Questions tagged [sql-injection]
SQL injection is a technique used to take advantage of vulnerabilities arising from non-validated input on web applications to pass SQL commands through for execution on a backend database.
888
questions
0
votes
1
answer
27
views
SQL Injection "Error 1 - Operand should contain 1 column(s)"
I am injecting:
-35' and updatexml(null,concat(0x3a,(0x0a,(select database()))),null)-- -
and I am receiving:
Error 1 - Operand should contain 1 column(s)
Any idea how to fix this?
I am trying to ...
0
votes
0
answers
22
views
What are vulnerabilities of saving user input directly in wordpress plugin?
I have a WordPress plugin that helps create an organization chart/tree and then generates a URL where the chart is available to be viewed by the public.
The plugin dashboard looks like this
the plugin ...
1
vote
1
answer
87
views
Why does this SQL injection have an equals symbol?
I was reading into the basics of SQL injection attacks on w3schools here.
In the second example, I was curious as to why the equal sign was used. I have quoted within the line below.
" or "&...
- 327
0
votes
0
answers
17
views
How does the --os-shell parameter in Sqlmap work? Is it still anonymous over Tor?
How does the --os-shell parameter in Sqlmap work? I know its uploading a backdoor, but how is sqlmap uploading it and is the file just a normal reverse shell trojan?
And is it still anonymous when ...
- 122
1
vote
3
answers
133
views
What account do you enter when using ' or '1'='1?
So I'm writing a paper on sql injection for my db class and one thing I don't understand is this.
I assumed that one of the reasons a lot of sites don't allow duplicate usernames is that they use ...
- 13
4
votes
1
answer
195
views
What is this attacker trying to do by making edits to Stack Exchange posts?
While reviewing the suggested edits for the Personal Finance & Money Stack Exchange site, I came across some strange proposed edits:
Example 1:
Example 2:
This looks like some kind of attempt at ...
- 583
0
votes
1
answer
25
views
What is the wisdom of using the ASCII function in exploit SQLi?
I mean, I can exploit the vulnerability using a substring function and without using an ASCII function like:
SELECT username FROM users WHERE id = 1 AND (SELECT substring(password,1,1) FROM users ...
1
vote
1
answer
75
views
How secure and anonymous is the --tor parameter in Sqlmap?
How secure and anonymous is the --tor parameter in Sqlmap?
Does it really send every request over Tor and does it have any IP/DNS/STUN requests leak loopholes?
- 122
1
vote
0
answers
66
views
SQL Injection in an Update clause SQLite engine - Affect other tables?
I have an SQL Injection in an update SQL query that is run against an SQLite database in it's default configuration. The query itself is somewhat similar to the following:
"UPDATE user SET active ...
- 111
1
vote
0
answers
167
views
Bypass sql injection filtering (whitespace, /, *) [closed]
I want to bypass a sql injection waf that replaces /,* and whitespaces.
This is a payload I want use :
?parameter=22321'union select CAST(normal_column AS bigint),'a','b' from normal_table--
But the ...
- 11
0
votes
0
answers
36
views
How to modify a database through SQL injection UNION?
I need help with an sqli exercise. I used sqlmap to find a UNION vulnerability.
I managed to get the H2 version with this payload:
string') UNION ALL SELECT NULL,H2VERSION(),NULL,NULL,NULL--
But I ...
- 1
4
votes
1
answer
141
views
Does "row-level security" actually serve a security purpose?
Row-level security is often an industry requirement in secure environments, such as those dealing with payment cards.
It's supported by most major relational databases, including PostgreSQL, Microsoft ...
- 5,308
3
votes
1
answer
88
views
Bypassing "OR" SQLi filter
I am trying to bypass a filter on a black-box SQL injection CTF that likely looks like /or/i. I suspect the filter is in a WAF somewhere in between me and the target.
To get the OR keyword, I use ||.
...
- 178
1
vote
2
answers
230
views
SQL Injection detected
I was loading my sites front end and watching the responses in burpsuite when I noticed a response which contained a very verbose sql error
"message": "SQLSTATE[22P02]: Invalid text ...
- 95
0
votes
0
answers
71
views
SQL injection into LIMIT in MySQL 8
Given a query such as:
SELECT * FROM users limit 1,$limit
Is there a way to exploit this when using MySQL 8 and the standard PHP MySQL functions (ie no multi_query)?
What I have tried (unsuccessfully)...
- 29k
0
votes
1
answer
144
views
Cloudflare SQLinjection protection
I'm testing for vulnerabilities for a specific site using sqlmap. However, the site has a cloudflare firewall which blocks queries including for example *, ANY or OR. I sort of found a bypass while ...
