Questions tagged [sql-injection]

SQL injection is a technique used to take advantage of vulnerabilities arising from non-validated input on web applications to pass SQL commands through for execution on a backend database.

Filter by
Sorted by
Tagged with
0
votes
2answers
42 views

SQL Injection syntax inquiry-commented injections

I have some programming experience, but am having trouble with SQL injection code. I don't understand why there's sometimes SQL syntax after the comment character (such as -- or #). I know that -- - ...
1
vote
0answers
42 views

Can sqlmap be used to extract data if the attack is blind?

I'm solving this challenge/lab where SQLi is inside the cookie parameter. After solving it manually, I thought to check if it can extract data. I used sqlmap with --cookie=COOKIE* (Notice * that's the ...
0
votes
0answers
26 views

sqlmap: why use concat and JSON_ARRAYAGG

I have run sqlmap through burpsuite and to get the existing databases it ran this query 1 UNION ALL SELECT NULL,NULL,CONCAT(0x7171717671,JSON_ARRAYAGG(CONCAT_WS(0x6a716a6c6a68,schema_name)),...
1
vote
0answers
47 views

Server response delays without having provided a time-based blind SQL injection input

I am new to SQL injection. When I was researching a bug bounty site protected by cloudflare, unsurprisingly, entering email@gmail.com' OR 1=1--, to test SQL injection, did not work. So later, trying ...
0
votes
0answers
88 views

Backendly preventing database injections on simple web forms [duplicate]

I have a simple PHP-HTML-CSS contact form which saves emails to a local email client's database (in my case, Roundcube's database, which is a standalone MySQL database, I think --- I haven't used the ...
1
vote
0answers
70 views

Is it possible to enumerate Microsoft Access database using sqlmap?

I'm trying to enumerate a Microsoft Access database using sqlmap, in particular I run this command: sqlmap -r http.txt --risk 2 --dump-all Anyway it seems is not retrieving a single information. Am I ...
14
votes
2answers
3k views

SQL injection inside XSS

Is it possible to perform an SQL injection inside an XSS attack? And if so, where can I find information on this or some examples?
1
vote
1answer
64 views

Blind SQL Injection POC in Java

I am looking for some java applications (other than Manage Engine) vulnerable to Blind SQL Injection attacks for Authentication Bypass. I explored exploitdb and others but didn't find anything ...
1
vote
1answer
48 views

Is it possible to get an sql injection after importing a sql dump?

Is it possible that after I dump a SQL Database created with prepared statements as an ".sql" file, and then I import it again, that the import may be vulnerable to SQL Injections?
1
vote
2answers
140 views

Cannot perform SQL injection because of the weird postgresql syntax that is used

I have a website that uses ManageEngine Service Plus and it has a SQL injection vulnerability the linksays that with the help of the following url we would be able to inject postgresql commands to get ...
1
vote
1answer
96 views

Sqlmap Sleepy User-Agent

I was testing Burp Suite Crawl on some old php sites I made and it found Sleepy User-Agent SQL injection vulnerability User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, ...
0
votes
2answers
52 views

How to connect to a MariaDB database after collecting data about users and passwords with a SQLI? [closed]

I'm trying to breach a dummy MariaDB database which is vulnerable to SQLI and is storing sensitive data about its users and their passwords. I've collected all the data I could collect, but now how am ...
1
vote
0answers
62 views

SQL Injection Problem

I was practising on OWASP Mutillidae, and I met a problem. There's a task that examines our knowledge of UNION query. The vulnerable query is: SELECT * FROM accounts WHERE username=' The accounts ...
1
vote
1answer
84 views

Blind SQL Injection

I am participating in a program that when I write in the url parameter ' or 1=1;-- it gives me Forbidden 403 and when I write in the parameter ' or 1=2;-- it shows me the page. Is the website and ...
0
votes
0answers
58 views

What tools/checklists can help determine the presence of malicious code in a database? MS SQL specifically

Consider a scenario, where your AV / EDR software has to exclude paths of database files as suggested by vendors to avoid affecting performance or stability issues. You want to review your database ...
0
votes
1answer
62 views

SQL Injection with long data type

All the examples of an SQL injections that I've seen have a user controlled string variable that was directly used to construct the SQL query but, I was wondering if it's possible to perform an SQL ...
1
vote
1answer
77 views

SQLinjection prevention: parser + blacklist?

