Questions tagged [sql-injection]
SQL injection is a technique used to take advantage of vulnerabilities arising from non-validated input on web applications to pass SQL commands through for execution on a backend database.
1
vote
2answers
51 views
SQL Injection on MariaDB
I am trying to exploit (legally) a MariaDb database with an SQLi vulnerability.
I have identified the vulnerability here...
/?o=1&page=app
The o=* is vulnerable and produces the following error....
-5
votes
0answers
48 views
please analisys my code [on hold]
$mysqli1 = mysqli_connect("$DbHostName", "$DbUserName", "$DbPassWord",$DatabaseName");
function sanitize($var, $mysqli1) {
if (is_array($var)) { //run each array item through this function (by ...
0
votes
1answer
67 views
What would be an example of an attack that exploits escape characters?
As far as I know escape characters are characters which change the meaning of the following character. In HTML for example the & is an escape character that declares the beginning of an entity ...
19
votes
6answers
9k views
Is it possible to detect 100% of SQLi with a simple regex?
I'm wondering if it is possible to detect 100% of the possible SQLi attacks using a simple regex.
In other words, using very simple PHP code as an example:
if (preg_match("/select/i", $input)) {
...
0
votes
0answers
32 views
is it possible to alter the contents of this table using sqli? [on hold]
*Hi, I found a related link which basically answers the question I originally had. So you can mark it down as duplicate. See post 72755
I have a table of the following format:
table comments;
...
0
votes
0answers
19 views
Exploiting MairaDB Sql Injection with procedure analyse and extractvalue()
I am testing a sql injection to a website. And spending several hours i just become to get the version of the database.
test.com/abc.php?query=1&limit=3 procedure analyse(extractvalue(rand(),...
-1
votes
0answers
21 views
Contact Form Security [closed]
I've built a contact form for my website but I'm not sure if it's secure enough against SQL injections. I'm a novice PHP developer so I might even have made a dumb mistake. Could you please take a ...
3
votes
0answers
58 views
Vulnerable web application - sql-injection that's hard to find with a regular scanner like sqlmap
I am creating a "vulnerable web application".
Is there a way to create a sql-injection vulnerability that is easy to spot during manual testing, but very hard (or impossible) for a regular sqli-...
0
votes
0answers
32 views
WAF tuning for SQLi
We have a record tracking application behind WAF. Everytime end users submit a record with special chars such as ' or " or () it blocks it as SQLi even when the payload is completely benign.
At the ...
0
votes
0answers
26 views
SQLmap different response than burp
This is my GET request, inside a get_request.txt file:
GET /sa4apc/restrict/menuApc.do?MVPG=ApcAssistitiRicerca&s_TIPO_ASSISTITO=C&s_ELIMINATI=1&s_ASSISTITO='giovanni&s_TIPO_SOGGETTO=...
0
votes
2answers
47 views
What are some examples of injection attacks into databases that abuse common programs besides SQL?
Most data validation deals with SQL injection attacks. My question is, what other types of injection types are there that use common programs, and what are good defenses against them?
0
votes
1answer
78 views
SQLmap after burp possible injection point
Burp states that a GET request have surely a SQL injection point.
I am using python sqlmap.py -r file_with_that_request.txt --level 5 --risk 3 --dbms=oracle but the injectiont doesn't work. Am I ...
231
votes
12answers
22k views
Is single quote filtering nonsense?
Penetration testers found out that we allow single quotes in submitted data fields, and want us to apply rules (input validation) to not allow them in any value.
While I'm aware that single quotes ...
0
votes
1answer
38 views
SQLmap non authorized user, but the url works in browser
Through Burp Suite I get a possible SQL injection point using this request:
POST /restrict/menuApc.do?ccsForm=AssistitoImposta:Edit&MVPG=ApcAssistitoDatiAnagraficiInserisci HTTP/1.1
Host: test-...
0
votes
2answers
78 views
getting the column names of a table by brute force blind sql injection
is there a way of getting the column names of a table by brute force blind sql injection in mysql.
so the query would be:
select column_name from information_schema.columns WHERE table_name = ‘...
0
votes
0answers
32 views
SQL Injection ORDER By not working MySQL Error Based [duplicate]
I've been learning different attack vectors using applications such as bWapp and others to further my practice and knowledge of cybersecurity.
I've stumbled across a problem in one of them. If Order ...
