Questions tagged [sql-injection]
SQL injection is a technique used to take advantage of vulnerabilities arising from non-validated input on web applications to pass SQL commands through for execution on a backend database.
825
questions
0
votes
1answer
15 views
Can attack to a website from a parked subdomain with different hosts?
I have a website like maindomain.com that hosted on a different hosting like 192.168.1.1 i want to add a subdomain from a different host like 192.168.1.2 to my main domain which my address will be ...
0
votes
1answer
61 views
SQL injection without the use of union and select
I was wondering if there is a way to use SELECT and UNION keywords without being caught by a algorithm (see below) that filters these keywords out.
$filter = array('UNION', 'SELECT');
// Remove ...
0
votes
1answer
55 views
Trying to do an SQL injection into a login field [closed]
I have an assignment to make an SQL injection - I found a login field that spits out an error, but I can't seem to make queries work inside of it. For your information it's an Mysql server. What is ...
0
votes
1answer
74 views
SQL Injection and Hidden parameter modification
A friend of mine gave me a web application for me to test and find vulnerabilities. He told me that this web application can be purposefully modified and then made to run an SQL injection. I have ...
0
votes
0answers
40 views
Execute sqlmap in a javaScript object cookie
I am studying sqli and I found a blind sqli vulnerability in a cookie and I have exploited manually, however, I would like to detect and exploit it with sqlmap.
Cookie looks like javascript object ...
0
votes
1answer
90 views
Blind SQL injection in sort direction
I have an SQL injection in a query where I control the sort direction parameter i.e: SELECT * from x where y=y ORDER BY COLUMN_NAME [SORT_DIRECTION]
When I control the SORT_DIRECTION, which is ...
0
votes
1answer
65 views
Never use stored session in sqlmap
I am trying to make sqlmap to avoid fetch data from stored session. How do I achieve that? I have performed sqlmap check once on a target and now that target is offline, I want sqlmap to just stop the ...
-1
votes
1answer
39 views
How to continue performing checks on a site if sqlmap found an issue on a URL of the same site while using --batch option?
I have a file /tmp/urls which has following URLs:
http://127.0.0.1:8081/?id=1
http://127.0.0.1:8081/?id2=1
I am using this command to perform checks on file URLs concurrently:
python3 sqlmap.py --...
0
votes
1answer
61 views
How can I build a simple website that contains SQL injection vulnerabilities? [closed]
How can I build a simple website that contains SQL injection vulnerabilities for study purposes? What do I need to learn?
2
votes
2answers
101 views
How can I carry out SQL insert injection when there's a select statement beforehand
So here's the deal. I've been working on an SQL injection challenge and here's what comes up.
There's a registration page where you input your Username, password and confirm password. It's vulnerable ...
0
votes
0answers
31 views
SQL File Privilege
I have a question about SQL File privilege. Recently, I found SQL injection vulnerability for user who had FILE privilege and I used sqlmap to get some interesting files. And I was wondering, how this ...
0
votes
1answer
56 views
Extracting data from db with time based SQL injections
SCENARIO:
a vulnerable login form. I say vulnerable because if I enter +select(sleep(0))+ the server response normally. If I enter +select(sleep(5))+ the server wait for a period of time greater than ...
1
vote
0answers
49 views
SQLinjection in SQLite: How to select a column with whitespace without use it?
So, I'm trying to do a SQL injection in a ctf application that removes all whitespace in form parameters, so I can't use it. To perform my query I used /**/ to insert whitespace and I could perform ...
0
votes
0answers
46 views
SQL Injection Doesn't Sanitize But Doesn't Execute Commands
I am currently doing a pentesting on a web application and focusing more on SQL Injection. This company I am pentesting have a functionality in which we are allowed to buy things from the vendors/...
0
votes
1answer
57 views
Is it possible to locate web document root using SQL query/SQL Injection?
I have access to MySQL database which the current user has FILE privilege. I want to upload a web shell but I do not know the root directory of the web server.
Is it possible to somehow locate the ...
1
vote
1answer
65 views
Why intruder number of threads has an effect on the time delay of indiviual requests
I was solving SQL injection lab on Portswigger, and the lab was asking to exploit blind SQL injection by triggering time delays, using that to retrieve administrator password.
I was making 720 ...
