Questions tagged [sql-injection]
SQL injection is a technique used to take advantage of vulnerabilities arising from non-validated input on web applications to pass SQL commands through for execution on a backend database.
872
questions
0
votes
0answers
20 views
Error-based SQL injection to get next row [closed]
Next step to below command to get the second row data,
ID = ColumnName and
employee_details = TableName
‘ and 1=convert(int,(select top 1 ID from employee_details))-- -
-2
votes
0answers
35 views
As heuristic test turned out positive you are strongly advised to continue on with the tests
My sqlmap injection returns this critical error As heuristic test turned out positive you are strongly advised to continue on with the tests. What does it mean? The website can be injectable?
0
votes
0answers
55 views
Is this stored procedure vulnerable to SQL injection?
My question is about what exploits are possible given the following, not how to prevent SQL injection. I would not use this code in a real application.
Using MSSQL Server 2019, imagine a stored ...
0
votes
0answers
41 views
How could this SQL injection with a `SHOW` statement be exploited?
I have the following scenario:
The mysql request looks like
SHOW INDEX FROM `<table>` from `<database>`
The <database> is a user input and is vulnerable to injection. For example I ...
0
votes
0answers
85 views
Possible no sql injection?
We are developing a application in Dotnet MVC with mongodb as a database.
We use below mentioned query in order fetch the data from the database.
Controller code:
[Get("getmsg")]
Public ...
0
votes
0answers
34 views
How can I replicate or mitigate this reported SQL Injection vulnerability?
We have a .Net WebForms-based website, hosted on IIS10 behind HAProxy on pfSense. We've performed many vulnerability scans and penetration tests on the site over the years, with only minor issues ever ...
0
votes
0answers
56 views
Blind MSSQL Injection - Stacked query in cookies
I am currently working on a bug bounty program and in one subdomain of my target there is a Blind SQL flaw in a cookie. The back-end is MSSQL/ASP.net however, since cookies are separated by semicolons ...
0
votes
2answers
55 views
What are the security vulnerability of letting users insert anything to a nvarchar sql column?
I have several Web APIs that are used by the UI, for these APIs I have several validations that prevent users from adding invalid data. On the other hand, I have some APIs that are not used by any UI, ...
0
votes
0answers
80 views
Sqlmap, All tested parameters do not appear to be injectable
I am new to SQLMAP, I have been practicing with the Altoro Mutual portal which is a vulnerable portal, just enter the code 'OR 1 = 1 - in one of its forms (Login) and we will obtain administrator ...
0
votes
0answers
64 views
manual SQL injection syntax error on MySQL
I am doing a SQL injection training with TryHackMe as shown below. https://tryhackme.com/room/ccpentesting task 18
I am trying to do it the manual way. From the guide online I know that to get the SQL ...
0
votes
1answer
103 views
Sqlmap won't pick up injection point. Tweak?
I manually found an injection point, on CTF VM, located on POST form. I found it with the following manual payload :
1' OR SLEEP(1)-- t
I would like to use sqlmap. I ended with following call :
...
10
votes
3answers
6k views
No -*|%/ and no whitespace, is this SQL injectable?
I have an SQL query like "select * from records where record like '%" + user_input + "%'" My goal here is to get all the records. So far everything I have tried involves using ...
0
votes
0answers
13 views
Sql injection how does getting data outside from susposed rows works? [duplicate]
Let's say there is some vulnerable page and it gets SQL injected. PHP on the backend only returns specific rows and does not return passwords in any way. How do people get the passwords using that?
1
vote
0answers
97 views
SQL Injection Prevention WAF Generic Rule for Wordpress
We are trying to develop a GENERIC WAF Rule for SQLI Prevention for WordPress-based websites that can provide some level of effectiveness with a very low probability of having false positives.
From my ...
1
vote
0answers
88 views
Attack on a string created by a developer
Go and Java have "compile time constants", and JavaScript will soon get a feature that allows "Distinguishing strings from a trusted developer from strings that may be attacker ...
0
votes
0answers
438 views
SQLMap - Invalid character detected. retrying
I recently discovered an time-based blind SQL injection attack on one of the websites. I was able to dump the data with 100 threads (By default, SQLmap doesn't allow more than 10 but, I modified the ...