I know the best way to prevent SQL-injection is parameterized queries. But this is not possible in the specific use case because the client has to be able to input SQL statements directly. So what my ...
0
votes
0answers
62 views

Is that SQL query exploitable for really malicious things

I have following SQL query in my WordPress plugin, SELECT `ID`, `post_content` FROM `wp_posts` WHERE `post_type` = 'movie' AND `post_status` = 'publish' OR `post_status` = 'private' AND `ID` NOT ...
0
votes
2answers
68 views

Is union based mysql injection able to read files outside database?

Can files outside database which are not part of any tables in database be read via union based SQL injection? For eg http://xyz.com/fetch?id=3 Consider id parameter is used at server side by cursor ...
1
vote
2answers
123 views

SQL injection using brute force?

I am studying about cyber defense lately for fun and found about a proposed method that as I understand it performs automated SQL injection using brute force by training a model. At some point it says ...
0
votes
1answer
88 views

Does Injection Attack Against SQL Server Require Semicolon or Comment?

In creating a blacklist function as part of our multi-pronged defense against SQL injection that includes parameterized queries and validating for length and type of input, we are creating a Blacklist ...
1
vote
0answers
50 views

When using parameterized SQL queries, is there still any *security* issue with simply blindly accepting user input variables?

Suppose I have this: parameterized_database_call('SELECT * FROM widgets WHERE id = $1', $_GET['widget_id']); The SQL query is parameterized, as I've done for many years now. (I'm trying to repress ...
0
votes
0answers
55 views

SQL Injection Training challenge including a PHP file

I’m currently trying to get some knowledge in SQL injection. In a pen test environment, there is a challenge on which you get the PHP file and you need to try to login using SQL Injection. I’ve ...
0
votes
1answer
55 views

SQLi Filter Bypass with banned table/column names

I've studying and practicing different approach to SQLi filter bypass and I faced a challenge. What if the WAF filters look for specific strings rather than SQL keywords? Example: Filter: /UNION/ SQLi:...
1
vote
2answers
183 views

What is this attack? id=1'[0]

I'm frequently getting these weird URLs. https://mywebsite.com/mymage.php?id=1'[0] The weird part is '[0]. The webpage pass the id to the database and the database expect an integer so we are ...
0
votes
0answers
98 views

Error Based SQL Injection

I have a MySQL lab challenge where I send id=1‘ and select @@version;# then manage to trigger an error. But the part of the error response that has my version info looks like it comes back in binary (...
0
votes
0answers
107 views

Understanding sqlmap's payload for blind sql injection

I am fairly new to sql injections and tried to solve a little hackit to understand everything better. I wasn't able to solve one of the levels so I ran sqlmap to see what it would do. The payloads ...
0
votes
1answer
59 views

Can attack to a website from a parked subdomain with different hosts?

I have a website like maindomain.com that hosted on a different hosting like 192.168.1.1 i want to add a subdomain from a different host like 192.168.1.2 to my main domain which my address will be ...
0
votes
2answers
337 views

SQL injection without the use of union and select

I was wondering if there is a way to use SELECT and UNION keywords without being caught by a algorithm (see below) that filters these keywords out. $filter = array('UNION', 'SELECT'); // Remove ...
0
votes
1answer
63 views

Trying to do an SQL injection into a login field [closed]

I have an assignment to make an SQL injection - I found a login field that spits out an error, but I can't seem to make queries work inside of it. For your information it's an Mysql server. What is ...
0
votes
1answer
220 views

SQL Injection and Hidden parameter modification

A friend of mine gave me a web application for me to test and find vulnerabilities. He told me that this web application can be purposefully modified and then made to run an SQL injection. I have ...
0
votes
0answers
95 views

Execute sqlmap in a javaScript object cookie

I am studying sqli and I found a blind sqli vulnerability in a cookie and I have exploited manually, however, I would like to detect and exploit it with sqlmap. Cookie looks like javascript object ...
1
vote
1answer
215 views

Blind SQL injection in sort direction

I have an SQL injection in a query where I control the sort direction parameter i.e: SELECT * from x where y=y ORDER BY COLUMN_NAME [SORT_DIRECTION] When I control the SORT_DIRECTION, which is ...
0
votes
2answers
969 views

Never use stored session in sqlmap

I am trying to make sqlmap to avoid fetch data from stored session. How do I achieve that? I have performed sqlmap check once on a target and now that target is offline, I want sqlmap to just stop the ...
-1
votes
1answer
242 views

How to continue performing checks on a site if sqlmap found an issue on a URL of the same site while using --batch option?

