Questions tagged [sql-injection]

SQL injection is a technique used to take advantage of vulnerabilities arising from non-validated input on web applications to pass SQL commands through for execution on a backend database.

Filter by
Sorted by
Tagged with
0
votes
1answer
54 views

Virus / malware stored inside database

I have a small network of several Windows 10 machines (all protected by BitDefender 2020 Total Security), one of which acts as server with Firebird database. For some time the database is ...
-1
votes
2answers
85 views

Can someone Inject malicious SQL to my SQL query?

I build a simple chat with MySQL. It has a table called users and two colums: id and username. I use the following query to extract username and ID by ID. Is there a way someone can Inject malicios ...
0
votes
2answers
60 views

sqlmap won't give me results i'm looking for [closed]

I am trying to use sqlmap. Although every time I use it, I just get a response of: [13:39:11] [CRITICAL] previous heuristics detected that the target is protected by some kind of WAF/IPS [13:39:11] [...
-1
votes
0answers
23 views

Is CodeIgniter 4 secure? [closed]

I am start using codeigniter 4. Codeigniter Model and query builder using escape. codeigniter will automitically escape all data before enter database. They are not use prepared statement for query ...
0
votes
1answer
44 views

SQLMap Only Returns information_schema

I run this command python sqlmap.py -u https://acme.com/post.php --data "id=1" --tamper="between,randomcase,space2comment" -v 3 --random-agent --dbs but SQLMap only returns ...
0
votes
1answer
59 views

PostgreSQL injection with basic sanitization

I'm trying to figure out if an SQLi for the following PostgreSQL/Java code exists. public void availableItems(String name) { return this.query("SELECT * FROM items WHERE name='"+name+"...
0
votes
0answers
45 views

Sqlmap not detects error based injection

I am working on Hack the VM (hard machine) for my OSCP preparation There is a web app with two drop down boxes.. Year and month.. both contain numbers and a submit to fetch data from DB based on year ...
0
votes
1answer
56 views

sql injection mitigation by signed db entries?

In a php/mysql based system I work on, they recently found several SQL injection vulnerabilities. Those come from 3rd party plugins, and I must assume there are more to be discovered. My major concern ...
0
votes
0answers
19 views

.php code in .txt file with eval() function [duplicate]

I have found three files with name as below: a.phpfile.txt b.phpfile.txt c.phpfile.txt when i open, each file contained with the following code: <?php @eval($_POST[x]); I have deleted all ...
1
vote
1answer
93 views

ORDER BY sort direction is exploitable in SQL Injection?

I am testing an internal application and come across a page where if I am able to make the application display a SQL error because it does not recognize the payload for ORDER BY sort direction. The ...
0
votes
1answer
114 views

How can I write a function that will log a user in an old system without knowing any username or password? [closed]

I'm studying Internet Security and I learned something about code injection in older websites (using the string ' OR 1 == 1 // as a username will log in with any password provided); but what if a ...
0
votes
1answer
57 views

How to best limit SQL injection attacks that are being funneled through an Apache proxy I control

I use an Apache proxy to funnel traffic to an IIS server. The IIS server sends me emails if some bad actor attacks my site with an sql injection attack. It captures their IP address, and sends me the ...
0
votes
0answers
49 views

SQLmap automation

I'm automating SQL injection using sqlmap. Is there someone who managed to parse sqlmap console output to only report critical findings (vulnerable pages to SQL injection)? The tool doesn't support ...
1
vote
1answer
68 views

Multi-byte character exploit

I read this answer, It explains how a multi-byte character exploit works in a decent way, the only way I could think of avoiding this problem is whitelisting all single-byte characters because of the ...
0
votes
1answer
69 views

Having problems with SQL injection with mysqli extension PHP

I am new to SQL injections, and people on Reddit asked me do the portswigger labs. Which I did up till before 2nd order ones. So I am pretty comfortable with usual SQL injections. Now I have myself ...
0
votes
0answers
69 views

Sqlmap waf bypass

This is my first post here, sorry for my english. Im making some test around, because i want to learn more about sql injection. Im not really good as manual sql injection, so im using sqlmap. what ...
0
votes
1answer
58 views

SQLmap finds injectable 'id' parameter but the response is 'Internal Server Error'

I am trying to understand the SQLi so I ran SQLMap with '-vvv' parameter 4: Show also HTTP requests. I did scan one of the vulnerable and 'free to hack' sites. In one of the requests sent, the ...
0
votes
0answers
94 views

What type of attack is this? '[0]

This is the example query: GET directory/file.txt?lang=it'[0] HTTP/1.1 I don't know what language it is. The ' (single quote) reminds me of a SQL Injection. I don't think it's a typo because I saw ...
0
votes
1answer
68 views

How to find vulnerable PHP parameter such as `.php?id=` as found in Kioptrix 3?

