Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [sql-injection]

SQL injection is a technique used to take advantage of vulnerabilities arising from non-validated input on web applications to pass SQL commands through for execution on a backend database.

-1
votes
0answers
30 views

SQL Injection on script that retrieve image data

I found sql injection on script that retrieve image data from database.Ex : http://target.com/gallery.php that contain : <img src='getimg.php?id=1'> and i trying access http://target.com/...
-1
votes
0answers
36 views

SQL injection for Capture the Flag

So I am in CTF and I need to bypass login form. I only got this message so far: Traceback (most recent call last): File "./main.py", line 145, in do_login if cur.execute('SELECT password FROM ...
0
votes
0answers
6 views

Dangerous MySQL functions [migrated]

It is well-known that the SQL function SLEEP() can be used to attack web applications, e.g. as described here. The sleep function cannot be disabled since it is compiled into the MySQL code and does ...
1
vote
0answers
51 views

WAF is set to Alert, not block. We are seeing thousands of XSS and SQL Injection attacks. How can I tell if any were actually successful?

I'm pretty inexperienced with WAFs and the events/alerts it generates. I'm wondering how I can tell if any of those were successful? For example, in the last 24 hours we saw over 50K alerts/events ...
2
votes
0answers
98 views

How do I use sqlmap to dump the OWASP Juice Shop schema?

EDIT 4/12/19: Added reproduction steps. I cannot seem to get sqlmap to successfully exploit and retrieve schema information from OWASP's deliberately vulnerable Juice Shop web application. I've ...
0
votes
0answers
51 views

What kind of attack is a request like this?

The number of request strings like this one seems to have increased over the last weeks. They all have in common, that they contain a combination of google adwords / google adsense parameters and sql ...
0
votes
1answer
88 views

Is removing semi-colons an effective defense against SQL injection?

So obviously there is a security error if I have some code like this execute("Select * where {} = {}".format(input1, input2)) As someone can simply, for input1, send in 1=1; DROP Table Users-- and ...
1
vote
2answers
69 views

When to perform secure code review?

OWASP recommends that secure code review to be performed throughout the SDLC process. Although it makes sense to perform secure code review before moving codes to production, could anyone here help ...
0
votes
1answer
55 views

SQL injection in Windows Services?

I have many Windows services which run on the server side only. It performs few CRUD operations on a database (MySQL). There is a client application which allows a user to upload files through it to ...
1
vote
1answer
44 views

Sqlmap, update query and risk param

I was reading about the 'risk' param for sqlmap, and the docs contain information, that risk 3 level can update tables. What does it mean? As far as I understand, this can happen either in the app ...
0
votes
0answers
29 views

SQL injection in Go with database/sql lib

Is it possible to inject SQL statements with fmt.Sprintf instead of Db.qwery with the ? and not %s parameter? I know it's a bad habit to use it but I wonder if it's possible or not. Example : query :...
1
vote
1answer
73 views

“Malformed URL” string when trying to inject SQL

I'm trying to check if a particular form of a web app belonging to a bug bounty project is vulnerable to SQL injection. After inserting a malformed URL, I get this message on my browser: "Malformed ...
1
vote
1answer
76 views

SQL Injection after Like Operator with continuing query

is it possible to add a new query like update in between this?: SELECT characters.id as charId FROM characters WHERE characters.name LIKE '%<User-Input-Here>%' ORDER BY `level` DESC, exp DESC ...
-2
votes
3answers
186 views

How can I stay anonymous in a LAN without Internet access?

I need to perform attacks (SQL injection) on a server. I thought of using a proxy to be anonymous, but the topology is a LAN without Internet access. I have no idea of the protocols used in the ...
0
votes
1answer
130 views

sqlmap - Testing parameters when reading request from file

After hours of trial an error I decided to ask here for some advice. I am currently trying to perform a sqlinj using using sqlmap on a system that was specifically designed to be attacked. The API ...
0
votes
1answer
172 views

Is this website vulnerable to an SQL injection?