1
vote
1answer
189 views
Bypass input validation
I'm trying to create a vulnerable sandbox environment for pentesting challenges. As part of the challenge, I want to include some elements of XSS or SQLi if possible. However, I do not wish to make ...
0
votes
0answers
137 views
how to dump all first row of table in several database using SQLmap? [duplicate]
I have several databases in each one, several tables, I am trying to extract the first row from each table from several databases using sqlmap.
0
votes
1answer
61 views
Escaping out of a select query to run a statement that modifies data in the database
Lets say you use SELECT * FROM ($query) sub where you can swap $query to any query you wish. Is there a way to escape this select and run a command that modifies data in the database?
0
votes
0answers
187 views
SQL injection to RCE with load_file , into outfile etc
I know it is possible to get RCE with SQLi but I can't write to web root, I can only write files to /tmp folder. I can upload shell.php in /tmp without problems, but I'm curious is there any other way ...
1
vote
1answer
444 views
Using sqlmap for detecting SQLi on Juice shop's login page
New Sqlmap user, so please be patient :)
I've started looking at the tool and I'm curious about its use. For instance, the login page of OWASP's Juice shop is vulnerable to sql injection (' OR 1=1-- ...
0
votes
1answer
127 views
SQL Injection with Filters
I have a SQLite Query, which is something like:
SELECT id FROM demo WHERE name="insertname".
In this case, double-quotes are disabled, which means that insertname cannot contain double-...
0
votes
1answer
184 views
How to configure SQLMap to attack JSON parameter?
Part of a box I'm doing, I can successfully pass basic SQL query 'or'1'='1 with no errors,
{"search":"'or'1'='1"}
Output:
HTTP/1.0 200 OK
Trying to error the query
{"search&...
1
vote
3answers
265 views
Can you protect against SQLi without using prepared statements?
I am learning about SQLi (SQL injection) and I know that the solution to avoid them is prepared statements. However, does this mean that without them we are sure that we can get hacked? Are prepared ...
0
votes
2answers
79 views
SQL Injection syntax inquiry-commented injections
I have some programming experience, but am having trouble with SQL injection code. I don't understand why there's sometimes SQL syntax after the comment character (such as -- or #). I know that -- - ...
1
vote
0answers
197 views
Can sqlmap be used to extract data if the attack is blind?
I'm solving this challenge/lab where SQLi is inside the cookie parameter. After solving it manually, I thought to check if it can extract data. I used sqlmap with --cookie=COOKIE* (Notice * that's the ...
0
votes
0answers
71 views
sqlmap: why use concat and JSON_ARRAYAGG
I have run sqlmap through burpsuite and to get the existing databases it ran this query
1 UNION ALL SELECT NULL,NULL,CONCAT(0x7171717671,JSON_ARRAYAGG(CONCAT_WS(0x6a716a6c6a68,schema_name)),...
1
vote
0answers
65 views
Server response delays without having provided a time-based blind SQL injection input
I am new to SQL injection. When I was researching a bug bounty site protected by cloudflare, unsurprisingly, entering email@gmail.com' OR 1=1--, to test SQL injection, did not work.
So later, trying ...
0
votes
0answers
90 views
Backendly preventing database injections on simple web forms [duplicate]
I have a simple PHP-HTML-CSS contact form which saves emails to a local email client's database (in my case, Roundcube's database, which is a standalone MySQL database, I think --- I haven't used the ...
1
vote
0answers
333 views
Is it possible to enumerate Microsoft Access database using sqlmap?
I'm trying to enumerate a Microsoft Access database using sqlmap, in particular I run this command:
sqlmap -r http.txt --risk 2 --dump-all
Anyway it seems is not retrieving a single information. Am I ...
14
votes
2answers
3k views
SQL injection inside XSS
Is it possible to perform an SQL injection inside an XSS attack?
And if so, where can I find information on this or some examples?
1
vote
1answer
124 views
Blind SQL Injection POC in Java
I am looking for some java applications (other than Manage Engine) vulnerable to Blind SQL Injection attacks for Authentication Bypass. I explored exploitdb and others but didn't find anything ...
1
vote
1answer
68 views
Is it possible to get an sql injection after importing a sql dump?
Is it possible that after I dump a SQL Database created with prepared statements as an ".sql" file, and then I import it again, that the import may be vulnerable to SQL Injections?