- 1
0
votes
1
answer
153
views
How to bypass this silly SQL injection protection?
I'm currently dealing with a SQL injection problem that involves an input being taken and put through a function that replaces all ' with \' and all \ with \\. I've tried a lot of things but I don't ...
- 3
0
votes
0
answers
148
views
SQLMAP payloads don't work manually, why?
I was trying out SQLMAP on DVWA (medium security for SQL injection), and I did get a set of payloads (sqlmap chucked out a few payloads that should have worked). But entered manually, I couldn't get ...
- 1
0
votes
1
answer
59
views
SQLi with error messages but no output
With the authorization of the owner, I was testing a website and when I put in some sql query and has some syntax error, it shows me, but when I test it with a parameter like
p.php?id=66+/*!...
- 9
0
votes
2
answers
132
views
Is SQL Injection possible in ORDER BY before LIMIT?
I'm using MySQL with Mybatis library. And I found the code below:
SELECT *
FROM tableA
WHERE xxx
ORDER BY ${inputA} ${inputB}
LIMIT #{inputC}
I know there are many ways to inject the ORDER BY, but ...
- 1
1
vote
1
answer
115
views
API Sql Injection Need help
I need some help with sqli in API.
Webserver IIS 8.5
GET request looks like this
...
https://example.com/api/Search?q=Landing
Response look like this
HTTP/1.1 200 OK
...
[{"pageId":1,"...
- 11
0
votes
0
answers
87
views
Is this stored procedure vulnerable to SQL injection?
My question is about what exploits are possible given the following, not how to prevent SQL injection. I would not use this code in a real application.
Using MSSQL Server 2019, imagine a stored ...
- 1
0
votes
0
answers
78
views
How could this SQL injection with a `SHOW` statement be exploited?
I have the following scenario:
The mysql request looks like
SHOW INDEX FROM `<table>` from `<database>`
The <database> is a user input and is vulnerable to injection. For example I ...
- 13
0
votes
0
answers
127
views
Possible no sql injection?
We are developing a application in Dotnet MVC with mongodb as a database.
We use below mentioned query in order fetch the data from the database.
Controller code:
[Get("getmsg")]
Public ...
- 449
0
votes
0
answers
78
views
How can I replicate or mitigate this reported SQL Injection vulnerability?
We have a .Net WebForms-based website, hosted on IIS10 behind HAProxy on pfSense. We've performed many vulnerability scans and penetration tests on the site over the years, with only minor issues ever ...
- 101
0
votes
0
answers
126
views
Blind MSSQL Injection - Stacked query in cookies
I am currently working on a bug bounty program and in one subdomain of my target there is a Blind SQL flaw in a cookie. The back-end is MSSQL/ASP.net however, since cookies are separated by semicolons ...
0
votes
2
answers
93
views
What are the security vulnerability of letting users insert anything to a nvarchar sql column?
I have several Web APIs that are used by the UI, for these APIs I have several validations that prevent users from adding invalid data. On the other hand, I have some APIs that are not used by any UI, ...
- 101
0
votes
0
answers
139
views
Sqlmap, All tested parameters do not appear to be injectable
I am new to SQLMAP, I have been practicing with the Altoro Mutual portal which is a vulnerable portal, just enter the code 'OR 1 = 1 - in one of its forms (Login) and we will obtain administrator ...
- 1
0
votes
0
answers
114
views
manual SQL injection syntax error on MySQL
I am doing a SQL injection training with TryHackMe as shown below. https://tryhackme.com/room/ccpentesting task 18
I am trying to do it the manual way. From the guide online I know that to get the SQL ...
- 103
0
votes
1
answer
195
views
Sqlmap won't pick up injection point. Tweak?
I manually found an injection point, on CTF VM, located on POST form. I found it with the following manual payload :
1' OR SLEEP(1)-- t
I would like to use sqlmap. I ended with following call :
...
- 103
10
votes
3
answers
6k
views
No -*|%/ and no whitespace, is this SQL injectable?
I have an SQL query like "select * from records where record like '%" + user_input + "%'" My goal here is to get all the records. So far everything I have tried involves using ...
user212222
0
votes
0
answers
13
views
Sql injection how does getting data outside from susposed rows works? [duplicate]
Let's say there is some vulnerable page and it gets SQL injected. PHP on the backend only returns specific rows and does not return passwords in any way. How do people get the passwords using that?
- 27
1
vote
0
answers
130
views
SQL Injection Prevention WAF Generic Rule for Wordpress
We are trying to develop a GENERIC WAF Rule for SQLI Prevention for WordPress-based websites that can provide some level of effectiveness with a very low probability of having false positives.
