Questions tagged [sql-injection]
SQL injection is a technique used to take advantage of vulnerabilities arising from non-validated input on web applications to pass SQL commands through for execution on a backend database.
865
questions
0
votes
0answers
35 views
manual SQL injection syntax error on MySQL
I am doing a SQL injection training with TryHackMe as shown below. https://tryhackme.com/room/ccpentesting task 18
I am trying to do it the manual way. From the guide online I know that to get the SQL ...
0
votes
0answers
36 views
Sqlmap won't pick up injection point. Tweak?
I manually found an injection point, on CTF VM, located on POST form. I found it with the following manual payload :
1' OR SLEEP(1)-- t
I would like to use sqlmap. I ended with following call :
...
10
votes
3answers
6k views
No -*|%/ and no whitespace, is this SQL injectable?
I have an SQL query like "select * from records where record like '%" + user_input + "%'" My goal here is to get all the records. So far everything I have tried involves using ...
0
votes
0answers
13 views
Sql injection how does getting data outside from susposed rows works? [duplicate]
Let's say there is some vulnerable page and it gets SQL injected. PHP on the backend only returns specific rows and does not return passwords in any way. How do people get the passwords using that?
1
vote
0answers
80 views
SQL Injection Prevention WAF Generic Rule for Wordpress
We are trying to develop a GENERIC WAF Rule for SQLI Prevention for WordPress-based websites that can provide some level of effectiveness with a very low probability of having false positives.
From my ...
1
vote
0answers
75 views
Attack on a string created by a developer
Go and Java have "compile time constants", and JavaScript will soon get a feature that allows "Distinguishing strings from a trusted developer from strings that may be attacker ...
0
votes
0answers
176 views
SQLMap - Invalid character detected. retrying
I recently discovered an time-based blind SQL injection attack on one of the websites. I was able to dump the data with 100 threads (By default, SQLmap doesn't allow more than 10 but, I modified the ...
1
vote
1answer
76 views
Bypass input validation
I'm trying to create a vulnerable sandbox environment for pentesting challenges. As part of the challenge, I want to include some elements of XSS or SQLi if possible. However, I do not wish to make ...
0
votes
0answers
57 views
how to dump all first row of table in several database using SQLmap? [duplicate]
I have several databases in each one, several tables, I am trying to extract the first row from each table from several databases using sqlmap.
0
votes
1answer
50 views
Escaping out of a select query to run a statement that modifies data in the database
Lets say you use SELECT * FROM ($query) sub where you can swap $query to any query you wish. Is there a way to escape this select and run a command that modifies data in the database?
0
votes
0answers
126 views
SQL injection to RCE with load_file , into outfile etc
I know it is possible to get RCE with SQLi but I can't write to web root, I can only write files to /tmp folder. I can upload shell.php in /tmp without problems, but I'm curious is there any other way ...
1
vote
1answer
258 views
Using sqlmap for detecting SQLi on Juice shop's login page
New Sqlmap user, so please be patient :)
I've started looking at the tool and I'm curious about its use. For instance, the login page of OWASP's Juice shop is vulnerable to sql injection (' OR 1=1-- ...
0
votes
1answer
107 views
SQL Injection with Filters
I have a SQLite Query, which is something like:
SELECT id FROM demo WHERE name="insertname".
In this case, double-quotes are disabled, which means that insertname cannot contain double-...
0
votes
1answer
124 views
How to configure SQLMap to attack JSON parameter?
Part of a box I'm doing, I can successfully pass basic SQL query 'or'1'='1 with no errors,
{"search":"'or'1'='1"}
Output:
HTTP/1.0 200 OK
Trying to error the query
{"search&...
1
vote
3answers
216 views
Can you protect against SQLi without using prepared statements?
I am learning about SQLi (SQL injection) and I know that the solution to avoid them is prepared statements. However, does this mean that without them we are sure that we can get hacked? Are prepared ...
0
votes
2answers
56 views
SQL Injection syntax inquiry-commented injections
I have some programming experience, but am having trouble with SQL injection code. I don't understand why there's sometimes SQL syntax after the comment character (such as -- or #). I know that -- - ...
1
vote
0answers
102 views
Can sqlmap be used to extract data if the attack is blind?