0
votes
1answer
88 views
Understanding sqlite3 sanitization in python
I use sqlite3 for my database and get data from untrusted source with
flask.request.get()
I insert all data with such syntax
c.execute("INSERT INTO table (e1, e2) VALUES(?, ?)", (V1, V2))
...
0
votes
1answer
69 views
Virus / malware stored inside database
I have a small network of several Windows 10 machines (all protected by BitDefender 2020 Total Security), one of which acts as server with Firebird database.
For some time the database is ...
-1
votes
2answers
101 views
Can someone Inject malicious SQL to my SQL query? [closed]
I build a simple chat with MySQL. It has a table called users and two colums: id and username. I use the following query to extract username and ID by ID.
Is there a way someone can Inject malicios ...
0
votes
2answers
148 views
sqlmap won't give me results i'm looking for [closed]
I am trying to use sqlmap. Although every time I use it, I just get a response of:
[13:39:11] [CRITICAL] previous heuristics detected that the target is protected by some kind of WAF/IPS
[13:39:11] [...
0
votes
1answer
87 views
SQLMap Only Returns information_schema
I run this command python sqlmap.py -u https://acme.com/post.php --data "id=1" --tamper="between,randomcase,space2comment" -v 3 --random-agent --dbs but SQLMap only returns ...
0
votes
1answer
91 views
PostgreSQL injection with basic sanitization
I'm trying to figure out if an SQLi for the following PostgreSQL/Java code exists.
public void availableItems(String name) {
return this.query("SELECT * FROM items WHERE name='"+name+"...
0
votes
0answers
100 views
Sqlmap not detects error based injection
I am working on Hack the VM (hard machine) for my OSCP preparation
There is a web app with two drop down boxes.. Year and month.. both contain numbers and a submit to fetch data from DB based on year ...
0
votes
1answer
57 views
sql injection mitigation by signed db entries?
In a php/mysql based system I work on, they recently found several SQL injection vulnerabilities. Those come from 3rd party plugins, and I must assume there are more to be discovered.
My major concern ...
0
votes
0answers
21 views
.php code in .txt file with eval() function [duplicate]
I have found three files with name as below:
a.phpfile.txt
b.phpfile.txt
c.phpfile.txt
when i open, each file contained with the following code:
<?php @eval($_POST[x]);
I have deleted all ...
1
vote
1answer
140 views
ORDER BY sort direction is exploitable in SQL Injection?
I am testing an internal application and come across a page where if I am able to make the application display a SQL error because it does not recognize the payload for ORDER BY sort direction. The ...
0
votes
1answer
133 views
How can I write a function that will log a user in an old system without knowing any username or password? [closed]
I'm studying Internet Security and I learned something about code injection in older websites (using the string ' OR 1 == 1 // as a username will log in with any password provided); but what if a ...
0
votes
1answer
62 views
How to best limit SQL injection attacks that are being funneled through an Apache proxy I control
I use an Apache proxy to funnel traffic to an IIS server. The IIS server sends me emails if some bad actor attacks my site with an sql injection attack. It captures their IP address, and sends me the ...
0
votes
0answers
59 views
SQLmap automation
I'm automating SQL injection using sqlmap. Is there someone who managed to parse sqlmap console output to only report critical findings (vulnerable pages to SQL injection)?
The tool doesn't support ...
1
vote
1answer
75 views
Multi-byte character exploit
I read this answer, It explains how a multi-byte character exploit works in a decent way, the only way I could think of avoiding this problem is whitelisting all single-byte characters because of the ...
0
votes
1answer
75 views
Having problems with SQL injection with mysqli extension PHP
I am new to SQL injections, and people on Reddit asked me do the portswigger labs. Which I did up till before 2nd order ones. So I am pretty comfortable with usual SQL injections.
Now I have myself ...
0
votes
0answers
142 views
Sqlmap waf bypass
This is my first post here, sorry for my english.
Im making some test around, because i want to learn more about sql injection. Im not really good as manual sql injection, so im using sqlmap.
what ...
0
votes
1answer
177 views
SQLmap finds injectable 'id' parameter but the response is 'Internal Server Error'
I am trying to understand the SQLi so I ran SQLMap with '-vvv' parameter
4: Show also HTTP requests.
I did scan one of the vulnerable and 'free to hack' sites.
In one of the requests sent, the ...