0
votes
1answer
40 views
What would be the best way to evaulate the database management systems? [closed]
I am an Information security analyst, looking for creative, non traditional, and unapproved ways to query/evaluate DBMS applications that includes SQL Server and PostgreSQL. Goal here is to protect ...
0
votes
0answers
35 views
How to make --os-shell command work on UBUNTU 16.04 ( Digital Ocean )?
I have made a vulnerable SQLi website ( to teach students ).
I am able to dump the database but I am not able to run os commands or upload os-shell.
I want to show them how to use --os-shell option ...
2
votes
1answer
98 views
Is SQL Injection Possible without double and single quotes?
Let's assume we're building a SQL query like this:
SELECT * FROM users WHERE username = 'Username' AND password='password'
If we blocked the characters " and ', will an attacker be able to hack into ...
0
votes
1answer
87 views
Sql injection bypass against KONA(akmai) WAF
I have been trying to find sql injection against a site in bug bounty.I tried a few parameters via sql map.One such query was shown to be injectible.
Parameter: query (GET)
Type: boolean-based ...
1
vote
2answers
171 views
SQL-injection, unable to get it to work!
I've recently found a SQL-injection vulnerability in one of our web applications. I've been able to exploit this SQLi, but only able to extract some very basic information. I'm not an expert pentester ...
0
votes
1answer
94 views
SQL injection that bypasses website's firewall that filters table by its prefix
There is a website I am assessing for security breaches. It has Joomla 1.5.x with MySQL 5.5.24 and PHP 5.3.2.
I am doing a penetration test, that exploits SQL injection. The thing is that WAF filters ...
0
votes
0answers
61 views
How trying to fetch limited entries using sqlmap?
I have 1 table (eg: users) with more than 1 million entries.
But when using Sqlmap try to --start and --stop it's not Working.
For example the query is:
sqlmap.py -u http://example.com/index.php?id=...
0
votes
1answer
86 views
What type of attack is the below SQL injection?
Today in the apache access log I saw something like this
https://xxxxx/xxxx/xx/something.html' or (1,2)=(select*from(select name_const(CHAR(103,119,111,107,69,82,84,99,118),1),name_const(CHAR(103,119,...
0
votes
0answers
55 views
Introduce a SQLi in a testing application
So I was building an application to demonstrate SQL injection via cookies and wrote some code to run SQL statements if the statement are passed within a redir cookie header but when using sqlmap to ...
4
votes
1answer
433 views
Is forbiding the ; char enough to prevent SQL injection?
Disclaimer: Parameterized queries are the way to go, no need to discuss about that :)
I've seen the following code at a friends place:
var query = "SELECT * FROM students WHERE name = " + name;
...
1
vote
0answers
96 views
How to find no of columns using sql injection
I'm new to web penetration testing and when I tried to test a website, I found that when I entered ' in the text box, I would get the following error:
OraOLEDB error '80004005'
ORA-01756: quoted ...
0
votes
2answers
91 views
SQLi with quote filter?
I'm doing some hacking courses, and in one of the lessons, I have a possible SQLi, but in the Python source code there's an if clause just before the SQL statement, which filters the quote symbol:
...
0
votes
1answer
300 views
SQl Injection MariaDB
Im found a sql query that is injectable below
"car_info = query("select models, color, running from cars where manual = 1 AND UID = '{}' LIMIT 1".format(uid))")
Where '{}' is the point of injection.
...
0
votes
1answer
199 views
SQL inject MariaDB with SQLMAP
I'm fairly new to sqlmap but I have tried a lot of attacks and have been successful except for this one attack that I have tried. SQLMAP won't detect this nor try to inject an error like this.
So how ...
3
votes
2answers
119 views
Possible SQLi with self-made prepared statements and real_escape_string?
My current assignment is to find a possible SQL injection in a PHP WebApp. While looking at the source code, I noticed that the way the script is handling prepared statments is weird.
$query = db::...
1
vote
1answer
147 views
What is this injection attack trying to accomplish?
My site has been repeatedly hit with this query. I am wondering what the attacker is trying to gain? The URL is:
my.site/content/page.aspx?myID=15641111111111111%20UNION%20SELECT%20cAsT(0x2d78312d512d%...
1
vote
0answers
128 views
Custom payload SQLMap from OWASP Zap vulnerability report
I ran OWASP Zap over my site.
In the vulnerability report I read that there is an SQL injection problem:
Advanced SQL Injection- MySQL > 5.0.11 stacked queries (SELECT - comment)
(see img for ...
