Questions tagged [mysql]

MySQL is an open-source relational database management system.

Filter by
Sorted by
Tagged with
9
votes
1answer
7k views

SQL Injection through addslashes

I'm trying to understand how a website can be hacked through using addslashes in PHP and MySQL for educational purpose. After reading this topic and this topic, I try to understand how it can bypass ...
8
votes
7answers
32k views

Are there any tools for scanning for SQL injection vulnerabilities while logged in?

Some pages of my website were vulnerable to SQL injection. The injection worked only when the user was logged in. I have now fixed this problem, and now I want to make sure that no similar problems ...
8
votes
3answers
6k views

Beneficial to rename MySQL root user?

Title sums it up. I'm setting up a dedicated server as opposed to using shared hosting, and am wondering if it's more secure to change the MySQL root username. I've gone for a long and complex ...
8
votes
2answers
41k views

MySql root password stored in .my.cnf

Before launch of a project, I reset the server's mysql root password. The colo that is hosting project wants the server's root database password stored in the .my.cnf file, in plain text, with the ...
8
votes
1answer
5k views

Implementing an autologin link in an email [duplicate]

So I'm working on a PHP application called Magento and I would like to implement a link which will be sent in an email to customers that will automatically log them in. I know it is critical in terms ...
8
votes
4answers
5k views

Is it a secure way to declare DB parameters in htaccess rather than in a PHP file?

It has been suggested in securing PHP article that using directive as below in htaccess is more secure than hardcoding it into your app: <VirtualHost ilia.ws> Include /home/ilia/sql.cnf </...
8
votes
2answers
33k views

How to securely connect to a database with PHP?

Currently in PHP (in the file /var/www/website.com/public_html/functions.php). I am connecting to the database like this: function connect(){ $config = parse_ini_file('/var/www/website.com/db.ini'...
8
votes
1answer
3k views

SQL injection with single statement query

Suppose I had a vulnerable query like this: var q = 'SELECT x FROM y WHERE id = ' + req.body.id + ' ORDER BY date DESC;'; For the purposes of this question, req.body.id could be any integer ...
7
votes
2answers
12k views

What is the meaning of "something AND 1=0" command in SQL?

I have read somewhere that in SQL injection attacks the attackers use such keywords into application entry points. Whats the purpose of doing this?
7
votes
4answers
7k views

Store password using sha1 [duplicate]

I've been using the sha1() function to hash password before inserting it into my database. But I have this procedure so that it just won't be the password to be hashed. My page would register a user ...
7
votes
2answers
20k views

How to extract information using a SQL injection on PHP?

I'm new to SQL injections so please forgive me if this appear a little amateur. I was working on a website where I managed to bypass authentication and login as a normal user: username: ' OR 1 -- - ...
7
votes
1answer
3k views

SQL Injection explain this query

' 1=1 GROUP BY CONCAT_WS ('~',version(), FLOOR(rand(0)*2)) having min(0) 1>> My first question is what is CONCAT function is being used for in this query 2>> And Why do we use having min(0) in here.
7
votes
1answer
517 views

How does MariaDB's ed25519 auth scheme work?

Newer versions of MariaDB (a MySQL database server fork) have a new password based auth scheme called "ed25519". The docs are very sparse regarding how it works and what it does. https://mariadb.com/...
7
votes
1answer
5k views

Spoofing `localhost` to connect to a server that only accepts connections from localhost

I have been wondering whether it is possible or not to spoof localhost so that when a connection is made the remote server can be tricked into thinking the connections are coming from localhost. For ...
7
votes
2answers
2k views

What's the best way to test for SQL Injection vulnerabilities? Manual or SQLMap?

As part of my job I test for web application vulnerabilities regularly. When it comes to SQL Injection, my methodology is to start by manually browsing the website and spidering it, then, sending the ...
7
votes
1answer
971 views

How important is a mysql password for localhost?

We can assume that if an attacker gained access to a web server running mysql that they would be capable of reading the scripts to determine the mysql password. If mysql only responds on localhost, ...
7
votes
4answers
24k views

What can I do with an SQL shell using SQLMap?