0
votes
0answers
99 views
What type of attack is this? '[0]
This is the example query: GET directory/file.txt?lang=it'[0] HTTP/1.1
I don't know what language it is. The ' (single quote) reminds me of a SQL Injection.
I don't think it's a typo because I saw ...
0
votes
1answer
88 views
How to find vulnerable PHP parameter such as `.php?id=` as found in Kioptrix 3?
This is part of my preparation for OSCP.
According to https://www.vulnhub.com/entry/kioptrix-level-12-3,24/, Kioptrix 3 is vulnerable to SQL Injection.
However, I found that SQLi challenge on ...
1
vote
2answers
114 views
Develop and test a vulnerable login system
I'm a beginner on course to be an expert (hopefully) and I've been set assignments to test security systems on the web. The whole assignment is to prepare, test and document the results to correlate ...
1
vote
1answer
46 views
How do SRP (and PAKE generally) protect against verifier leak
I have been reading into PAKE protocols, specifically starting with SRP RFC2945
The gist of the requirement on the server is that the server saves triplet (username, verifier (v), salt (s)) in the ...
0
votes
2answers
202 views
In SQL injection why don't we use OR 1 or OR 2>1 instead of OR 1=1?
I read everywhere regarding SQL injection where it is said that if SQL query is:
SELECT * FROM table_name where username='xxxxx' AND password ='xxxx'
and if you want to enter always true condition ...
0
votes
1answer
162 views
SQL injection and XSS prevention
I would kindly ask you to review the following code and tell me if it's enough to prevent most of SQL injection and XSS attacks.
SQL injection: treated via PDO prepared statements;
XSS: All user's ...
1
vote
0answers
66 views
Possibility of dynamically generated prepared statements and stored procedure SQL injection?
I am working on Java application which generate SQL prepared statements and stored procedure query strings using user inputs and executes with PreparedStatement.execute() or CallableStatement.execute()...
0
votes
0answers
45 views
Drupal 8 - Create REST API vulnerable to SQL Injection for CTF purposes
Recently I started creating a CTF challenge based on Drupal 8. I want to create a REST API parameter that will be vulnerable to SQLi. Even if this isn't something I should ask for here, I decided to ...
1
vote
3answers
179 views
Prevent SQL injections on the old PHP website using software
A friend of mine works for a company which owns a 15-ish years old website written in PHP using Apache/MySQL/home brew CMS and outdated hosting on OS Debian 8 "jessie". SSH allows passwords (with no ...
1
vote
2answers
885 views
SQLMap Cookie Injectioin with Working Manual SQLi
I'm using an existing exploit which calls for a cookie called wp_sap to be set with the following value:
["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,@@version,11#"]
This works ...
0
votes
0answers
40 views
Unable to exploit SQL injection in the parameter
During my testing I have found a vulnerable parameter in an API (/api/v1/documents/?direction=desc&limit=30&mode=reports**&page=1**) and its parameter is page=1 at the end. Upon giving the ...
1
vote
1answer
88 views
What does the last single quote of the sql injection query: ' or “1”=“1” ' mean
I couldn't fully grasp why the last single quote of the sql query: ' or "1"="1" ' is necessary. So I understand the part until the last single quote '. The first single quote enables to inject the sql ...
2
votes
3answers
127 views
How are biometrics tougher to crack than a pin?
When I hear that bio-metrics are tougher to crack, it's left ambiguous as to whether they refer to the term 'hack' as simply getting through the system by guessing the password or mimicking the person....
26
votes
12answers
7k views
Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql real escape string() function
Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql_real_escape_string() function?
-4
votes
3answers
64 views
Why is using prepared statements in PHP considered best practice?
Let me first start by stating that I am by no means a webdeveloper, so please do point out if I'm going in the wrong somewhere in my story.
I think most people agree with the idea that using prepared ...
0
votes
0answers
105 views
Out-of-band Sql Injection
When I was doing some security research, I found an unexpected query in a POST request like this:
q=select%20*%20from%20x%20where%20a%20%3D%20'%7B%22something%22%3A%22blah%22%2C...%7D'
Where the ...
1
vote
1answer
161 views
SQL injection with no output
So I found this section of a webpage, which is a basic "feedback box". It had all the characteristics of an SQL injectable element. Scanned it with OWASP, it was true. Tried SQLmap, it gave me ...