1
vote
1answer
100 views
SQL injection with an auto-incrementing parameter
I'm currently performing an API Pentest and I suspect an SQLi in one of the API calls. It updates a certain item of the web-service and requires an increase of the version number for each request.
...
2
votes
0answers
94 views
SQLmap on Login. Expect 401 reponse
I'm using sqlmap to test a login. When using invalid credentials, the webserver sends back a 401 response. However, sqlmap interprets this response as I'm not authorized to call this page and needs ...
2
votes
1answer
153 views
SQL injection on PostgreSQL in integer field?
I was trying https://server/shared/sendemail?sendto=" and got this response:
Database operation "0or1row" failed
(exception ERROR, "ERROR: invalid input syntax for integer:"""
LINE 4: where user_id ...
27
votes
1answer
7k views
Why should we sometimes use --+ instead of — in SQL injection to comment the rest of the query?
I have encountered some websites that when I used -- to comment the rest of the query it didn't work, but when I tried --+ it worked.
In the MySQL official documentation there is no such thing as --+ ...
0
votes
2answers
127 views
Blind SQL Injection on Amazon RDS
I found a vulnerability which allows me to run any query on an Amazon RDS server. I was able to extract the user hashes by using the --passwords parameter of sqlmap, and one of the hashes was cracked ...
0
votes
3answers
317 views
Is SQL-injection a client-side or a server-side attack?
What type of attack is SQL-injection? I am confused because this type of attack is done through the client-side. However, the attackers target is a database which is "behind" a server. Most attacks ...
1
vote
2answers
213 views
Is SQL Injection possible in String Concatenation When all Variables are created by the Program
Say I have a program that returns some date strings from a function in javascript.
function getDates()
{
var yesterday = [some code that gets current time with yesterday's date];
var today = [...
0
votes
1answer
129 views
Running sqlmap against a parameter inside a parameter
I have a domain in the format: example.com?host=http://anotherexample.com?bar=1
I want to attack the "bar" param, but sqlmap (correctly) parses the second url as a value of the foo param. Therefore I ...
0
votes
0answers
109 views
sqlmap: Upload file to get UUID to submit with main request?
I've been looking for a way to use sqlmap with a file-upload form that, when submitted, first uploads the given file to get back a UUID, which is then send along with the user information in another ...
-2
votes
2answers
396 views
What file types might be vulnerable to SQL injection? [closed]
I am learning about SQL injection and Google dorks. I have seen that there are three file types that can be vulnerable to SQL injection, .php, .aspx and one more.
I can't find the third one... The ...
0
votes
2answers
113 views
Php parameters (username, password) in link
Little Info: I am not a web developer, I am a beginner to php and sql. Trying to learn in my free time.
I was examining a web site on a remote server and i saw something like;
www.myurl.com/login....
0
votes
3answers
492 views
Is SQL injection still a thing? [duplicate]
I was wondering whether SQL injection is still a thing or if it is mainly extinct due to the fact that I don't hear about corporations being hit by this vulnerability, And the last time I heard an ...
0
votes
1answer
282 views
bWAPP- SQL injection Hack displays a white screen?
I've been following this video(https://www.youtube.com/watch?v=XDCZ8FC856s) to install bWAPP on Parrot OS and everything works fine except SQL Injection. I've checked the database and its active. As ...
1
vote
1answer
139 views
Is this parameter vulnerable to SQL Injection?
The backend server is running Tomcat 8.5 (Java backend). The URL in question is:
https://website.com/application/servlet.do?currentOID=abc12300000000
I found that when I give an incomplete OID (i.e ...
1
vote
1answer
262 views
How this Unique SQL injection works?
I found a challenge which was vulnerable to SQL injection and it was very very pretty hard to find So, How this unique SQL works?
I found this on login form where when I send user=\&pass=||1# as ...
0
votes
1answer
525 views
How to use custom injection in sqlmap?
This is post data, normally looks like this
{"end_date":"2018-8-26","start_date":"2018-8-26","success":1}
Below resulting "You have an error ..."
{"end_date":"2018-8-26'","start_date":"2018-8-26","...
1
vote
1answer
171 views
The role of Machine Learning In Cybersecurity Defense [closed]
Hackers and malware are one step ahead of cybersecurity experts, and every time technology is released to the market, vulnerabilities will be quickly discovered and exploited.
How effective can ...