I was just messing around with SQLMap on Kali and I have now got an --sql-shell on the main database. With this, I wondered what I can do now with this access. How would I insert data into the ...
7
votes
2answers
3k views

How to store nonce and key when working with libsodium secretbox?

Why am I asking? I am very new to cryptography (so please be patient with me...) and I want to avoid making unnecessary mistakes. I did a lot of research, but - other than with most other programming ...
7
votes
1answer
6k views

How does one scan a MySQL database for malware?

I have a lot of means of searching for malicious code within the file system, monitoring traffic, scanning log files, checking for suspicious/masked processes etc. However, scanning a relational ...
6
votes
6answers
15k views

Mysql - two-way encryption of sensitive data (email addresses) outside of Apache, PHP and MySQL

We store user email addresses in our database, like many other websites. While we do take pride in the security measures in place, sometimes "just enough" is just not enough. We've begun looking into ...
6
votes
2answers
2k views

What is better salted hash or openssl encryption?

Im using php and I was looking to store passwords in a mysql database. I was wondering what would be safer to use a salted hash or openssl encryption? If i use a unique random generated salted hash ...
6
votes
3answers
953 views

Making database code open source

I am building a web app. It is currently not open source, but I am considering making it open source, so that others can fix bugs, improve it, so that others are not suspicious of my motives (fun to ...
6
votes
2answers
663 views

How dangerous is disclosing a table's structure to users?

I apologize if this is a dumb question. I recently came across a website that embedded its error log out in a JSON response if the request to the website failed. In this case, it appeared there was a ...
6
votes
2answers
1k views

SQL injection across multiple tables

If a website has multiple web apps, each of them connected to different tables in a database and all of the apps are protected from SQL Injection except one; can that one web app be used to read/...
6
votes
4answers
6k views

MySQL AES_ENCRYPT key length

AES_ENCRYPT uses a 128 bit long key to encrypt the data, but how MySQL handle longer or shorter keys? I found out that PyCrypto for instances recomend to transform the key by using MD5, SHA-1, SHA-2, ...
6
votes
2answers
171 views

Security concerns with pre-pay system

I am looking at setting up a pre-pay system for the food retail industry. Retailers will be able to generate random 10 digit codes and supply these to customers to enter into an app to gain the value ...
6
votes
2answers
1k views

mysql security logging

Is there any logging available that logs mysql connection attempts to the port, login attempts, and times succeeded with username, IP address and date time? Im trying to detect brute force attempts. ...
6
votes
2answers
3k views

Backdoors after SQL injection?

I just found an injection vulnerability on a live site of a client. It looks like this: $sql = "SELECT * FROM users_dl WHERE Username = '" . $Uname . "' AND Password = '" . $Pword . "'"; I ...
6
votes
1answer
1k views

PHP SQL Injection Vulnerability In UPDATE Statements

Take the following SQL query as an example: UPDATE `sqlinjection2` SET `$vote`=`$vote`+1 Our goal is to increment the vote count by more than one, in one request. We cannot access the code itself. ...
6
votes
1answer
2k views

Why would output from sqlmap be trimmed?

I've decided to learn sqlmap but having an issue with Sqlmap trimming some of my output, the hash. The hash is about to be 32 characters long but I'm only getting 25 and the warning: [WARNING] ...
5
votes
2answers
833 views

Should every output element be filtered, or just those which contain user-editable data? [duplicate]

I'm combing through a legacy app updating SQL to prevent Injections and XSS vulnerabilities. I know to apply PHP's htmlspecialchars() anything that is directly passed to a script and displayed on a ...
5
votes
2answers
48k views

Uploading Shell Using SQLI

I found an SQL injection vulnerability in a Wordpress installation inside one of my lab machines and I am trying to leverage it to upload a shell. I can get the admin hash but it seems that it is ...
5
votes
5answers
691 views

Obfuscating IDs for greater security in DB?

Original post: https://laracasts.com/discuss/channels/general-discussion/best-way-to-secure-healthcare-data-in-db I have a problem dealing with high secure/sensitive (healthcare) data. I know about ...
5
votes
2answers
526 views

Identifying an ongoing exploit?