I have a file /tmp/urls which has following URLs: http://127.0.0.1:8081/?id=1 http://127.0.0.1:8081/?id2=1 I am using this command to perform checks on file URLs concurrently: python3 sqlmap.py --...
0
votes
1answer
66 views

How can I build a simple website that contains SQL injection vulnerabilities? [closed]

How can I build a simple website that contains SQL injection vulnerabilities for study purposes? What do I need to learn?
2
votes
2answers
135 views

How can I carry out SQL insert injection when there's a select statement beforehand

So here's the deal. I've been working on an SQL injection challenge and here's what comes up. There's a registration page where you input your Username, password and confirm password. It's vulnerable ...
0
votes
0answers
39 views

SQL File Privilege

I have a question about SQL File privilege. Recently, I found SQL injection vulnerability for user who had FILE privilege and I used sqlmap to get some interesting files. And I was wondering, how this ...
0
votes
1answer
124 views

Extracting data from db with time based SQL injections

SCENARIO: a vulnerable login form. I say vulnerable because if I enter +select(sleep(0))+ the server response normally. If I enter +select(sleep(5))+ the server wait for a period of time greater than ...
1
vote
0answers
180 views

SQLinjection in SQLite: How to select a column with whitespace without use it?

So, I'm trying to do a SQL injection in a ctf application that removes all whitespace in form parameters, so I can't use it. To perform my query I used /**/ to insert whitespace and I could perform ...
0
votes
0answers
51 views

SQL Injection Doesn't Sanitize But Doesn't Execute Commands

I am currently doing a pentesting on a web application and focusing more on SQL Injection. This company I am pentesting have a functionality in which we are allowed to buy things from the vendors/...
0
votes
1answer
193 views

Is it possible to locate web document root using SQL query/SQL Injection?

I have access to MySQL database which the current user has FILE privilege. I want to upload a web shell but I do not know the root directory of the web server. Is it possible to somehow locate the ...
1
vote
1answer
211 views

Why intruder number of threads has an effect on the time delay of indiviual requests

I was solving SQL injection lab on Portswigger, and the lab was asking to exploit blind SQL injection by triggering time delays, using that to retrieve administrator password. I was making 720 ...
0
votes
1answer
406 views

Understanding sqlite3 sanitization in python

I use sqlite3 for my database and get data from untrusted source with flask.request.get() I insert all data with such syntax c.execute("INSERT INTO table (e1, e2) VALUES(?, ?)", (V1, V2)) ...
0
votes
1answer
95 views

Virus / malware stored inside database

I have a small network of several Windows 10 machines (all protected by BitDefender 2020 Total Security), one of which acts as server with Firebird database. For some time the database is ...
-1
votes
2answers
110 views

Can someone Inject malicious SQL to my SQL query? [closed]

I build a simple chat with MySQL. It has a table called users and two colums: id and username. I use the following query to extract username and ID by ID. Is there a way someone can Inject malicios ...
0
votes
2answers
717 views

sqlmap won't give me results i'm looking for [closed]

I am trying to use sqlmap. Although every time I use it, I just get a response of: [13:39:11] [CRITICAL] previous heuristics detected that the target is protected by some kind of WAF/IPS [13:39:11] [...
0
votes
1answer
249 views

SQLMap Only Returns information_schema

I run this command python sqlmap.py -u https://acme.com/post.php --data "id=1" --tamper="between,randomcase,space2comment" -v 3 --random-agent --dbs but SQLMap only returns ...
0
votes
1answer
311 views

PostgreSQL injection with basic sanitization

I'm trying to figure out if an SQLi for the following PostgreSQL/Java code exists. public void availableItems(String name) { return this.query("SELECT * FROM items WHERE name='"+name+"...
0
votes
0answers
342 views

Sqlmap not detects error based injection

I am working on Hack the VM (hard machine) for my OSCP preparation There is a web app with two drop down boxes.. Year and month.. both contain numbers and a submit to fetch data from DB based on year ...

1
2 3 4 5
17