I'm solving this challenge/lab where SQLi is inside the cookie parameter. After solving it manually, I thought to check if it can extract data. I used sqlmap with --cookie=COOKIE* (Notice * that's the ...
0
votes
0answers
51 views
sqlmap: why use concat and JSON_ARRAYAGG
I have run sqlmap through burpsuite and to get the existing databases it ran this query
1 UNION ALL SELECT NULL,NULL,CONCAT(0x7171717671,JSON_ARRAYAGG(CONCAT_WS(0x6a716a6c6a68,schema_name)),...
1
vote
0answers
51 views
Server response delays without having provided a time-based blind SQL injection input
I am new to SQL injection. When I was researching a bug bounty site protected by cloudflare, unsurprisingly, entering email@gmail.com' OR 1=1--, to test SQL injection, did not work.
So later, trying ...
0
votes
0answers
89 views
Backendly preventing database injections on simple web forms [duplicate]
I have a simple PHP-HTML-CSS contact form which saves emails to a local email client's database (in my case, Roundcube's database, which is a standalone MySQL database, I think --- I haven't used the ...
1
vote
0answers
214 views
Is it possible to enumerate Microsoft Access database using sqlmap?
I'm trying to enumerate a Microsoft Access database using sqlmap, in particular I run this command:
sqlmap -r http.txt --risk 2 --dump-all
Anyway it seems is not retrieving a single information. Am I ...
14
votes
2answers
3k views
SQL injection inside XSS
Is it possible to perform an SQL injection inside an XSS attack?
And if so, where can I find information on this or some examples?
1
vote
1answer
93 views
Blind SQL Injection POC in Java
I am looking for some java applications (other than Manage Engine) vulnerable to Blind SQL Injection attacks for Authentication Bypass. I explored exploitdb and others but didn't find anything ...
1
vote
1answer
50 views
Is it possible to get an sql injection after importing a sql dump?
Is it possible that after I dump a SQL Database created with prepared statements as an ".sql" file, and then I import it again, that the import may be vulnerable to SQL Injections?
1
vote
2answers
186 views
Cannot perform SQL injection because of the weird postgresql syntax that is used
I have a website that uses ManageEngine Service Plus and it has a SQL injection vulnerability
the linksays that with the help of the following url we would be able to inject postgresql commands to get ...
1
vote
1answer
237 views
Sqlmap Sleepy User-Agent
I was testing Burp Suite Crawl on some old php sites I made and it found Sleepy User-Agent
SQL injection vulnerability
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, ...
0
votes
2answers
57 views
How to connect to a MariaDB database after collecting data about users and passwords with a SQLI? [closed]
I'm trying to breach a dummy MariaDB database which is vulnerable to SQLI and is storing sensitive data about its users and their passwords. I've collected all the data I could collect, but now how am ...
1
vote
0answers
63 views
SQL Injection Problem
I was practising on OWASP Mutillidae, and I met a problem. There's a task that examines our knowledge of UNION query.
The vulnerable query is:
SELECT * FROM accounts WHERE username='
The accounts ...
1
vote
1answer
120 views
Blind SQL Injection
I am participating in a program that when I write in the url parameter ' or 1=1;-- it gives me Forbidden 403 and when I write in the parameter ' or 1=2;-- it shows me the page.
Is the website and ...
0
votes
0answers
72 views
What tools/checklists can help determine the presence of malicious code in a database? MS SQL specifically
Consider a scenario, where your AV / EDR software has to exclude paths of database files as suggested by vendors to avoid affecting performance or stability issues.
You want to review your database ...
0
votes
1answer
69 views
SQL Injection with long data type
All the examples of an SQL injections that I've seen have a user controlled string variable that was directly used to construct the SQL query but, I was wondering if it's possible to perform an SQL ...
1
vote
1answer
88 views
SQLinjection prevention: parser + blacklist?
I know the best way to prevent SQL-injection is parameterized queries. But this is not possible in the specific use case because the client has to be able to input SQL statements directly.
So what my ...
0
votes
0answers
64 views
Is that SQL query exploitable for really malicious things
I have following SQL query in my WordPress plugin,
SELECT `ID`, `post_content`
FROM `wp_posts`
WHERE `post_type` = 'movie'
AND `post_status` = 'publish'
OR `post_status` = 'private'
AND `ID` NOT ...
0
votes
2answers
87 views
Is union based mysql injection able to read files outside database?