Recently I was contacted by a person saying that they had found a vulnerability in my site. They were able to prove it, by sending me a list of my own databases (some of which had been created but ...
5
votes
1answer
139 views

Should I take care of mysql credentials?

My mysql server is configured to not allow remote connection. Should I seriously care about mysql user and password in this case?
5
votes
2answers
1k views

Could this login form be "hacked" to allow access?

We have this legacy website which has horrendous code in it. I have just been looking through the login form/code and can see un-sanitised sql queries. E.g. in a nutshell: $email=$_POST['email']; $...
5
votes
2answers
7k views

How do I protect user data at rest?

I want to encrypt the username, email, and password fields in the database AND encrypt user files at rest. How can I do this? I am aware of software such as Gazzang and since there is not cost ...
5
votes
1answer
827 views

What are the dangers with creating MySQL databases on the fly?

I am building a site where people set up small, private, social networks. For ease of administration and portability, I would like each network to be stored in a different MySQL database. I ...
5
votes
3answers
3k views

Securely storing an encryption key on AWS

Regardless of the format of encryption, what is the best way to store an encryption key on an AWS EC2 server? I am storing encrypted information in a MySQL database and my cryptography key is stored ...
5
votes
1answer
524 views

Blind SQL Injection and HTTP Version Dependency?

I Recently came across a Virtual Machine that has Blind SQL Injection in the X-Forwarded-For header. I used sleep() to detect the vulnerability. The Payload worked in HTTP/1.0 and not in HTTP/1.1 . ...
5
votes
1answer
103 views

How much extra security do the Host part of a mysql user account provide?

MySQL users have a username and a Host associated with them, so usually you'd identify the user by 'user'@'host'. The host part is there to assure only clients which connect from that specific host ...
5
votes
2answers
18k views

SQL Injection Modify / Insert Table Values

Is it possible to update a field in a MySQL database or insert a new row using SQL injection in this case: The only protection in the PHP code is mysql_real_escape_string(). The query is constructed ...
5
votes
3answers
178 views

Drupal Security & Two DBs

I use drupal for our site. It uses nodes that store data. We link lots of these nodes together to allow us to log jobs, customer info, invoices etc. These are linked via an addon drupal module. If I ...
5
votes
1answer
2k views

Is this admin area secure enough? V2

This is a response to my previous question, Is this admin area secure enough?. There were some very helpful answers there, for which I am very grateful. So I went back to the drawing board and here is ...
5
votes
3answers
2k views

The security of the PASSWORD function in MySQL

The PASSWORD function in MySQL can be translated to the code in php: function mysql_password($string){ $pass = strtoupper( sha1( sha1($string, true) ) ...
5
votes
1answer
4k views

SQL Injection - login bypass [closed]

Background information: SQL Injection as a school task. Login bypass. Given two input fields name and password. Confirm via solve button. Info on what I have and was able to find out: it is ...
5
votes
1answer
2k views

sqlmap HTTP 405 error on a vulnerable POST parameter

For academical purposes I need to explode a blind sql injection on a form paramater which is sent using the POST method. The form is very simple, it just has an input text box where to introduce the ...
5
votes
2answers
1k views

Tokenless REST API security concerns

I'm designing an API in PHP/MySQL that, by its design, will not store a user's password in the database and thus does not generate authorization tokens for the client to hold. The reason for this is ...
5
votes
1answer
28k views

Why does MYSQL's LOAD FILE only read some files and not others?

As part of an assessment I'm using mysql to poke around at a compromised hosts' filesystem. As I seemed to remember from the last time I played with it, some files can be read (eg. /etc/passwd) and ...
5
votes
2answers
6k views

Blind SQL injection with Acunetrix Vulnerability Scanner

I'm trying to analyse the test results for blind SQL injection using Acunetrix Vulnerability Scanner. URL encoded POST input address was set to if(now()=sysdate(),sleep(0),0)/*'XOR(if(now()=sysdate()...

1
2
3 4 5
10