SQL injection is a technique used to take advantage of vulnerabilities arising from non-validated input on web applications to pass SQL commands through for execution on a backend database.
0
votes
1answer
18 views
Sql injection to update all rows [closed]
I want to know if this query can be SQL injected to update all rows
$pass = md5(mysqli_real_escape_string($_POST['password']));
$sql = "UPDATE user_table SET password = '$pass' WHERE reset = '...
0
votes
0answers
8 views
Parameterized script is not working [migrated]
I'm trying to prevent my search code against SQL Injection, i searched a litle about parameteried queries, and i'm trying to make this script works:
if(isset($_POST['pesquisar'])&&!empty($...
-2
votes
2answers
74 views
What file types might be vulnerable to SQL injection? [on hold]
I am learning about SQL injection and Google dorks. I have seen that there are three file types that can be vulnerable to SQL injection, .php, .aspx and one more.
I can't find the third one... The ...
0
votes
0answers
33 views
preg_replace() bypassing [duplicate]
so i was googling some web CTF's to play, and i've found a one with preg_replace() filtering in the login page.
$name = preg_replace('/\'/', '', $name);
$pass = preg_replace('/\'/', '', $pass);
$...
0
votes
2answers
92 views
Php parameters (username, password) in link
Little Info: I am not a web developer, I am a beginner to php and sql. Trying to learn in my free time.
I was examining a web site on a remote server and i saw something like;
www.myurl.com/login....
0
votes
3answers
260 views
Is SQL injection still a thing? [duplicate]
I was wondering whether SQL injection is still a thing or if it is mainly extinct due to the fact that I don't hear about corporations being hit by this vulnerability, And the last time I heard an ...
0
votes
1answer
57 views
bWAPP- SQL injection Hack displays a white screen?
I've been following this video(https://www.youtube.com/watch?v=XDCZ8FC856s) to install bWAPP on Parrot OS and everything works fine except SQL Injection. I've checked the database and its active. As ...
-4
votes
0answers
64 views
Where should i put SQL Injection query? [duplicate]
Well i know little about how sql works and most common ways to test is id=1' and like that but my question is where else we can enter our data to check sql vulnerability
1
vote
1answer
89 views
Is this parameter vulnerable to SQL Injection?
The backend server is running Tomcat 8.5 (Java backend). The URL in question is:
https://website.com/application/servlet.do?currentOID=abc12300000000
I found that when I give an incomplete OID (i.e ...
0
votes
1answer
107 views
How this Unique SQL injection works?
I found a challenge which was vulnerable to SQL injection and it was very very pretty hard to find So, How this unique SQL works?
I found this on login form where when I send user=\&pass=||1# as ...
0
votes
1answer
38 views
How to use custom injection in sqlmap?
This is post data, normally looks like this
{"end_date":"2018-8-26","start_date":"2018-8-26","success":1}
Below resulting "You have an error ..."
{"end_date":"2018-8-26'","start_date":"2018-8-26","...
1
vote
1answer
159 views
The role of Machine Learning In Cybersecurity Defense [closed]
Hackers and malware are one step ahead of cybersecurity experts, and every time technology is released to the market, vulnerabilities will be quickly discovered and exploited.
How effective can ...
0
votes
0answers
23 views
?, / or ; in input query string are causing errors. What does that mean?
I am currently testing a website and realized that if I put ; and/or % into the input for a search query it causes a 505 Internal Error.
Putting a ? in causes a 404 Page not found.
The URL for the ...
0
votes
1answer
119 views
I'm not sure if this Website is SQL Injectable
I think I found an SQL vulnerability; the request and response can be found below. I'm not sure because it is showing a normal error (it's in French) instead of showing an SQL error.
I also tried to ...
0
votes
1answer
107 views
Is it SQL Injection Vuln?
Today my friend asking help to test and prevent his website from sql injection..
After i tried basic sql injection like 1 OR 1=1, ' OR 1--',' '1'='1 There is no mysql error displayed..
But After i ...
1
vote
1answer
29 views
Single quotes ' not sanitized
I'm trying to find security issues on my friend's site.
There is an input box for subscription. I can enter my email address:
Henry<IMG SRC=# onmouseover="alert('xxs')">@gmail.com
After ...
