Questions tagged [sql-injection]

SQL injection is a technique used to take advantage of vulnerabilities arising from non-validated input on web applications to pass SQL commands through for execution on a backend database.

Filter by
Sorted by
Tagged with
0
votes
0answers
9 views

SQL Injection - Help with extracting data [on hold]

I'm testing a web application running Oracle DB. I found a vulnerable parameter to SQL injection using sql-map. When I try to extract some data from the DB(--tables and default tables list), I get ...
1
vote
1answer
51 views

Is emulated SQL query preparation less secure?

I have been looking at PDO attributes, specifically at resources (some are linked at the end of this post) saying that emulated query preparation is less secure than using real prepared statements, ...
-1
votes
1answer
49 views

SQL Injection in Database [closed]

I have database name collage. I want to know if collage have any non-empty table or not? What i should write to find it using SQL Injection attack technique.
1
vote
0answers
42 views

how to create random request time delay in sqlmap?

How can i configure sql-map to try payloads at random time delay? as an example time between first and second request can be 0.10s and second and third might 0.25 and so on. i know there is --delay ...
1
vote
1answer
20 views

How to input generic type or determine data types for selected values in UNION ALL SQL injection attack?

I've determined that the application is vulnerable to SQL injection and the proper amount of values to SELECT in the corresponding UNION ALL query: foo' UNION ALL SELECT '1','1','1','1','1','1','1','...
2
votes
1answer
104 views

Why do I need an space at the end for this SQL Injection to work?

This is the vulnerable code: $order = isset($_GET["order{$i}"]) ? $_GET["order{$i}"] : ''; if (stripos($order, 'benchmark') !== false) die; ${"result$i"} = $db->query("SELECT * FROM {$tables[$i]} "...
1
vote
1answer
81 views

What kinds of attacks are possible with credentials to a read-only Postgres user?

Assuming I implement the literal SQL-injection on an HTTP endpoint with a read-only user that limits execution time to e.g. some amount of seconds. What's the worst that could happen? I know simple ...
0
votes
1answer
95 views

Cybersecurity role for my website project. Need help and Advice [closed]

I been given a task to secure a website which will be done by my group mates, but I have no clue. Could someone give my ideas? and how I am going to protect? what code can I use to secure login page?
1
vote
0answers
46 views

Understanding SQLMAP payload

I was participating in a CTF and there was a SQL Injection challenge. There is a Wordpress page with a vulnerable plugin parameter (let's call the website https://vulnerable.com/), and the solution ...
3
votes
1answer
80 views

Security concerns in disseminating database design?

I work for a government agency, and we've been requested via a freedom of information request for the layout of the tables of one of our systems, a data dictionary and schema design request. What are ...
0
votes
0answers
48 views

How to send file with SQLMap

Note: this is a challenge in a past CTF. There is a webapp where you can submit an image that contains some text and the app will run an OCR and search for the text in a database. The app is ...
0
votes
0answers
51 views

Boolean blind SQLi with sqlmap

I am trying to run sqlmap in order to find a flag for a CTF. The injection string is sent via a POST request in the parameter called search. The response is received as either 1, 2, or 3 (error codes),...
-1
votes
1answer
118 views

SQLI Login Bypass Cheat-sheets Question [duplicate]

Assuming you are authorized to pentest a live website that's login page is vulnerable to SQL Injection. Lets say your backpack has only 2 crafted queries by you which is admin' -- and '=' 'OR'. Your ...
0
votes
0answers
132 views

'=' 'OR' SQL Injection Login Bypass Question [duplicate]

I was testing SQLI Cheatsheets on a vulnerable test site. This particular injection '=' 'OR' seems to work on the login page. Why does that injection work? What's the back-end SQL code, if I could ...
0
votes
1answer
154 views

Bypass login with SQL injection with additional password check

I'm having some fun with SQL injection attacks, and I'm currently attempting to bypass a login using SQLi. I think I've figured out the SQL query just fine, however this module also implemented an ...
2
votes
1answer
121 views

Got warnings last night from a SQL injection attack - What were they trying to do?

