Questions tagged [sql-injection]
SQL injection is a technique used to take advantage of vulnerabilities arising from non-validated input on web applications to pass SQL commands through for execution on a backend database.
0
votes
1answer
45 views
SqlDateTime overflow.. Will this cause any issues ? is any kind of hacking or bypassing age restriction is possible in this case? [on hold]
We have a website with age restriction. If a user want to register in our website, user must be 18 years old.As i know there is validation at client and server side ?
When i tried to register in our ...
1
vote
1answer
80 views
SQL injection with an auto-incrementing parameter
I'm currently performing an API Pentest and I suspect an SQLi in one of the API calls. It updates a certain item of the web-service and requires an increase of the version number for each request.
...
0
votes
0answers
40 views
how to resume sqlmap from session sqlite
I was not able to find a way to resume sqlmap from session.sqlite file. I tried to use their given commands but I think I am using it wrongly. Can anybody tell me the correct way to resume sessions in ...
0
votes
0answers
23 views
Load_file() with Blind boolean based sql injection, is this possible?
As in the title, is it possible to do load_file in boolean based sql injections just like in regular "union select" injections? if so then how?
Thanks in advance.
0
votes
0answers
34 views
Modsecurity SQLI rules not checking REQUEST_URI?
recently I integrated Modsecurity 3 + OWASP CRS into our NGINX loadbalancer. I ran it in DetectionOnly mode for a while, added some exclusions and then switched it on.
The last few days we got 10.000+...
0
votes
0answers
32 views
SQLi : How to extract Info about tables if the user doesn't have access to Information_Schema and Mysql.user?
So lets say you got the access to a database using SQLi, (get method)
the problem here is that this 'database user' has no access to Information_Schema or mysql.user to learn about the table names ...
2
votes
0answers
42 views
SQLmap on Login. Expect 401 reponse
I'm using sqlmap to test a login. When using invalid credentials, the webserver sends back a 401 response. However, sqlmap interprets this response as I'm not authorized to call this page and needs ...
2
votes
1answer
72 views
SQL injection on PostgreSQL in integer field?
I was trying https://server/shared/sendemail?sendto=" and got this response:
Database operation "0or1row" failed
(exception ERROR, "ERROR: invalid input syntax for integer:"""
LINE 4: where user_id ...
27
votes
1answer
7k views
Why should we sometimes use --+ instead of — in SQL injection to comment the rest of the query?
I have encountered some websites that when I used -- to comment the rest of the query it didn't work, but when I tried --+ it worked.
In the MySQL official documentation there is no such thing as --+ ...
0
votes
2answers
90 views
Blind SQL Injection on Amazon RDS
I found a vulnerability which allows me to run any query on an Amazon RDS server. I was able to extract the user hashes by using the --passwords parameter of sqlmap, and one of the hashes was cracked ...
0
votes
3answers
166 views
Is SQL-injection a client-side or a server-side attack?
What type of attack is SQL-injection? I am confused because this type of attack is done through the client-side. However, the attackers target is a database which is "behind" a server. Most attacks ...
0
votes
0answers
51 views
Multiple records created after running SQL injections
I tried running this SQL injection via SQLMap:
sqlmap -r /root/MyProject/text_file -p "textfield1, textfield2" --tamper=space2comment --level=5 --risk=3
text_file is a burpsuite generated text file ...
1
vote
2answers
132 views
Is SQL Injection possible in String Concatenation When all Variables are created by the Program
Say I have a program that returns some date strings from a function in javascript.
function getDates()
{
var yesterday = [some code that gets current time with yesterday's date];
var today = [...
0
votes
0answers
34 views
Enumerate values of database column via error based SQL-injection?
I was reading about SQL-injection in SQL Server and I saw a technique that allows me to show any information from database via errors.
Assume this is the vulnerable site:
example.com/showproducts....
0
votes
1answer
67 views
Running sqlmap against a parameter inside a parameter
I have a domain in the format: example.com?host=http://anotherexample.com?bar=1
I want to attack the "bar" param, but sqlmap (correctly) parses the second url as a value of the foo param. Therefore I ...
0
votes
0answers
60 views
sqlmap: Upload file to get UUID to submit with main request?
I've been looking for a way to use sqlmap with a file-upload form that, when submitted, first uploads the given file to get back a UUID, which is then send along with the user information in another ...
