Questions tagged [sql-injection]
SQL injection is a technique used to take advantage of vulnerabilities arising from non-validated input on web applications to pass SQL commands through for execution on a backend database.
769
questions
0
votes
0answers
53 views
Response seems to get redirected if SQL injection query succeeds, if not then it doesn't get redirected
Under the authorization of my friend, I am testing his website against potential vulnerabilities.
I was trying to find if I was able to inject a SQL query into a POST request parameter hi' or 1=1 --:
...
-4
votes
0answers
46 views
SQLmap is repeatedly showing error messages [closed]
I've been able to successfully download SQLMap and a lower version of Python than what I already had. Unfortunately it doesn't seem to function properly. The commands I enter just don't seem to ...
0
votes
0answers
58 views
Is this SQLMap query is correct?
I am practicing on some vulnerable application, and I am asked to find an injection vulnerability with a payload. it states there is a common and simple filter in place. Then I need to extract the ...
2
votes
2answers
110 views
SQL injection using URL query string (web application/php server)
Hacker is trying to attack the site by using the following SQL injection query to get the SQL version.
Using URL site. example:
www.abc.com/?queryParamString=(SELECT 9701 FROM(SELECT COUNT(*),...
2
votes
1answer
72 views
Is SQL Injection possible in this case (REGEXP)?
I'm on a website which have a program, there is a search input for keywords.
When I input & or < or > and search, it returns Got error 'empty (sub)expression' from regexp error and when I ...
0
votes
1answer
37 views
Is a differentially private SQL database relatively more secure from an SQL injection?
I've been in security for a while now but I'm relatively new to privacy. I've been studying differential privacy and its application to databases. However I'm still a little confused about where ...
1
vote
1answer
147 views
Which symbols can I whitelist to remain safe against SQL injection, XSS, and all other injections attacks?
I have an input field in a web that is being saved. This field can be shown in other systems that I do not have control over and that's why I would like to limit what is allowed in this field, ...
0
votes
1answer
103 views
How can this sql query be injected?
I've a php code where I get the page number from a GET request and then run a sql query to select records from the database by the page number
$maxPerPage = 20;
$page = $_GET["p"];
$applicants = DB:...
1
vote
0answers
125 views
SQL Injection only with OR
I am doing a practise SQL injection in a search field and I don't understand the logic of what is happening.
The following behaviours is what I noticed:
Entering ' OR '1' = '1 shows all the results.
...
2
votes
0answers
74 views
How can an attacker use SQL injection in ALTER query?/What can an attacker do with an injectable ALTER statement? [closed]
Let's say you have a Java app which has a query which can unlock/reset passwords for users like:
ALTER USER " + iD_Of_User.toUpperCase() + " IDENTIFIED BY " + password_Of_User + " ACCOUNT UNLOCK
...
2
votes
3answers
92 views
How can a restricted window for sql injections be abused?
I have a postgres 11 database with no confidential information in it and in the application an intruder can write queries inside the following update statement.
UPDATE table
SET col_a = val_b
WHERE {...
2
votes
2answers
142 views
Allowing users to input raw SQL in update statement safely
I'm building an application and I have some very, very advanced users who can come up with endless filters they want. They know SQL so in the end gave them some of the filters and said in the bottom ...
2
votes
1answer
108 views
How exactly works this SQL injection example related to the DVWA application?
I am a software developer converting do application security and I have some doubts about SQL injection example.
I am following a tutorial related the famous DVWA: http://www.dvwa.co.uk/
So I have ...
8
votes
1answer
562 views
Some doubts about SQL Injection examples, how exactly works?
I am a software developer starting studying application security and I have the following doubt related SQL injection.
I am following a video course and there are these two examples:
I have an ...
1
vote
1answer
108 views
Replaced single quote bypass for SQLi
I have this scenario on my lab. HTTP POST login form on a IIS server. ASP backend using MSSQL database, and a single simple query as this:
sql="SELECT * FROM USERS_TABLE WHERE USER='" & user &...
2
votes
1answer
282 views
Server returns 403 when I try SQL injection
I am trying to pentest my friend's site. It is clearly vulnerable to SQL injection attack based on the error messages I get from entering different get parameters.
Whenever I try very simple attacks ...
0
votes
2answers
304 views
How do you perform SQL injection on a login form that checks for email address format?
