Questions tagged [sql-injection]
SQL injection is a technique used to take advantage of vulnerabilities arising from non-validated input on web applications to pass SQL commands through for execution on a backend database.
834
questions
0
votes
1answer
11 views
SQLinjection prevention: parser + blacklist?
I know the best way to prevent SQL-injection is parameterized queries. But this is not possible in the specific use case because the client has to be able to input SQL statements directly.
So what my ...
0
votes
0answers
58 views
Is that SQL query exploitable for really malicious things
I have following SQL query in my WordPress plugin,
SELECT `ID`, `post_content`
FROM `wp_posts`
WHERE `post_type` = 'movie'
AND `post_status` = 'publish'
OR `post_status` = 'private'
AND `ID` NOT ...
1
vote
2answers
53 views
Is union based mysql injection able to read files outside database?
Can files outside database which are not part of any tables in database be read via union based SQL injection? For eg
http://xyz.com/fetch?id=3
Consider id parameter is used at server side by cursor ...
2
votes
2answers
81 views
SQL injection using brute force?
I am studying about cyber defense lately for fun and found about a proposed method that as I understand it performs automated SQL injection using brute force by training a model. At some point it says ...
0
votes
1answer
61 views
Does Injection Attack Against SQL Server Require Semicolon or Comment?
In creating a blacklist function as part of our multi-pronged defense against SQL injection that includes parameterized queries and validating for length and type of input, we are creating a Blacklist ...
1
vote
0answers
47 views
When using parameterized SQL queries, is there still any *security* issue with simply blindly accepting user input variables?
Suppose I have this:
parameterized_database_call('SELECT * FROM widgets WHERE id = $1', $_GET['widget_id']);
The SQL query is parameterized, as I've done for many years now. (I'm trying to repress ...
0
votes
0answers
50 views
SQL Injection Training challenge including a PHP file
I’m currently trying to get some knowledge in SQL injection. In a pen test environment, there is a challenge on which you get the PHP file and you need to try to login using SQL Injection. I’ve ...
0
votes
1answer
38 views
SQLi Filter Bypass with banned table/column names
I've studying and practicing different approach to SQLi filter bypass and I faced a challenge. What if the WAF filters look for specific strings rather than SQL keywords?
Example:
Filter: /UNION/
SQLi:...
1
vote
2answers
181 views
What is this attack? id=1'[0]
I'm frequently getting these weird URLs.
https://mywebsite.com/mymage.php?id=1'[0]
The weird part is '[0].
The webpage pass the id to the database and the database expect an integer so we are ...
0
votes
0answers
71 views
Error Based SQL Injection
I have a MySQL lab challenge where I send id=1‘ and select @@version;# then manage to trigger an error. But the part of the error response that has my version info looks like it comes back in binary (...
0
votes
0answers
80 views
Understanding sqlmap's payload for blind sql injection
I am fairly new to sql injections and tried to solve a little hackit to understand everything better. I wasn't able to solve one of the levels so I ran sqlmap to see what it would do. The payloads ...
0
votes
1answer
50 views
Can attack to a website from a parked subdomain with different hosts?
I have a website like maindomain.com that hosted on a different hosting like 192.168.1.1 i want to add a subdomain from a different host like 192.168.1.2 to my main domain which my address will be ...
0
votes
2answers
136 views
SQL injection without the use of union and select
I was wondering if there is a way to use SELECT and UNION keywords without being caught by a algorithm (see below) that filters these keywords out.
$filter = array('UNION', 'SELECT');
// Remove ...
0
votes
1answer
59 views
Trying to do an SQL injection into a login field [closed]
I have an assignment to make an SQL injection - I found a login field that spits out an error, but I can't seem to make queries work inside of it. For your information it's an Mysql server. What is ...
0
votes
1answer
100 views
SQL Injection and Hidden parameter modification
A friend of mine gave me a web application for me to test and find vulnerabilities. He told me that this web application can be purposefully modified and then made to run an SQL injection. I have ...
0
votes
0answers
71 views
Execute sqlmap in a javaScript object cookie
I am studying sqli and I found a blind sqli vulnerability in a cookie and I have exploited manually, however, I would like to detect and exploit it with sqlmap.
Cookie looks like javascript object ...