-2
votes
2answers
253 views
What file types might be vulnerable to SQL injection? [closed]
I am learning about SQL injection and Google dorks. I have seen that there are three file types that can be vulnerable to SQL injection, .php, .aspx and one more.
I can't find the third one... The ...
0
votes
0answers
50 views
preg_replace() bypassing [duplicate]
so i was googling some web CTF's to play, and i've found a one with preg_replace() filtering in the login page.
$name = preg_replace('/\'/', '', $name);
$pass = preg_replace('/\'/', '', $pass);
$...
0
votes
2answers
105 views
Php parameters (username, password) in link
Little Info: I am not a web developer, I am a beginner to php and sql. Trying to learn in my free time.
I was examining a web site on a remote server and i saw something like;
www.myurl.com/login....
0
votes
3answers
388 views
Is SQL injection still a thing? [duplicate]
I was wondering whether SQL injection is still a thing or if it is mainly extinct due to the fact that I don't hear about corporations being hit by this vulnerability, And the last time I heard an ...
0
votes
1answer
175 views
bWAPP- SQL injection Hack displays a white screen?
I've been following this video(https://www.youtube.com/watch?v=XDCZ8FC856s) to install bWAPP on Parrot OS and everything works fine except SQL Injection. I've checked the database and its active. As ...
1
vote
1answer
121 views
Is this parameter vulnerable to SQL Injection?
The backend server is running Tomcat 8.5 (Java backend). The URL in question is:
https://website.com/application/servlet.do?currentOID=abc12300000000
I found that when I give an incomplete OID (i.e ...
0
votes
1answer
183 views
How this Unique SQL injection works?
I found a challenge which was vulnerable to SQL injection and it was very very pretty hard to find So, How this unique SQL works?
I found this on login form where when I send user=\&pass=||1# as ...
0
votes
1answer
205 views
How to use custom injection in sqlmap?
This is post data, normally looks like this
{"end_date":"2018-8-26","start_date":"2018-8-26","success":1}
Below resulting "You have an error ..."
{"end_date":"2018-8-26'","start_date":"2018-8-26","...
1
vote
1answer
169 views
The role of Machine Learning In Cybersecurity Defense [closed]
Hackers and malware are one step ahead of cybersecurity experts, and every time technology is released to the market, vulnerabilities will be quickly discovered and exploited.
How effective can ...
0
votes
1answer
132 views
I'm not sure if this Website is SQL Injectable
I think I found an SQL vulnerability; the request and response can be found below. I'm not sure because it is showing a normal error (it's in French) instead of showing an SQL error.
I also tried to ...
0
votes
1answer
129 views
Is it SQL Injection Vuln? [closed]
Today my friend asking help to test and prevent his website from sql injection..
After i tried basic sql injection like 1 OR 1=1, ' OR 1--',' '1'='1 There is no mysql error displayed..
But After i ...
1
vote
1answer
35 views
Single quotes ' not sanitized
I'm trying to find security issues on my friend's site.
There is an input box for subscription. I can enter my email address:
Henry<IMG SRC=# onmouseover="alert('xxs')">@gmail.com
After ...
0
votes
0answers
120 views
How to use binary search for blind SQL injection queries
From what I read online, it's possible to apply binary search to exploit blind SQL injection vulnerabilities, and that is probably what tools like sqlmap use to lower the number of queries that need ...
3
votes
1answer
317 views
False positive SQL Injection by ZAP with adding new parameter query
I have a spring MVC web application and am running ZAP Active scan on it.
I noticed that ZAP will modify URL , and add additional parameter named query and value query+AND+1%3D1+--+ to test SQL ...
0
votes
3answers
554 views
SQL Injection on POST JSON request
I have a web application vulnerable to SQL injections. I'm using BurpSuite to intercept the requests. More specifically, the data variable below is vulnerable. I added my own data to aggregates and ...
0
votes
1answer
59 views
Possibility of SQL injection by static or predefined values
Using direct variables is vulnerable to sql injection. So to prevent attacks we use parameters.
$result->bindParam(":id",$_POST['id'],PDO::PARAM_INT)
but I am confused regarding the following ...
0
votes
2answers
185 views
Using single or double quotes to prevent XSS and SQLi?
Why it is recommended to put single or double quotes around HTML attribute values? It is recommended to prevent XSS, but why?
Same goes for SQL injection: It is recommended to use single or double ...