0
votes
0answers
42 views
How to use binary search for blind SQL injection queries
From what I read online, it's possible to apply binary search to exploit blind SQL injection vulnerabilities, and that is probably what tools like sqlmap use to lower the number of queries that need ...
2
votes
1answer
65 views
False positive SQL Injection by ZAP with adding new parameter query
I have a spring MVC web application and am running ZAP Active scan on it.
I noticed that ZAP will modify URL , and add additional parameter named query and value query+AND+1%3D1+--+ to test SQL ...
0
votes
3answers
135 views
SQL Injection on POST JSON request
I have a web application vulnerable to SQL injections. I'm using BurpSuite to intercept the requests. More specifically, the data variable below is vulnerable. I added my own data to aggregates and ...
0
votes
1answer
56 views
Possibility of SQL injection by static or predefined values
Using direct variables is vulnerable to sql injection. So to prevent attacks we use parameters.
$result->bindParam(":id",$_POST['id'],PDO::PARAM_INT)
but I am confused regarding the following ...
0
votes
1answer
61 views
Use of Single/Double quotes for XSS/SQL Injection Context
XSS Prevention:
Why it is recommended to use single quotes or double quotes for declaring HTML attribute values instead of unquoted values?
It is recommended to prevent XSS.
Same goes for SQL ...
0
votes
0answers
46 views
From SQL Injection in SQLite to shell
I need to obtain a shell from an SQL injection over an application with sqlite database.
Currently my exploit looks like the following:
lucian@0x90:~/$ proxychains nc 10.185.10.55 1101
ProxyChains-3....
0
votes
1answer
95 views
Can an ampersand (&) be used in SQL injection?
With SQL Server, does the ampersand pose as a threat related to SQL injection? I'm working on a project that includes this as a blacklisted character. I'm aware that there's a threat related to Oracle ...
0
votes
0answers
16 views
Replacing single quote with double single quote (SQL Injection sanitation) [duplicate]
Let's say I want to sql inject into a site, and the textbox is for my name. My name is U'ser Smith. The code is handling the single quote by replacing any instance of ' with '' on the users input only....
1
vote
0answers
80 views
SQLmap error (what happen if i have no parameters)
I have an error when I use sqlmap. The problem is: I use this dork https://www.exploit-db.com/ghdb/4301/
but I do not know how to use sqlmap with this type of sql injection.
I use the classic:
...
0
votes
4answers
129 views
Is it possible to verify if a website is vulnerable to SQLi by viewing its source code?
I've heard the eval() function is vulnerable to SQLi.
Can I check for vulnerabilities by simply viewing the website source code?
1
vote
0answers
59 views
SQL Injection in a simple form [closed]
There is a form that I'm trying to crack it. It has two fields: username & password.
When I enter 1'; WAITFOR DELAY '00:00:15' -- in username, it tries to load for about 40 seconds, then it shows ...
1
vote
1answer
126 views
DVWA: “Hacking attempt detected…”
Hello and good evening,
i've recently tried to improve my pentesting skills and learn more about it with metasploitable 2. I am trying some things on the DVWA.
For the moment, i am learning the ...
0
votes
2answers
130 views
SQL Injection : How to begin when the id parameter value is not numeric
I am learning SQL injection currently and I feel I am quite comfortable doing Basic SQL injection. I am learning it by solving online challenges and so far I have only come across situations where the ...
-1
votes
1answer
84 views
Attempting SQLi against website with WAF filter [closed]
I was pentesting a website when I discovered that the URL included the id parameter. Because of this, I knew that the id parameter might be vulnerable to SQLi. I received a 200 response and found no ...
0
votes
1answer
63 views
can a token be used for sql injection
I have a token that is restricted to read only access.
If someone obtains that token, can they use it to do a sql injection attack?
Given that the token is permissioned for read only, can someone ...
1
vote
1answer
50 views
Is the hosting OS safe to sql injection hackers by hiding admin ID?
We are 1-3 guys maintaining a fairly large but clumsy developed-in-house website. With around 900+ mysql tables, and a lot of data access code in PHP. Let's say it is huge amount of code for just 1 or ...
13
votes
6answers
8k views
What pages are vulnerable to SQL injection?
I believe I understand the basics of SQL injection. I also know using prepared statements with PHP files is the best way to prevent SQL injection. I was always told that SQL injection happens most ...
0
votes
1answer
149 views
Can website get hacked by iframe injection?