A recent employment test prompted me to perform an SQL injection to gain access into their website.
Using manual and automated (Burp) methods, I was able to find out the form is definitely vulnerable ...
2
votes
1answer
54 views
bypassing metacharacter filtering
So I am trying to bypass metacharacter filtering.
I want to know how do you start an injection. For example if the ' is filtered how do you begin the input.
If i did ' or 1=1# without filtering it ...
1
vote
0answers
85 views
Bypass prepared statements?
I know that prepared statements are used to handle input at the front end. However I was wondering how do you bypass a prepared statement? I have seen some people talk about string concentration but I’...
1
vote
1answer
98 views
Use a WHERE clause that's stored in a table?
Background:
I have a workorder management system (WMS).
The WMS has functionality that allows users to save queries.
The queries are saved in a database table called QUERY (in a CLAUSE column).
An ...
2
votes
2answers
156 views
How does this SQLi statement work?
Hey i'm trying the hacker101 CTF's im still pretty new at this stuff
The CTF answer to the flag i'm trying to understand is https://github.com/testerting/hacker101-ctf/tree/master/micro-cms_v2/flag0
...
0
votes
1answer
78 views
is sending SQL query operators in HTTP GET requests is some kind of security issue? [duplicate]
Our webserver is forwarding HTTP GET request to application server as below including a statement or condition like "AND 1=1", our Palo Alto Firewall detecting this traffic as SQL Injection alert.
...
0
votes
1answer
131 views
Sql Injection ByPass problem [closed]
I don't know what if part of this command does.
FROM table
WHERE id = 1
AND IF(( Ascii(Lower(Substring((SELECT User()), $i, 1))) ) != $s, 1,
Benchmark(200000, Md5(Now()))) ...
5
votes
0answers
112 views
The login page I'm testing lets me in as long as the username starts with the right name. How could the SQL query be made?
Let's say my username is theusername and my password is thepassword. If use those credentials I login as expected. However if I add whatever at the END of the username, say theusername.random.stuff.at....
0
votes
1answer
51 views
what can you do in sql login details and encryption key is available
I am practicing pen testing in a protected box and I have a vulnerable Magento website and I managed to get its MySQL config file which is app/etc/local.xml.
In this file there is information such as:...
2
votes
2answers
126 views
SQL injection with UNION and two queries with same input
Say there are two queries, which are called after each other: one to get the amount datasets in the table, one to get the result of the actual query:
select count(*) as total from table_a where ...
2
votes
0answers
142 views
how to get shell from blind sql injection? [closed]
I'm trying to gain access to a web server after I found blind SQLi on the website. I used sqlmap to automate things.
I can read the databases and tables. tried to find a way to get a shell from SQL ...
1
vote
1answer
64 views
Can Blind SQL/Boolean Based SQL Injections not contain break characters or comparisons?
I'm using a scanner which passes subtraction attack traffic such as (1-1), (3-2), (5-2), etc. There are no break or continuation characters such as semicolons or &&, nor is there a comparison ...
-1
votes
3answers
262 views
Is a web application firewall enough to defend against sql injection? or should I use prepared statements?
Is it enough to rely on a web application firewall for protection against SQL injection? or should I use other techniques?
During a conversation with a friend he said it is enough to use web ...
4
votes
3answers
207 views
What is the risk of an attacker inserting new password hashes?
The normal threat model that I see with password hashing is as a kind of defense against if the hash somehow leaks to the wider world. In practice, this appears to usually be via some manner of ...
1
vote
1answer
242 views
Is sql injection possible on this websocket?
I was testing a websocket when i found an add to cart request like the following
["{\"ITEMS\":{\"ITEM\":[{\"package_id\":\"123\",\"customer_type\":\"3\",\"qty\":1,\"}"]
I tried to edit the value of ...
0
votes
1answer
168 views
How does this NoSQL injection work? [closed]
Could someone explain what this is doing and how it works? I already know about SQL injection but the NoSQL is confusing.
This is a lecture slide from my professor but he provides very little context....
0
votes
1answer
44 views
Character filtration in globalisation supported application
I am working on building an application which will be used in various language , to secure from attacks like xss, SQL injection I thought implementing character filteration (whitelisting/blacking) but ...