In sum, they tried 10 different commands. The site is ran on Wordpress, but has a security plugin that, "blocked a page visit to your site." I'm curious as to what they were trying to go after though....
2
votes
1answer
371 views

' OR 1=1/* SQL Injection Login Bypass Question

Recently I came across a SQL Injection Cheat Sheet which contains this particular cheat sheet which I am confused by ' or 1=1/* Assuming I am testing it on this server-side code below. SELECT * FROM ...
0
votes
1answer
183 views

SQL injection authentication bypass

I am testing a SQLi login bypass on the PHP code below: if(isset($_POST["login"]) && isset($_POST["password"])) { $sql="select * from users where login='{$_POST["login"]}' and password='{$...
3
votes
0answers
65 views

How Can Exploit Xss and Sqli via HTTP Verb Tampering?

I was reading a paper about 'HTTP Verb Tampering' here: https://blog.jeremiahgrossman.com/2008/06/what-you-need-to-know-about-http-verb.html The author said: 2) HTTP Verb tampering is generally ...
0
votes
0answers
91 views

SQLMAP injection with dynamic token?

I've a web app that has an injection point in POST data. POST data requires 4 params and one of these is a session-custom token. The problem is that every time request is made i need to get a new ...
0
votes
2answers
106 views

Exploiting SQL Injection Vulnerability Using Logical Errors [closed]

<?php /* CREATE TABLE `message` ( `remote_addr` TEXT NOT NULL , `user_agent` TEXT NOT NULL , `name` TEXT NOT NULL , `text` TEXT NOT NULL ) ENGINE = MYISAM ; INSERT INTO `message` (`remote_addr`, `...
1
vote
0answers
66 views

WAF is set to Alert, not block. We are seeing thousands of XSS and SQL Injection attacks. How can I tell if any were actually successful?

I'm pretty inexperienced with WAFs and the events/alerts it generates. I'm wondering how I can tell if any of those were successful? For example, in the last 24 hours we saw over 50K alerts/events ...
2
votes
0answers
297 views

How do I use sqlmap to dump the OWASP Juice Shop schema?

EDIT 4/12/19: Added reproduction steps. I cannot seem to get sqlmap to successfully exploit and retrieve schema information from OWASP's deliberately vulnerable Juice Shop web application. I've ...
1
vote
1answer
146 views

What kind of attack is a request like this?

The number of request strings like this one seems to have increased over the last weeks. They all have in common, that they contain a combination of google adwords / google adsense parameters and sql ...
0
votes
1answer
99 views

Is removing semi-colons an effective defense against SQL injection?

So obviously there is a security error if I have some code like this execute("Select * where {} = {}".format(input1, input2)) As someone can simply, for input1, send in 1=1; DROP Table Users-- and ...
1
vote
2answers
78 views

When to perform secure code review?

OWASP recommends that secure code review to be performed throughout the SDLC process. Although it makes sense to perform secure code review before moving codes to production, could anyone here help ...
0
votes
1answer
59 views

SQL injection in Windows Services?

I have many Windows services which run on the server side only. It performs few CRUD operations on a database (MySQL). There is a client application which allows a user to upload files through it to ...
1
vote
1answer
93 views

Sqlmap, update query and risk param

I was reading about the 'risk' param for sqlmap, and the docs contain information, that risk 3 level can update tables. What does it mean? As far as I understand, this can happen either in the app ...
0
votes
0answers
32 views

SQL injection in Go with database/sql lib

Is it possible to inject SQL statements with fmt.Sprintf instead of Db.qwery with the ? and not %s parameter? I know it's a bad habit to use it but I wonder if it's possible or not. Example : query :...
1
vote
1answer
156 views

“Malformed URL” string when trying to inject SQL

I'm trying to check if a particular form of a web app belonging to a bug bounty project is vulnerable to SQL injection. After inserting a malformed URL, I get this message on my browser: "Malformed ...
1
vote
1answer
211 views

SQL Injection after Like Operator with continuing query

is it possible to add a new query like update in between this?: SELECT characters.id as charId FROM characters WHERE characters.name LIKE '%<User-Input-Here>%' ORDER BY `level` DESC, exp DESC ...
-2
votes
3answers
221 views

How can I stay anonymous in a LAN without Internet access?

I need to perform attacks (SQL injection) on a server. I thought of using a proxy to be anonymous, but the topology is a LAN without Internet access. I have no idea of the protocols used in the ...
0
votes
1answer
334 views

sqlmap - Testing parameters when reading request from file

After hours of trial an error I decided to ask here for some advice. I am currently trying to perform a sqlinj using using sqlmap on a system that was specifically designed to be attacked. The API ...
0
votes
1answer
180 views

Is this website vulnerable to an SQL injection?