I have a SquirrelMail server setup, and when I play with the mailbox parameter in the following GET query example.com/src/right_main.php?PG_SHOWALL=0&sort=0&startMessage=1&mailbox=Drafts%...
0
votes
0answers
54 views

Error based SQL Injection Oracle

I have this valid GET request: GET /restrict/menuApc.do?ID_ASSISTITO=ciao&MVPG=ApcAssistitiRicerca&s_TIPO_ASSISTITO=&s_ASSISTITO=giovanni&s_TIPO_SOGGETTO= HTTP/1.1 Host: test:8080 ...
1
vote
0answers
109 views

SQLmap check sql burp vulnerability

Burp suggests me that an application has an SQL injection point. First request: GET /restrict/menuApc.do?MVPG=ApcAssistitoTSRicercaPre&ASSISTITO_ID=*SRVZOSA40002294'&s_ELIMINATI=1&...
0
votes
1answer
119 views

SQL injection using union statement

I have a table with lots of user info - email, password and others. The server performs this query without using prepared statements: SELECT * FROM login where email = '$_POST'; I want to do an SQL ...
1
vote
2answers
228 views

SQL Injection on MariaDB

I am trying to exploit (legally) a MariaDb database with an SQLi vulnerability. I have identified the vulnerability here... /?o=1&page=app The o=* is vulnerable and produces the following error....
0
votes
1answer
102 views

What would be an example of an attack that exploits escape characters?

As far as I know escape characters are characters which change the meaning of the following character. In HTML for example the & is an escape character that declares the beginning of an entity ...
34
votes
6answers
15k views

Is it possible to detect 100% of SQLi with a simple regex?

I'm wondering if it is possible to detect 100% of the possible SQLi attacks using a simple regex. In other words, using very simple PHP code as an example: if (preg_match("/select/i", $input)) { ...
0
votes
0answers
72 views

Exploiting MairaDB Sql Injection with procedure analyse and extractvalue()

I am testing a sql injection to a website. And spending several hours i just become to get the version of the database. test.com/abc.php?query=1&limit=3 procedure analyse(extractvalue(rand(),...
3
votes
0answers
69 views

Vulnerable web application - sql-injection that's hard to find with a regular scanner like sqlmap

I am creating a "vulnerable web application". Is there a way to create a sql-injection vulnerability that is easy to spot during manual testing, but very hard (or impossible) for a regular sqli-...
0
votes
0answers
35 views

WAF tuning for SQLi

We have a record tracking application behind WAF. Everytime end users submit a record with special chars such as ' or " or () it blocks it as SQLi even when the payload is completely benign. At the ...
0
votes
2answers
65 views

What are some examples of injection attacks into databases that abuse common programs besides SQL?

Most data validation deals with SQL injection attacks. My question is, what other types of injection types are there that use common programs, and what are good defenses against them?
0
votes
1answer
125 views

SQLmap after burp possible injection point

Burp states that a GET request have surely a SQL injection point. I am using python sqlmap.py -r file_with_that_request.txt --level 5 --risk 3 --dbms=oracle but the injectiont doesn't work. Am I ...
233
votes
12answers
23k views

Is single quote filtering nonsense?

Penetration testers found out that we allow single quotes in submitted data fields, and want us to apply rules (input validation) to not allow them in any value. While I'm aware that single quotes ...
0
votes
1answer
57 views

SQLmap non authorized user, but the url works in browser

Through Burp Suite I get a possible SQL injection point using this request: POST /restrict/menuApc.do?ccsForm=AssistitoImposta:Edit&MVPG=ApcAssistitoDatiAnagraficiInserisci HTTP/1.1 Host: test-...
0
votes
2answers
340 views

Getting the column names of a table by brute force blind SQL injection

Is there a way of getting the column names of a table by brute force blind SQL injection in MySQL. so the query would be: select column_name from information_schema.columns WHERE table_name = ‘...
0
votes
0answers
32 views

SQL Injection ORDER By not working MySQL Error Based [duplicate]

I've been learning different attack vectors using applications such as bWapp and others to further my practice and knowledge of cybersecurity. I've stumbled across a problem in one of them. If Order ...
0
votes
1answer
40 views

What would be the best way to evaulate the database management systems? [closed]

I am an Information security analyst, looking for creative, non traditional, and unapproved ways to query/evaluate DBMS applications that includes SQL Server and PostgreSQL. Goal here is to protect ...
0
votes
0answers
44 views

How to make --os-shell command work on UBUNTU 16.04 ( Digital Ocean )?

I have made a vulnerable SQLi website ( to teach students ). I am able to dump the database but I am not able to run os commands or upload os-shell. I want to show them how to use --os-shell option ...
3
votes
1answer
162 views

Is SQL Injection Possible without double and single quotes?