1
vote
1answer
128 views
Blind SQL injection in sort direction
I have an SQL injection in a query where I control the sort direction parameter i.e: SELECT * from x where y=y ORDER BY COLUMN_NAME [SORT_DIRECTION]
When I control the SORT_DIRECTION, which is ...
0
votes
2answers
359 views
Never use stored session in sqlmap
I am trying to make sqlmap to avoid fetch data from stored session. How do I achieve that? I have performed sqlmap check once on a target and now that target is offline, I want sqlmap to just stop the ...
-1
votes
1answer
113 views
How to continue performing checks on a site if sqlmap found an issue on a URL of the same site while using --batch option?
I have a file /tmp/urls which has following URLs:
http://127.0.0.1:8081/?id=1
http://127.0.0.1:8081/?id2=1
I am using this command to perform checks on file URLs concurrently:
python3 sqlmap.py --...
0
votes
1answer
66 views
How can I build a simple website that contains SQL injection vulnerabilities? [closed]
How can I build a simple website that contains SQL injection vulnerabilities for study purposes? What do I need to learn?
2
votes
2answers
109 views
How can I carry out SQL insert injection when there's a select statement beforehand
So here's the deal. I've been working on an SQL injection challenge and here's what comes up.
There's a registration page where you input your Username, password and confirm password. It's vulnerable ...
0
votes
0answers
35 views
SQL File Privilege
I have a question about SQL File privilege. Recently, I found SQL injection vulnerability for user who had FILE privilege and I used sqlmap to get some interesting files. And I was wondering, how this ...
0
votes
1answer
74 views
Extracting data from db with time based SQL injections
SCENARIO:
a vulnerable login form. I say vulnerable because if I enter +select(sleep(0))+ the server response normally. If I enter +select(sleep(5))+ the server wait for a period of time greater than ...
1
vote
0answers
95 views
SQLinjection in SQLite: How to select a column with whitespace without use it?
So, I'm trying to do a SQL injection in a ctf application that removes all whitespace in form parameters, so I can't use it. To perform my query I used /**/ to insert whitespace and I could perform ...
0
votes
0answers
49 views
SQL Injection Doesn't Sanitize But Doesn't Execute Commands
I am currently doing a pentesting on a web application and focusing more on SQL Injection. This company I am pentesting have a functionality in which we are allowed to buy things from the vendors/...
0
votes
1answer
116 views
Is it possible to locate web document root using SQL query/SQL Injection?
I have access to MySQL database which the current user has FILE privilege. I want to upload a web shell but I do not know the root directory of the web server.
Is it possible to somehow locate the ...
1
vote
1answer
130 views
Why intruder number of threads has an effect on the time delay of indiviual requests
I was solving SQL injection lab on Portswigger, and the lab was asking to exploit blind SQL injection by triggering time delays, using that to retrieve administrator password.
I was making 720 ...
0
votes
1answer
207 views
Understanding sqlite3 sanitization in python
I use sqlite3 for my database and get data from untrusted source with
flask.request.get()
I insert all data with such syntax
c.execute("INSERT INTO table (e1, e2) VALUES(?, ?)", (V1, V2))
...
0
votes
1answer
77 views
Virus / malware stored inside database
I have a small network of several Windows 10 machines (all protected by BitDefender 2020 Total Security), one of which acts as server with Firebird database.
For some time the database is ...
-1
votes
2answers
106 views
Can someone Inject malicious SQL to my SQL query? [closed]
I build a simple chat with MySQL. It has a table called users and two colums: id and username. I use the following query to extract username and ID by ID.
Is there a way someone can Inject malicios ...
0
votes
2answers
357 views
sqlmap won't give me results i'm looking for [closed]
I am trying to use sqlmap. Although every time I use it, I just get a response of:
[13:39:11] [CRITICAL] previous heuristics detected that the target is protected by some kind of WAF/IPS
[13:39:11] [...
0
votes
1answer
163 views
SQLMap Only Returns information_schema
I run this command python sqlmap.py -u https://acme.com/post.php --data "id=1" --tamper="between,randomcase,space2comment" -v 3 --random-agent --dbs but SQLMap only returns ...
0
votes
1answer
172 views
PostgreSQL injection with basic sanitization
I'm trying to figure out if an SQLi for the following PostgreSQL/Java code exists.
public void availableItems(String name) {
return this.query("SELECT * FROM items WHERE name='"+name+"...