This is part of my preparation for OSCP. According to https://www.vulnhub.com/entry/kioptrix-level-12-3,24/, Kioptrix 3 is vulnerable to SQL Injection. However, I found that SQLi challenge on ...
1
vote
2answers
114 views

Develop and test a vulnerable login system

I'm a beginner on course to be an expert (hopefully) and I've been set assignments to test security systems on the web. The whole assignment is to prepare, test and document the results to correlate ...
1
vote
1answer
44 views

How do SRP (and PAKE generally) protect against verifier leak

I have been reading into PAKE protocols, specifically starting with SRP RFC2945 The gist of the requirement on the server is that the server saves triplet (username, verifier (v), salt (s)) in the ...
0
votes
2answers
186 views

In SQL injection why don't we use OR 1 or OR 2>1 instead of OR 1=1?

I read everywhere regarding SQL injection where it is said that if SQL query is: SELECT * FROM table_name where username='xxxxx' AND password ='xxxx' and if you want to enter always true condition ...
0
votes
1answer
130 views

SQL injection and XSS prevention

I would kindly ask you to review the following code and tell me if it's enough to prevent most of SQL injection and XSS attacks. SQL injection: treated via PDO prepared statements; XSS: All user's ...
1
vote
0answers
66 views

Possibility of dynamically generated prepared statements and stored procedure SQL injection?

I am working on Java application which generate SQL prepared statements and stored procedure query strings using user inputs and executes with PreparedStatement.execute() or CallableStatement.execute()...
0
votes
0answers
44 views

Drupal 8 - Create REST API vulnerable to SQL Injection for CTF purposes

Recently I started creating a CTF challenge based on Drupal 8. I want to create a REST API parameter that will be vulnerable to SQLi. Even if this isn't something I should ask for here, I decided to ...
1
vote
3answers
129 views

Prevent SQL injections on the old PHP website using software

A friend of mine works for a company which owns a 15-ish years old website written in PHP using Apache/MySQL/home brew CMS and outdated hosting on OS Debian 8 "jessie". SSH allows passwords (with no ...
0
votes
2answers
253 views

SQLMap Cookie Injectioin with Working Manual SQLi

I'm using an existing exploit which calls for a cookie called wp_sap to be set with the following value: ["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,@@version,11#"] This works ...
0
votes
0answers
31 views

Unable to exploit SQL injection in the parameter

During my testing I have found a vulnerable parameter in an API (/api/v1/documents/?direction=desc&limit=30&mode=reports**&page=1**) and its parameter is page=1 at the end. Upon giving the ...
1
vote
1answer
83 views

What does the last single quote of the sql injection query: ' or “1”=“1” ' mean

I couldn't fully grasp why the last single quote of the sql query: ' or "1"="1" ' is necessary. So I understand the part until the last single quote '. The first single quote enables to inject the sql ...
0
votes
1answer
64 views

How are biometrics tougher to crack than a pin?

When I hear that bio-metrics are tougher to crack, it's left ambiguous as to whether they refer to the term 'hack' as simply getting through the system by guessing the password or mimicking the person....
26
votes
12answers
7k views

Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql real escape string() function

Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql_real_escape_string() function?
-4
votes
3answers
63 views

Why is using prepared statements in PHP considered best practice?

Let me first start by stating that I am by no means a webdeveloper, so please do point out if I'm going in the wrong somewhere in my story. I think most people agree with the idea that using prepared ...
0
votes
0answers
79 views

Out-of-band Sql Injection

When I was doing some security research, I found an unexpected query in a POST request like this: q=select%20*%20from%20x%20where%20a%20%3D%20'%7B%22something%22%3A%22blah%22%2C...%7D' Where the ...
1
vote
1answer
118 views

SQL injection with no output

So I found this section of a webpage, which is a basic "feedback box". It had all the characteristics of an SQL injectable element. Scanned it with OWASP, it was true. Tried SQLmap, it gave me ...
0
votes
1answer
45 views

What to do if right table has more columns than left table for UNION injection?