Let's assume we're building a SQL query like this: SELECT * FROM users WHERE username = 'Username' AND password='password' If we blocked the characters " and ', will an attacker be able to hack into ...
0
votes
1answer
221 views

Sql injection bypass against KONA(akmai) WAF

I have been trying to find sql injection against a site in bug bounty.I tried a few parameters via sql map.One such query was shown to be injectible. Parameter: query (GET) Type: boolean-based ...
1
vote
2answers
266 views

SQL-injection, unable to get it to work!

I've recently found a SQL-injection vulnerability in one of our web applications. I've been able to exploit this SQLi, but only able to extract some very basic information. I'm not an expert pentester ...
0
votes
1answer
100 views

SQL injection that bypasses website's firewall that filters table by its prefix

There is a website I am assessing for security breaches. It has Joomla 1.5.x with MySQL 5.5.24 and PHP 5.3.2. I am doing a penetration test, that exploits SQL injection. The thing is that WAF filters ...
0
votes
0answers
91 views

How trying to fetch limited entries using sqlmap?

I have 1 table (eg: users) with more than 1 million entries. But when using Sqlmap try to --start and --stop it's not Working. For example the query is: sqlmap.py -u http://example.com/index.php?id=...
0
votes
1answer
129 views

What type of attack is the below SQL injection?

Today in the apache access log I saw something like this https://xxxxx/xxxx/xx/something.html' or (1,2)=(select*from(select name_const(CHAR(103,119,111,107,69,82,84,99,118),1),name_const(CHAR(103,119,...
0
votes
0answers
58 views

Introduce a SQLi in a testing application

So I was building an application to demonstrate SQL injection via cookies and wrote some code to run SQL statements if the statement are passed within a redir cookie header but when using sqlmap to ...
4
votes
1answer
447 views

Is forbiding the ; char enough to prevent SQL injection?

Disclaimer: Parameterized queries are the way to go, no need to discuss about that :) I've seen the following code at a friends place: var query = "SELECT * FROM students WHERE name = " + name; ...
1
vote
0answers
139 views

How to find no of columns using sql injection

I'm new to web penetration testing and when I tried to test a website, I found that when I entered ' in the text box, I would get the following error: OraOLEDB error '80004005' ORA-01756: quoted ...
0
votes
2answers
119 views

SQLi with quote filter?

I'm doing some hacking courses, and in one of the lessons, I have a possible SQLi, but in the Python source code there's an if clause just before the SQL statement, which filters the quote symbol: ...
0
votes
1answer
449 views

SQl Injection MariaDB

Im found a sql query that is injectable below "car_info = query("select models, color, running from cars where manual = 1 AND UID = '{}' LIMIT 1".format(uid))") Where '{}' is the point of injection. ...
0
votes
1answer
298 views

SQL inject MariaDB with SQLMAP

I'm fairly new to sqlmap but I have tried a lot of attacks and have been successful except for this one attack that I have tried. SQLMAP won't detect this nor try to inject an error like this. So how ...
3
votes
2answers
126 views

Possible SQLi with self-made prepared statements and real_escape_string?

My current assignment is to find a possible SQL injection in a PHP WebApp. While looking at the source code, I noticed that the way the script is handling prepared statments is weird. $query = db::...
3
votes
1answer
287 views

What is this injection attack trying to accomplish?

My site has been repeatedly hit with this query. I am wondering what the attacker is trying to gain? The URL is: my.site/content/page.aspx?myID=15641111111111111%20UNION%20SELECT%20cAsT(0x2d78312d512d%...
1
vote
1answer
107 views

SQL injection with an auto-incrementing parameter

I'm currently performing an API Pentest and I suspect an SQLi in one of the API calls. It updates a certain item of the web-service and requires an increase of the version number for each request. ...
2
votes
0answers
145 views

SQLmap on Login. Expect 401 reponse

I'm using sqlmap to test a login. When using invalid credentials, the webserver sends back a 401 response. However, sqlmap interprets this response as I'm not authorized to call this page and needs ...
2
votes
1answer
214 views

SQL injection on PostgreSQL in integer field?

I was trying https://server/shared/sendemail?sendto=" and got this response: Database operation "0or1row" failed (exception ERROR, "ERROR: invalid input syntax for integer:""" LINE 4: where user_id ...