0
votes
0answers
214 views
Sqlmap not detects error based injection
I am working on Hack the VM (hard machine) for my OSCP preparation
There is a web app with two drop down boxes.. Year and month.. both contain numbers and a submit to fetch data from DB based on year ...
0
votes
1answer
67 views
sql injection mitigation by signed db entries?
In a php/mysql based system I work on, they recently found several SQL injection vulnerabilities. Those come from 3rd party plugins, and I must assume there are more to be discovered.
My major concern ...
0
votes
0answers
21 views
.php code in .txt file with eval() function [duplicate]
I have found three files with name as below:
a.phpfile.txt
b.phpfile.txt
c.phpfile.txt
when i open, each file contained with the following code:
<?php @eval($_POST[x]);
I have deleted all ...
1
vote
1answer
306 views
ORDER BY sort direction is exploitable in SQL Injection?
I am testing an internal application and come across a page where if I am able to make the application display a SQL error because it does not recognize the payload for ORDER BY sort direction. The ...
0
votes
1answer
138 views
How can I write a function that will log a user in an old system without knowing any username or password? [closed]
I'm studying Internet Security and I learned something about code injection in older websites (using the string ' OR 1 == 1 // as a username will log in with any password provided); but what if a ...
0
votes
1answer
82 views
How to best limit SQL injection attacks that are being funneled through an Apache proxy I control
I use an Apache proxy to funnel traffic to an IIS server. The IIS server sends me emails if some bad actor attacks my site with an sql injection attack. It captures their IP address, and sends me the ...
0
votes
0answers
87 views
SQLmap automation
I'm automating SQL injection using sqlmap. Is there someone who managed to parse sqlmap console output to only report critical findings (vulnerable pages to SQL injection)?
The tool doesn't support ...
1
vote
1answer
83 views
Multi-byte character exploit
I read this answer, It explains how a multi-byte character exploit works in a decent way, the only way I could think of avoiding this problem is whitelisting all single-byte characters because of the ...
0
votes
1answer
93 views
Having problems with SQL injection with mysqli extension PHP
I am new to SQL injections, and people on Reddit asked me do the portswigger labs. Which I did up till before 2nd order ones. So I am pretty comfortable with usual SQL injections.
Now I have myself ...
0
votes
0answers
284 views
Sqlmap waf bypass
This is my first post here, sorry for my english.
Im making some test around, because i want to learn more about sql injection. Im not really good as manual sql injection, so im using sqlmap.
what ...
0
votes
1answer
472 views
SQLmap finds injectable 'id' parameter but the response is 'Internal Server Error'
I am trying to understand the SQLi so I ran SQLMap with '-vvv' parameter
4: Show also HTTP requests.
I did scan one of the vulnerable and 'free to hack' sites.
In one of the requests sent, the ...
1
vote
0answers
124 views
What type of attack is this? '[0]
This is the example query: GET directory/file.txt?lang=it'[0] HTTP/1.1
I don't know what language it is. The ' (single quote) reminds me of a SQL Injection.
I don't think it's a typo because I saw ...
0
votes
1answer
146 views
How to find vulnerable PHP parameter such as `.php?id=` as found in Kioptrix 3?
This is part of my preparation for OSCP.
According to https://www.vulnhub.com/entry/kioptrix-level-12-3,24/, Kioptrix 3 is vulnerable to SQL Injection.
However, I found that SQLi challenge on ...
1
vote
2answers
120 views
Develop and test a vulnerable login system
I'm a beginner on course to be an expert (hopefully) and I've been set assignments to test security systems on the web. The whole assignment is to prepare, test and document the results to correlate ...
1
vote
1answer
48 views
How do SRP (and PAKE generally) protect against verifier leak
I have been reading into PAKE protocols, specifically starting with SRP RFC2945
The gist of the requirement on the server is that the server saves triplet (username, verifier (v), salt (s)) in the ...
0
votes
2answers
231 views
In SQL injection why don't we use OR 1 or OR 2>1 instead of OR 1=1?
I read everywhere regarding SQL injection where it is said that if SQL query is:
SELECT * FROM table_name where username='xxxxx' AND password ='xxxx'
and if you want to enter always true condition ...
0
votes
1answer
185 views
SQL injection and XSS prevention
I would kindly ask you to review the following code and tell me if it's enough to prevent most of SQL injection and XSS attacks.
SQL injection: treated via PDO prepared statements;
XSS: All user's ...