From my ...
- 11
1
vote
0
answers
117
views
Attack on a string created by a developer
Go and Java have "compile time constants", and JavaScript will soon get a feature that allows "Distinguishing strings from a trusted developer from strings that may be attacker ...
- 111
0
votes
0
answers
861
views
SQLMap - Invalid character detected. retrying
I recently discovered an time-based blind SQL injection attack on one of the websites. I was able to dump the data with 100 threads (By default, SQLmap doesn't allow more than 10 but, I modified the ...
- 606
1
vote
1
answer
462
views
Bypass input validation
I'm trying to create a vulnerable sandbox environment for pentesting challenges. As part of the challenge, I want to include some elements of XSS or SQLi if possible. However, I do not wish to make ...
- 15
0
votes
1
answer
92
views
Escaping out of a select query to run a statement that modifies data in the database
Lets say you use SELECT * FROM ($query) sub where you can swap $query to any query you wish. Is there a way to escape this select and run a command that modifies data in the database?
- 101
1
vote
1
answer
844
views
Using sqlmap for detecting SQLi on Juice shop's login page
New Sqlmap user, so please be patient :)
I've started looking at the tool and I'm curious about its use. For instance, the login page of OWASP's Juice shop is vulnerable to sql injection (' OR 1=1-- ...
- 113
0
votes
1
answer
175
views
SQL Injection with Filters
I have a SQLite Query, which is something like:
SELECT id FROM demo WHERE name="insertname".
In this case, double-quotes are disabled, which means that insertname cannot contain double-...
user212222
1
vote
1
answer
317
views
How to configure SQLMap to attack JSON parameter?
Part of a box I'm doing, I can successfully pass basic SQL query 'or'1'='1 with no errors,
{"search":"'or'1'='1"}
Output:
HTTP/1.0 200 OK
Trying to error the query
{"search&...
- 21
1
vote
3
answers
382
views
Can you protect against SQLi without using prepared statements?
I am learning about SQLi (SQL injection) and I know that the solution to avoid them is prepared statements. However, does this mean that without them we are sure that we can get hacked? Are prepared ...
- 21
0
votes
2
answers
124
views
SQL Injection syntax inquiry-commented injections
I have some programming experience, but am having trouble with SQL injection code. I don't understand why there's sometimes SQL syntax after the comment character (such as -- or #). I know that -- - ...
1
vote
0
answers
347
views
Can sqlmap be used to extract data if the attack is blind?
I'm solving this challenge/lab where SQLi is inside the cookie parameter. After solving it manually, I thought to check if it can extract data. I used sqlmap with --cookie=COOKIE* (Notice * that's the ...
- 11
1
vote
0
answers
104
views
Server response delays without having provided a time-based blind SQL injection input
I am new to SQL injection. When I was researching a bug bounty site protected by cloudflare, unsurprisingly, entering email@gmail.com' OR 1=1--, to test SQL injection, did not work.
So later, trying ...
- 575
0
votes
0
answers
91
views
Backendly preventing database injections on simple web forms [duplicate]
I have a simple PHP-HTML-CSS contact form which saves emails to a local email client's database (in my case, Roundcube's database, which is a standalone MySQL database, I think --- I haven't used the ...
1
vote
0
answers
523
views
Is it possible to enumerate Microsoft Access database using sqlmap?
I'm trying to enumerate a Microsoft Access database using sqlmap, in particular I run this command:
sqlmap -r http.txt --risk 2 --dump-all
Anyway it seems is not retrieving a single information. Am I ...
- 477
14
votes
1
answer
4k
views
SQL injection inside XSS
Is it possible to perform an SQL injection inside an XSS attack?
And if so, where can I find information on this or some examples?
- 243
1
vote
1
answer
177
views
Blind SQL Injection POC in Java
I am looking for some java applications (other than Manage Engine) vulnerable to Blind SQL Injection attacks for Authentication Bypass. I explored exploitdb and others but didn't find anything ...
- 201
1
vote
1
answer
99
views
Is it possible to get an sql injection after importing a sql dump?
Is it possible that after I dump a SQL Database created with prepared statements as an ".sql" file, and then I import it again, that the import may be vulnerable to SQL Injections?
- 113
1
vote
2
answers
737
views
Cannot perform SQL injection because of the weird postgresql syntax that is used
I have a website that uses ManageEngine Service Plus and it has a SQL injection vulnerability
the linksays that with the help of the following url we would be able to inject postgresql commands to get ...
- 21