I'm trying an injection on the following SQL statement: SELECT * FROM Products WHERE ((name LIKE '%Apple%' OR description LIKE '%Apple') I've determined that the Products table has 9 columns, and ...
3
votes
3answers
157 views

Is SQL injection still a bad thing if the user is restricted to non-harmful queries?

Suppose I have a very simple PHP application that acts as a front-end for an SQL database. The user enters their query into a box, and the app shows the query results in a table. To prevent a user ...
0
votes
0answers
52 views

SQLsus injections failed

I’m trying to inject a website using sqlsus tool on Kali, but i keep getting a failure message, I’ve changed the website I’m testing even though I’m sure it’s vulnerable, but still a failure message. ...
3
votes
1answer
50 views

Sql map Manual Vulnerability Assessment

I am trying to do penetration testing for one of my client. The platform is Code ignitor. There is an endpoint /find/1 The function queries the vehicle table where vehicle ID is 1 with no sanity check....
50
votes
1answer
9k views

In SQL injections why do they put “— -” at the end of the URL?

I understand when they put a + at the end, URL treats it like a space. I want to know what -- - does. I do know what the "double dash" does. Including the double dash with a "space at the end". I ...
1
vote
1answer
297 views

There seems to have been an attempt to attack my website [duplicate]

I am using PHP as a server side language. And I don't use CMS or Framework. From the nginx log the website attack seems obvious. I wonder what kind of attack the attacker attempted. The attacker ...
4
votes
1answer
100 views

Making SQL/HTML Injection attacks programmatically impossible

Apparently having 100% prevention of SQL Injection and XSS attacks is easier said than done, but why? Can't static code analysis tools ensure that all user supplied input vectors (including user ...
1
vote
0answers
136 views

XSS / SQL Injection Attacks with Character Encoding Mixups

Are there any character encoding mixup attacks that are still a threat in 2020? Such as with XSS or SQL injection being the most obvious. Some examples: Tricking a browser to display a page in UTF-...
4
votes
0answers
143 views

Whats the meaning of ] symbol in a SQL query?

I have come across a CTF challenge that has a part with an SQL injection (MySQL DB). I have completed it, but I do not know why or how the injection works. The query in the PHP application would ...
2
votes
3answers
161 views

Are injection vulnerabilities a design or an implementation flaw?

Are injection vulnerabilities mainly a design or an implementation problem? I'm using SQL injection as an example; I'm interested in other injection vulnerabilities as well. I believe that it is the ...
0
votes
1answer
124 views

Is my Java code still vulnerable to SQL injection? [duplicate]

We have a Java web application that was vulnerable to blind SQL injection attacks. Our developers fixed the code by using the replaceAll() function to convert single quotes to two single quotes. I am ...
1
vote
0answers
161 views

SQLMAP with single URL application

I have a local application which will be accessible only after login. Its single URL application, URL of application won't change, just it use 'XMLHttpRequest' to refresh the content of screen based ...
1
vote
1answer
117 views

It this a safe way to filter input into an SQL query

Is this a safe way to filter strings into an SQL query in java or could this be bypassed? I understand that I should just parameterize everything but this is an ancient code base where it makes more ...
0
votes
0answers
72 views

Response seems to get redirected if SQL injection query succeeds, if not then it doesn't get redirected

Under the authorization of my friend, I am testing his website against potential vulnerabilities. I was trying to find if I was able to inject a SQL query into a POST request parameter hi' or 1=1 --: ...
0
votes
0answers
142 views

Is this SQLMap query is correct?

I am practicing on some vulnerable application, and I am asked to find an injection vulnerability with a payload. it states there is a common and simple filter in place. Then I need to extract the ...
2
votes
2answers
468 views

SQL injection using URL query string (web application/php server)

Hacker is trying to attack the site by using the following SQL injection query to get the SQL version. Using URL site. example: www.abc.com/?queryParamString=(SELECT 9701 FROM(SELECT COUNT(*),...

1
2 3 4 5
17