Can files outside database which are not part of any tables in database be read via union based SQL injection? For eg
http://xyz.com/fetch?id=3
Consider id parameter is used at server side by cursor ...
1
vote
2answers
206 views
SQL injection using brute force?
I am studying about cyber defense lately for fun and found about a proposed method that as I understand it performs automated SQL injection using brute force by training a model. At some point it says ...
0
votes
1answer
119 views
Does Injection Attack Against SQL Server Require Semicolon or Comment?
In creating a blacklist function as part of our multi-pronged defense against SQL injection that includes parameterized queries and validating for length and type of input, we are creating a Blacklist ...
1
vote
0answers
52 views
When using parameterized SQL queries, is there still any *security* issue with simply blindly accepting user input variables?
Suppose I have this:
parameterized_database_call('SELECT * FROM widgets WHERE id = $1', $_GET['widget_id']);
The SQL query is parameterized, as I've done for many years now. (I'm trying to repress ...
0
votes
0answers
56 views
SQL Injection Training challenge including a PHP file
I’m currently trying to get some knowledge in SQL injection. In a pen test environment, there is a challenge on which you get the PHP file and you need to try to login using SQL Injection. I’ve ...
0
votes
1answer
120 views
SQLi Filter Bypass with banned table/column names
I've studying and practicing different approach to SQLi filter bypass and I faced a challenge. What if the WAF filters look for specific strings rather than SQL keywords?
Example:
Filter: /UNION/
SQLi:...
1
vote
2answers
197 views
What is this attack? id=1'[0]
I'm frequently getting these weird URLs.
https://mywebsite.com/mymage.php?id=1'[0]
The weird part is '[0].
The webpage pass the id to the database and the database expect an integer so we are ...
0
votes
0answers
138 views
Error Based SQL Injection
I have a MySQL lab challenge where I send id=1‘ and select @@version;# then manage to trigger an error. But the part of the error response that has my version info looks like it comes back in binary (...
0
votes
0answers
137 views
Understanding sqlmap's payload for blind sql injection
I am fairly new to sql injections and tried to solve a little hackit to understand everything better. I wasn't able to solve one of the levels so I ran sqlmap to see what it would do. The payloads ...
0
votes
1answer
76 views
Can attack to a website from a parked subdomain with different hosts?
I have a website like maindomain.com that hosted on a different hosting like 192.168.1.1 i want to add a subdomain from a different host like 192.168.1.2 to my main domain which my address will be ...
0
votes
2answers
627 views
SQL injection without the use of union and select
I was wondering if there is a way to use SELECT and UNION keywords without being caught by a algorithm (see below) that filters these keywords out.
$filter = array('UNION', 'SELECT');
// Remove ...
0
votes
1answer
73 views
Trying to do an SQL injection into a login field [closed]
I have an assignment to make an SQL injection - I found a login field that spits out an error, but I can't seem to make queries work inside of it. For your information it's an Mysql server. What is ...
0
votes
1answer
345 views
SQL Injection and Hidden parameter modification
A friend of mine gave me a web application for me to test and find vulnerabilities. He told me that this web application can be purposefully modified and then made to run an SQL injection. I have ...
0
votes
0answers
131 views
Execute sqlmap in a javaScript object cookie
I am studying sqli and I found a blind sqli vulnerability in a cookie and I have exploited manually, however, I would like to detect and exploit it with sqlmap.
Cookie looks like javascript object ...
1
vote
1answer
301 views
Blind SQL injection in sort direction
I have an SQL injection in a query where I control the sort direction parameter i.e: SELECT * from x where y=y ORDER BY COLUMN_NAME [SORT_DIRECTION]
When I control the SORT_DIRECTION, which is ...
0
votes
2answers
2k views
Never use stored session in sqlmap
I am trying to make sqlmap to avoid fetch data from stored session. How do I achieve that? I have performed sqlmap check once on a target and now that target is offline, I want sqlmap to just stop the ...
-1
votes
1answer
400 views
How to continue performing checks on a site if sqlmap found an issue on a URL of the same site while using --batch option?
I have a file /tmp/urls which has following URLs:
http://127.0.0.1:8081/?id=1
http://127.0.0.1:8081/?id2=1
I am using this command to perform checks on file URLs concurrently:
python3 sqlmap.py --...