I have a SquirrelMail server setup, and when I play with the mailbox parameter in the following GET query example.com/src/right_main.php?PG_SHOWALL=0&sort=0&startMessage=1&mailbox=Drafts%...
0
votes
0answers
142 views

Error based SQL Injection Oracle

I have this valid GET request: GET /restrict/menuApc.do?ID_ASSISTITO=ciao&MVPG=ApcAssistitiRicerca&s_TIPO_ASSISTITO=&s_ASSISTITO=giovanni&s_TIPO_SOGGETTO= HTTP/1.1 Host: test:8080 ...
1
vote
0answers
318 views

SQLmap check sql burp vulnerability

Burp suggests me that an application has an SQL injection point. First request: GET /restrict/menuApc.do?MVPG=ApcAssistitoTSRicercaPre&ASSISTITO_ID=*SRVZOSA40002294'&s_ELIMINATI=1&...
0
votes
1answer
371 views

SQL injection using union statement

I have a table with lots of user info - email, password and others. The server performs this query without using prepared statements: SELECT * FROM login where email = '$_POST'; I want to do an SQL ...
1
vote
2answers
474 views

SQL Injection on MariaDB

I am trying to exploit (legally) a MariaDb database with an SQLi vulnerability. I have identified the vulnerability here... /?o=1&page=app The o=* is vulnerable and produces the following error....
0
votes
1answer
205 views

What would be an example of an attack that exploits escape characters?

As far as I know escape characters are characters which change the meaning of the following character. In HTML for example the & is an escape character that declares the beginning of an entity ...
35
votes
6answers
16k views

Is it possible to detect 100% of SQLi with a simple regex?

I'm wondering if it is possible to detect 100% of the possible SQLi attacks using a simple regex. In other words, using very simple PHP code as an example: if (preg_match("/select/i", $input)) { ...
0
votes
0answers
154 views

Exploiting MairaDB Sql Injection with procedure analyse and extractvalue()

I am testing a sql injection to a website. And spending several hours i just become to get the version of the database. test.com/abc.php?query=1&limit=3 procedure analyse(extractvalue(rand(),...
3
votes
0answers
75 views

Vulnerable web application - sql-injection that's hard to find with a regular scanner like sqlmap

I am creating a "vulnerable web application". Is there a way to create a sql-injection vulnerability that is easy to spot during manual testing, but very hard (or impossible) for a regular sqli-...
0
votes
0answers
38 views

WAF tuning for SQLi

We have a record tracking application behind WAF. Everytime end users submit a record with special chars such as ' or " or () it blocks it as SQLi even when the payload is completely benign. At the ...
0
votes
2answers
124 views

What are some examples of injection attacks into databases that abuse common programs besides SQL?

Most data validation deals with SQL injection attacks. My question is, what other types of injection types are there that use common programs, and what are good defenses against them?
0
votes
1answer
195 views

SQLmap after burp possible injection point

Burp states that a GET request have surely a SQL injection point. I am using python sqlmap.py -r file_with_that_request.txt --level 5 --risk 3 --dbms=oracle but the injectiont doesn't work. Am I ...
235
votes
12answers
23k views

Is single quote filtering nonsense?

Penetration testers found out that we allow single quotes in submitted data fields, and want us to apply rules (input validation) to not allow them in any value. While I'm aware that single quotes ...
0
votes
1answer
139 views

SQLmap non authorized user, but the url works in browser

Through Burp Suite I get a possible SQL injection point using this request: POST /restrict/menuApc.do?ccsForm=AssistitoImposta:Edit&MVPG=ApcAssistitoDatiAnagraficiInserisci HTTP/1.1 Host: test-...
0
votes
2answers
737 views

Getting the column names of a table by brute force blind SQL injection

Is there a way of getting the column names of a table by brute force blind SQL injection in MySQL. so the query would be: select column_name from information_schema.columns WHERE table_name = ‘...
0
votes
0answers
36 views

SQL Injection ORDER By not working MySQL Error Based [duplicate]

I've been learning different attack vectors using applications such as bWapp and others to further my practice and knowledge of cybersecurity. I've stumbled across a problem in one of them. If Order ...
0
votes
1answer
40 views

What would be the best way to evaulate the database management systems? [closed]

I am an Information security analyst, looking for creative, non traditional, and unapproved ways to query/evaluate DBMS applications that includes SQL Server and PostgreSQL. Goal here is to protect ...