My website has been hacked. I am observing how hacker accesses my site. Though I have been using bindparam to prevent from sql injection and direct access restriction for backdoor attack, hacker's ...
3
votes
2answers
119 views
Is it plausible to enforce authorisation on SQL generated from “Client-side”?
Background
We know that SQL Injection (OWASP Top 10) is the most prevalent security vulnerability on websites today. The strategies for mitigating the risk are well known. But are these only ...
2
votes
1answer
115 views
Impact of SQL injection on SELECT statement
During a routine penetration test I encountered a possibility for SQL injection. The following criteria apply:
Microsoft SQL Server (2016);
Query has to start with SELECT;
The semicolon ; is not ...
1
vote
1answer
55 views
Using a transaction as mitigation against SQL injection
Considering a generic stored procedure that is subject to SQL injection:
CREATE PROC usp_badproc
@sql NVARCHAR(8000)
AS BEGIN
EXEC(@sql)
END
and operating under the assumptions that
the ...
0
votes
0answers
65 views
is it possible to insert data using sql injection in select statement?
First of all i am testing it on my server for learning purpose.
The condition here is i want to insert a entry in test table in database and
SELECT * FROM `student` WHERE `name` LIKE '% ".$name." %';...
0
votes
1answer
36 views
Applying regexp for user input validation using JavaScript
As a full-stack developer I am buliding an webapp for tennis club in codeignitor framework. During making html forms on client side and writing scripts for validation of user input. i thought would ...
0
votes
1answer
94 views
About SQL Injection Mysql
I'm trying to test SQL injection on a site (PHP, uses MySQL Database). When I put an apostrophe in the username field and leave the password box blank, after submitting, the form reloads and the ...
-2
votes
1answer
152 views
Can just adding an apostrophe to input lead to SQLi that makes changes in the database?
If I try to find a SQL injection vulnerability in an admin login form by putting an apostrophe after the username (username') and write a password, will this vulnerability checking effect or modify ...
0
votes
3answers
88 views
SQL injection with filtered column names
I have the following MySQL query susceptible to an injection and I need to extract the password of a given user:
SELECT * FROM users WHERE login='$login' and password='$password'
However from the ...
34
votes
11answers
9k views
How to limit the impact of and reduce the risk of SQL injection for existing website?
Our website is 100% API based (with an SPA client). Recently, a hacker managed to get our admin's password (hashed with SHA-256) through SQL injection (and cracking pwd) like this:
https://example....
9
votes
3answers
512 views
How could our passwords be cracked so easily?
We are saving password in a database using PHP:
return hash('sha256', PASSWORD_SALT . $password);
Recently a (fortunately) good hacker SQL-injected us and cracked some passwords including the admin ...
0
votes
1answer
100 views
Problem with Time based SQL injection payload for specific web app
The web app is a sample vulnerable one, and it's quite simple, yet I can't craft a suitable payload.
Here is the code:
<?php
$UA = $_SERVER['HTTP_USER_AGENT']
$DB_USER = "user";
$DB_PASS = "p@ss";
...
4
votes
1answer
139 views
Possible SQL injection vulnerability?
I'm a developer and I'm creating a script to interface with game servers to update player stats. I was sending a POST request with multipart form data and on the last boundary accidentally had the ...
0
votes
0answers
37 views
Blackbox SQLi: MySql “error in your SQL syntax” when larger “UNSIGNED BIGINT”
I'm trying to blackbox pentest a website, the URL has the form http://example.com/a/[integer_value]/something_else
When trying to change [integer_value] to quotes (double and single), characters. It ...
0
votes
1answer
47 views
SQL Query Sanatization
It seems to me SQL injection could be avoided by just converting everything to a simple encoding like base64 that doesn't have any harmful symbols.
In the classic query "SELECT * FROM users WHERE ...
0
votes
2answers
286 views
SQL Injection with an uninjectable URL
I was recently given a subdomain to try and exploit with SQLi: gov.ns.agency. Unlike what I would see in most tutorials, I can't really inject parameters into the URL like I would see everywhere else.
...
80
votes
19answers
16k views
Good analogy needed: Sec issues due to different coders implementing the same features in different ways for the same app
I have to give a school presentation about vulnerabilities found in the Moodle platform. Of course, they only apply to a legacy version which has since been patched.
The catch is that the ...