0
votes
0answers
164 views
SQL Injection bypass UNION filter/restriciton
I've recently had an interesting interview exercise I haven't completed and it does puzzle me what kind of filter/protection they've used.
The vuln app is a PHP with simple MariaDB (5.5.56) back-end, ...
-1
votes
1answer
74 views
mysql_query | Why " breaks query but ' does not?
I ran across an opportunity for SQL injection the other day in some legacy code ...
// input: email@email.com"
$email = $_POST['email'];
mysql_query('SELECT * FROM users WHERE email = "'.$email.'" ');...
1
vote
1answer
80 views
Exploiting incorrectly escaped `mysql_query() or die(mysql_error())` to exfiltrate data?
I ran across some legacy code that uses mysql_query($sql) or die(mysql_error())
Was curious and noticed that with a correctly placed " in the email input ... I am shown output from mysql_error() as a ...
1
vote
2answers
120 views
Is there any way to find all the endpoints for any website for sql injection? [closed]
I'm wondering, if it's possible to discover all the endpoints for any product which is prone to SQL injection.
I want all the endpoints where I can apply SQL injection on my site.
2
votes
1answer
163 views
What security implications are involved when using a CSV file to fill a SQL table?
I have some data on CSV files and I want automate the input of this data into an SQL database using Powershell. The data is mostly, if not completely, numbers.
I am using a script based on the one ...
3
votes
2answers
200 views
Mysql injection with a single `USE` statement
I know you need prepared statements and such to avoid SQL injection, and I've seen that there are different questions about exploits for SELECT, INSERT, UPDATE injectable queries.
But I couldn't come ...
1
vote
1answer
88 views
Is emulated SQL query preparation less secure?
I have been looking at PDO attributes, specifically at resources (some are linked at the end of this post) saying that emulated query preparation is less secure than using real prepared statements, ...
1
vote
0answers
167 views
how to create random request time delay in sqlmap?
How can i configure sql-map to try payloads at random time delay?
as an example time between first and second request can be 0.10s and second and third might 0.25 and so on.
i know there is --delay ...
1
vote
1answer
35 views
How to input generic type or determine data types for selected values in UNION ALL SQL injection attack?
I've determined that the application is vulnerable to SQL injection and the proper amount of values to SELECT in the corresponding UNION ALL query:
foo' UNION ALL SELECT '1','1','1','1','1','1','1','...
2
votes
1answer
128 views
Why do I need an space at the end for this SQL Injection to work?
This is the vulnerable code:
$order = isset($_GET["order{$i}"]) ? $_GET["order{$i}"] : '';
if (stripos($order, 'benchmark') !== false) die;
${"result$i"} = $db->query("SELECT * FROM {$tables[$i]} "...
1
vote
1answer
87 views
What kinds of attacks are possible with credentials to a read-only Postgres user?
Assuming I implement the literal SQL-injection on an HTTP endpoint with a read-only user that limits execution time to e.g. some amount of seconds. What's the worst that could happen? I know simple ...
0
votes
1answer
130 views
Securing a website for my school project [closed]
I have been given a task to secure a website which will be done by my group mates, but I have no clue. Could someone give my ideas? and how I am going to protect? what code can I use to secure login ...
11
votes
2answers
726 views
Understanding SQLMAP payload
I was participating in a CTF and there was a SQL Injection challenge. There is a Wordpress page with a vulnerable plugin parameter (let's call the website https://vulnerable.com/), and the solution ...
3
votes
1answer
84 views
Security concerns in disseminating database design?
I work for a government agency, and we've been requested via a freedom of information request for the layout of the tables of one of our systems, a data dictionary and schema design request.
What are ...
0
votes
0answers
278 views
How to send file with SQLMap
Note: this is a challenge in a past CTF.
There is a webapp where you can submit an image that contains some text and the app will run an OCR and search for the text in a database. The app is ...
0
votes
0answers
298 views
Boolean blind SQLi with sqlmap
I am trying to run sqlmap in order to find a flag for a CTF. The injection string is sent via a POST request in the parameter called search. The response is received as either 1, 2, or 3 (error codes),...
-1
votes
1answer
741 views
SQLI Login Bypass Cheat-sheets Question [duplicate]
Assuming you are authorized to pentest a live website that's login page is vulnerable to SQL Injection.
Lets say your backpack has only 2 crafted queries by you which is admin' -- and '=' 'OR'.
Your ...
