a database in a dedicated server (CentOS 7) setup by an external provider. I see a disgusting amount of brute-force attempts in MySQL log file every day. I know the best option would be to not ...
1
vote
2answers
43 views

Is there a point to set up passwords for services like MySQL, Redis etc. if we disable their related ports?

Redis' default port is 6379 and MySQL's default port is 3306. Let's say we disable these ports to outside of the world with ufw. And let's say only I have access to the servers. Is there still a point ...
6
votes
2answers
552 views

How dangerous is disclosing a table's structure to users?

I apologize if this is a dumb question. I recently came across a website that embedded its error log out in a JSON response if the request to the website failed. In this case, it appeared there was a ...
0
votes
1answer
59 views

Possibility of SQL injection by static or predefined values

Using direct variables is vulnerable to sql injection. So to prevent attacks we use parameters. $result->bindParam(":id",$_POST['id'],PDO::PARAM_INT) but I am confused regarding the following ...
1
vote
2answers
797 views

MySQL AES_ENCRYPT string key length

In MySQL there are builtin AES_ENCRYPT() and AES_DECRYPT() functions which take the form of: AES_ENCRYPT(str, key_str) What length is required for the key_str argument? Can it be variable? What is ...
0
votes
4answers
142 views

Is it possible to verify if a website is vulnerable to SQLi by viewing its source code?

I've heard the eval() function is vulnerable to SQLi. Can I check for vulnerabilities by simply viewing the website source code?
1
vote
1answer
54 views

Is the hosting OS safe to sql injection hackers by hiding admin ID?

We are 1-3 guys maintaining a fairly large but clumsy developed-in-house website. With around 900+ mysql tables, and a lot of data access code in PHP. Let's say it is huge amount of code for just 1 or ...
2
votes
2answers
110 views

Can root user have access to MySQL data?

Having MySQL using auth_socket as default authentication mechanism for the root user scares me, so I change it to password authentication with rigid controls on password quality and documentation. If ...
0
votes
1answer
115 views

About SQL Injection Mysql

I'm trying to test SQL injection on a site (PHP, uses MySQL Database). When I put an apostrophe in the username field and leave the password box blank, after submitting, the form reloads and the ...
34
votes
11answers
10k views

How to limit the impact of and reduce the risk of SQL injection for existing website?

Our website is 100% API based (with an SPA client). Recently, a hacker managed to get our admin's password (hashed with SHA-256) through SQL injection (and cracking pwd) like this: https://example....
4
votes
1answer
217 views

Possible SQL injection vulnerability?

I'm a developer and I'm creating a script to interface with game servers to update player stats. I was sending a POST request with multipart form data and on the last boundary accidentally had the ...
0
votes
0answers
43 views

Blackbox SQLi: MySql “error in your SQL syntax” when larger “UNSIGNED BIGINT”

I'm trying to blackbox pentest a website, the URL has the form http://example.com/a/[integer_value]/something_else When trying to change [integer_value] to quotes (double and single), characters. It ...
5
votes
1answer
109 views

Blind SQL Injection and HTTP Version Dependency?

I Recently came across a Virtual Machine that has Blind SQL Injection in the X-Forwarded-For header. I used sleep() to detect the vulnerability. The Payload worked in HTTP/1.0 and not in HTTP/1.1 . ...
7
votes
1answer
370 views

How to store nonce and key when working with libsodium secretbox?

Why am I asking? I am very new to cryptography (so please be patient with me...) and I want to avoid making unnecessary mistakes. I did a lot of research, but - other than with most other programming ...
0
votes
2answers
301 views

How to extract data using SQL injection on a vulnerable ASP.NET application?

I managed to find a vulnerability in a so-called friend of mines website and I want to show him that his website is vulnerable to data extraction. When I use something like yes')-- as post I get the ...
0
votes
2answers
81 views

What can be done with MySQL password

Let's say there's a simple website hosted on the web, based on Flask + MySQL. The website's functionality is secure and does not allow arbitrary queries to be run against the database. However, let's ...
3
votes
1answer
209 views

protection from Backdoor hacks from disgruntled developer/ employee

I created a ecommerce site with a developer. He completed almost all his work but in the end we had some financial disagreements so our partnership ended in a bitter dispute. That developer threatened ...
-1
votes
1answer
286 views

What does pseudonymization mean in the context of web development?