1
vote
2answers
323 views
Cannot perform SQL injection because of the weird postgresql syntax that is used
I have a website that uses ManageEngine Service Plus and it has a SQL injection vulnerability
the linksays that with the help of the following url we would be able to inject postgresql commands to get ...
1
vote
1answer
489 views
Sqlmap Sleepy User-Agent
I was testing Burp Suite Crawl on some old php sites I made and it found Sleepy User-Agent
SQL injection vulnerability
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, ...
0
votes
2answers
70 views
How to connect to a MariaDB database after collecting data about users and passwords with a SQLI? [closed]
I'm trying to breach a dummy MariaDB database which is vulnerable to SQLI and is storing sensitive data about its users and their passwords. I've collected all the data I could collect, but now how am ...
1
vote
0answers
74 views
SQL Injection Problem
I was practising on OWASP Mutillidae, and I met a problem. There's a task that examines our knowledge of UNION query.
The vulnerable query is:
SELECT * FROM accounts WHERE username='
The accounts ...
1
vote
1answer
135 views
Blind SQL Injection
I am participating in a program that when I write in the url parameter ' or 1=1;-- it gives me Forbidden 403 and when I write in the parameter ' or 1=2;-- it shows me the page.
Is the website and ...
0
votes
0answers
85 views
What tools/checklists can help determine the presence of malicious code in a database? MS SQL specifically
Consider a scenario, where your AV / EDR software has to exclude paths of database files as suggested by vendors to avoid affecting performance or stability issues.
You want to review your database ...
0
votes
1answer
87 views
SQL Injection with long data type
All the examples of an SQL injections that I've seen have a user controlled string variable that was directly used to construct the SQL query but, I was wondering if it's possible to perform an SQL ...
1
vote
1answer
102 views
SQLinjection prevention: parser + blacklist?
I know the best way to prevent SQL-injection is parameterized queries. But this is not possible in the specific use case because the client has to be able to input SQL statements directly.
So what my ...
0
votes
0answers
74 views
Is that SQL query exploitable for really malicious things
I have following SQL query in my WordPress plugin,
SELECT `ID`, `post_content`
FROM `wp_posts`
WHERE `post_type` = 'movie'
AND `post_status` = 'publish'
OR `post_status` = 'private'
AND `ID` NOT ...
0
votes
2answers
181 views
Is union based mysql injection able to read files outside database?
Can files outside database which are not part of any tables in database be read via union based SQL injection? For eg
http://xyz.com/fetch?id=3
Consider id parameter is used at server side by cursor ...
1
vote
2answers
325 views
SQL injection using brute force?
I am studying about cyber defense lately for fun and found about a proposed method that as I understand it performs automated SQL injection using brute force by training a model. At some point it says ...
0
votes
1answer
165 views
Does Injection Attack Against SQL Server Require Semicolon or Comment?
In creating a blacklist function as part of our multi-pronged defense against SQL injection that includes parameterized queries and validating for length and type of input, we are creating a Blacklist ...
1
vote
0answers
62 views
When using parameterized SQL queries, is there still any *security* issue with simply blindly accepting user input variables?
Suppose I have this:
parameterized_database_call('SELECT * FROM widgets WHERE id = $1', $_GET['widget_id']);
The SQL query is parameterized, as I've done for many years now. (I'm trying to repress ...
0
votes
0answers
70 views
SQL Injection Training challenge including a PHP file
I’m currently trying to get some knowledge in SQL injection. In a pen test environment, there is a challenge on which you get the PHP file and you need to try to login using SQL Injection. I’ve ...
0
votes
1answer
223 views
SQLi Filter Bypass with banned table/column names
I've studying and practicing different approach to SQLi filter bypass and I faced a challenge. What if the WAF filters look for specific strings rather than SQL keywords?
Example:
Filter: /UNION/
SQLi:...
1
vote
2answers
228 views
What is this attack? id=1'[0]
I'm frequently getting these weird URLs.
https://mywebsite.com/mymage.php?id=1'[0]
The weird part is '[0].
The webpage pass the id to the database and the database expect an integer so we are ...
0
votes
0answers
167 views
Error Based SQL Injection
I have a MySQL lab challenge where I send id=1‘ and select @@version;# then manage to trigger an error. But the part of the error response that has my version info looks like it comes back in binary (...