0
votes
0answers
165 views
From SQL Injection in SQLite to shell
I need to obtain a shell from an SQL injection over an application with sqlite database.
Currently my exploit looks like the following:
lucian@0x90:~/$ proxychains nc 10.185.10.55 1101
ProxyChains-3....
0
votes
1answer
188 views
Can an ampersand (&) be used in SQL injection?
With SQL Server, does the ampersand pose as a threat related to SQL injection? I'm working on a project that includes this as a blacklisted character. I'm aware that there's a threat related to Oracle ...
0
votes
0answers
18 views
Replacing single quote with double single quote (SQL Injection sanitation) [duplicate]
Let's say I want to sql inject into a site, and the textbox is for my name. My name is U'ser Smith. The code is handling the single quote by replacing any instance of ' with '' on the users input only....
1
vote
0answers
200 views
SQLmap error (what happen if i have no parameters)
I have an error when I use sqlmap. The problem is: I use this dork https://www.exploit-db.com/ghdb/4301/
but I do not know how to use sqlmap with this type of sql injection.
I use the classic:
...
0
votes
4answers
137 views
Is it possible to verify if a website is vulnerable to SQLi by viewing its source code?
I've heard the eval() function is vulnerable to SQLi.
Can I check for vulnerabilities by simply viewing the website source code?
1
vote
0answers
66 views
SQL Injection in a simple form [closed]
There is a form that I'm trying to crack it. It has two fields: username & password.
When I enter 1'; WAITFOR DELAY '00:00:15' -- in username, it tries to load for about 40 seconds, then it shows ...
1
vote
2answers
411 views
DVWA: “Hacking attempt detected…”
Hello and good evening,
i've recently tried to improve my pentesting skills and learn more about it with metasploitable 2. I am trying some things on the DVWA.
For the moment, i am learning the ...
0
votes
2answers
298 views
SQL Injection : How to begin when the id parameter value is not numeric
I am learning SQL injection currently and I feel I am quite comfortable doing Basic SQL injection. I am learning it by solving online challenges and so far I have only come across situations where the ...
-1
votes
1answer
133 views
Attempting SQLi against website with WAF filter [closed]
I was pentesting a website when I discovered that the URL included the id parameter. Because of this, I knew that the id parameter might be vulnerable to SQLi. I received a 200 response and found no ...
0
votes
1answer
130 views
can a token be used for sql injection
I have a token that is restricted to read only access.
If someone obtains that token, can they use it to do a sql injection attack?
Given that the token is permissioned for read only, can someone ...
1
vote
1answer
53 views
Is the hosting OS safe to sql injection hackers by hiding admin ID?
We are 1-3 guys maintaining a fairly large but clumsy developed-in-house website. With around 900+ mysql tables, and a lot of data access code in PHP. Let's say it is huge amount of code for just 1 or ...
13
votes
6answers
8k views
What pages are vulnerable to SQL injection?
I believe I understand the basics of SQL injection. I also know using prepared statements with PHP files is the best way to prevent SQL injection. I was always told that SQL injection happens most ...
0
votes
1answer
325 views
Can website get hacked by iframe injection?
My website has been hacked. I am observing how hacker accesses my site. Though I have been using bindparam to prevent from sql injection and direct access restriction for backdoor attack, hacker's ...
3
votes
2answers
122 views
Is it plausible to enforce authorisation on SQL generated from “Client-side”?
Background
We know that SQL Injection (OWASP Top 10) is the most prevalent security vulnerability on websites today. The strategies for mitigating the risk are well known. But are these only ...
2
votes
1answer
287 views
Impact of SQL injection on SELECT statement
During a routine penetration test I encountered a possibility for SQL injection. The following criteria apply:
Microsoft SQL Server (2016);
Query has to start with SELECT;
The semicolon ; is not ...
1
vote
1answer
65 views
Using a transaction as mitigation against SQL injection
Considering a generic stored procedure that is subject to SQL injection:
CREATE PROC usp_badproc
@sql NVARCHAR(8000)
AS BEGIN
EXEC(@sql)
END
and operating under the assumptions that
the ...
1
vote
0answers
265 views
is it possible to insert data using sql injection in select statement?
First of all i am testing it on my server for learning purpose.
The condition here is i want to insert a entry in test table in database and
SELECT * FROM `student` WHERE `name` LIKE '% ".$name." %';...