In readiness for the new GDPR legislation that is coming in on May 25th, I am trying to understand what pseudonymization means in the context of web development. The info I've read infers that it is ...
3
votes
2answers
1k views

Is PHP OpenSSL safer than just using MySQL AES_ENCRYPT/DECRYPT alone?

I wish to encrypt/decrypt data in my MySQL database stored on my server. I use a salted hash for my passwords. All encryption/decryption would occur on the server. I use PHP end points which my remote ...
2
votes
0answers
106 views

Does MySQL error “Illegal mix of collations” imply an SQL injection vulnerability?

The user input of a given query is being sanitized (PHP, real_escape_string), yet the query fails with "Illegal mix of collations". This query is below: SELECT * FROM `table` WHERE `column` = "�½��ļ��...
3
votes
1answer
350 views

Are MariaDB's encryption and compression functions secure?

MariaDB [(none)]> SET @key_str = SHA2('Is it secure?',512); Query OK, 0 rows affected (0.00 sec) MariaDB [(none)]> SET @crypt_str = AES_ENCRYPT('cleartext',@key_str); Query OK, 0 rows affected (...
0
votes
0answers
314 views

Port forwarding mysql when it's bound to localhost

I am a pentesting n00b, working my way through vulnhub VMs. I am stuck trying to figure out how to make portforwarding work with a mysql instance bound to address of 127.0.0.1. Can someone give me ...
0
votes
2answers
211 views

SQL injection evasion

I know that filtering bad keyword is not a good approach to preventing SQL injection. However, when I couldn't answer why this is not a good approach, here is my rule: 1) When I see ;, I make it to '...
0
votes
0answers
84 views

Unable to run Metasploit scripts on a mysql server for authorized penetration testing

I am taking a course in penetration testing and I was provided with a virtual environment to pen test. I was provided with a vpn for my CC server and i am able to ping the host which was found to run ...
-1
votes
1answer
483 views

SQL Injection ByPass

$result = $db->query('SELECT * FROM USERS WHERE password="'.$_GET['password'].'"'); if($result->fetchArray()) $step1=true; $result = $db->query('SELECT * FROM USERS WHERE password=\''.$_GET['...
0
votes
0answers
81 views

Accessing MySQL DB from Java App or Apache Kafka and NiFi

I am wondering, what is more secure to access a database in MySQL: directly via Java application (DriverManager.getConnection) send information from Java App to Apache Kafka, then read it out in ...
-4
votes
1answer
741 views

Hex in the SQL Injection query [closed]

What would these hashes be in the query? How can I generate them? http://www.example.com?id=-29/!50000UNION/ /!50000SELECT/ 1,2,...
-1
votes
1answer
78 views

Can this be bypassed with SQL Injection?

This is my php code: $uname = $_POST['username']; $pwd = md5($_POST['password']); $sql = "SELECT * FROM `user` WHERE username = '$uname' AND password = '$pwd'"; My friend gave me this code but I’d ...
2
votes
1answer
101 views

Can native SQL code be vulnerable? To what?

I was able to find an article that mentions that SQL injection can be done to SQL code in the following scenarios where stored procedures are involved: EXEC statements Dynamic Cursors Assuming SQLi ...
0
votes
1answer
107 views

Using encrypted config file for MySQL?

On my Linux system, I always use a configuration file to log in to MySQL servers without having to enter my password every time. These files includes the username and password. I have to encrypt this ...
0
votes
0answers
259 views

Bypassing IP Restriction or finding accepted IPs for SQL Database

I have discovered the credentials of a website database. I've tried to access the database from SQLMap (which claims that you can access the SQL database from external sources) but in the meantime, ...
3
votes
2answers
61 views

Store basic oAuth for a session on a website

I am not sure if there is a good way to do this. Currently I have a website that users log into. In that website there is pages that have API calls to another service, this service uses: ...
3
votes
2answers
428 views

Why did this particular input work for SQL injection?

I'm studying infosec, starting to make my way through some of the online wargames out there. Have recently been working on Natas by OverTheWire (http://overthewire.org/wargames/natas/) and it's been ...
3
votes
0answers
129 views

Can a non-root process (MySQL) authenticate to RADIUS via PAM?

I've run across a dilemma with PAM RADIUS authentication for the database layer. In our environment, the OS login authenticates via PAM to a RADIUS server which accepts a token code and authenticates ...