Questions tagged [sql-injection]
SQL injection is a technique used to take advantage of vulnerabilities arising from non-validated input on web applications to pass SQL commands through for execution on a backend database.
748
questions
0
votes
0answers
17 views
SQL injection with UNION and two queries with same input
Say there are two queries, which are called after each other: one to get the amount datasets in the table, one to get the result of the actual query:
select count(*) as total from table_a where ...
1
vote
0answers
28 views
how to get shell from blind sql injection?
im trying to gain access to a web server after i found i blind sql inejction on the website .. i used sqlmap to automate thinks .. i can read the databases and tables .. first i try to crack the MD5 ...
0
votes
0answers
34 views
What are some common and advanced web server exploits? [closed]
Currently, I am testing my own website for vulnerabilities and had a question. I know the basic of pentesting such as sql injection, cross site scripting, etc. I wanted to know on what common methods ...
1
vote
1answer
38 views
Can Blind SQL/Boolean Based SQL Injections not contain break characters or comparisons?
I'm using a scanner which passes subtraction attack traffic such as (1-1), (3-2), (5-2), etc. There are no break or continuation characters such as semicolons or &&, nor is there a comparison ...
-2
votes
3answers
164 views
Is a web application firewall enough to defend against sql injection? or should I use prepared statements?
Is it enough to rely on a web application firewall for protection against SQL injection? or should I use other techniques?
During a conversation with a friend he said it is enough to use web ...
4
votes
3answers
180 views
What is the risk of an attacker inserting new password hashes?
The normal threat model that I see with password hashing is as a kind of defense against if the hash somehow leaks to the wider world. In practice, this appears to usually be via some manner of ...
1
vote
1answer
91 views
Is sql injection possible on this websocket?
I was testing a websocket when i found an add to cart request like the following
["{\"ITEMS\":{\"ITEM\":[{\"package_id\":\"123\",\"customer_type\":\"3\",\"qty\":1,\"}"]
I tried to edit the value of ...
0
votes
1answer
124 views
How does this NoSQL injection work? [closed]
Could someone explain what this is doing and how it works? I already know about SQL injection but the NoSQL is confusing.
This is a lecture slide from my professor but he provides very little context....
0
votes
1answer
43 views
Character filtration in globalisation supported application
I am working on building an application which will be used in various language , to secure from attacks like xss, SQL injection I thought implementing character filteration (whitelisting/blacking) but ...
0
votes
0answers
81 views
SQL Injection bypass UNION filter/restriciton
I've recently had an interesting interview exercise I haven't completed and it does puzzle me what kind of filter/protection they've used.
The vuln app is a PHP with simple MariaDB (5.5.56) back-end, ...
-1
votes
1answer
67 views
mysql_query | Why " breaks query but ' does not?
I ran across an opportunity for SQL injection the other day in some legacy code ...
// input: email@email.com"
$email = $_POST['email'];
mysql_query('SELECT * FROM users WHERE email = "'.$email.'" ');...
1
vote
1answer
57 views
Exploiting incorrectly escaped `mysql_query() or die(mysql_error())` to exfiltrate data?
I ran across some legacy code that uses mysql_query($sql) or die(mysql_error())
Was curious and noticed that with a correctly placed " in the email input ... I am shown output from mysql_error() as a ...
1
vote
2answers
100 views
Is there any way to find all the endpoints for any website for sql injection? [closed]
I'm wondering, if it's possible to discover all the endpoints for any product which is prone to SQL injection.
I want all the endpoints where I can apply SQL injection on my site.
2
votes
1answer
123 views
What security implications are involved when using a CSV file to fill a SQL table?
I have some data on CSV files and I want automate the input of this data into an SQL database using Powershell. The data is mostly, if not completely, numbers.
I am using a script based on the one ...
3
votes
2answers
164 views
Mysql injection with a single `USE` statement
I know you need prepared statements and such to avoid SQL injection, and I've seen that there are different questions about exploits for SELECT, INSERT, UPDATE injectable queries.
But I couldn't come ...
1
vote
1answer
62 views
Is emulated SQL query preparation less secure?
I have been looking at PDO attributes, specifically at resources (some are linked at the end of this post) saying that emulated query preparation is less secure than using real prepared statements, ...
1
vote
0answers
62 views
how to create random request time delay in sqlmap?
How can i configure sql-map to try payloads at random time delay?
as an example time between first and second request can be 0.10s and second and third might 0.25 and so on.
i know there is --delay ...
1
vote
1answer
30 views
How to input generic type or determine data types for selected values in UNION ALL SQL injection attack?
I've determined that the application is vulnerable to SQL injection and the proper amount of values to SELECT in the corresponding UNION ALL query:
foo' UNION ALL SELECT '1','1','1','1','1','1','1','...
2
votes
1answer
114 views
Why do I need an space at the end for this SQL Injection to work?
This is the vulnerable code:
$order = isset($_GET["order{$i}"]) ? $_GET["order{$i}"] : '';
if (stripos($order, 'benchmark') !== false) die;
${"result$i"} = $db->query("SELECT * FROM {$tables[$i]} "...
1
vote
1answer
84 views
What kinds of attacks are possible with credentials to a read-only Postgres user?
Assuming I implement the literal SQL-injection on an HTTP endpoint with a read-only user that limits execution time to e.g. some amount of seconds. What's the worst that could happen? I know simple ...
0
votes
1answer
125 views
Securing a website for my school project [closed]
I have been given a task to secure a website which will be done by my group mates, but I have no clue. Could someone give my ideas? and how I am going to protect? what code can I use to secure login ...
10
votes
2answers
250 views
Understanding SQLMAP payload
I was participating in a CTF and there was a SQL Injection challenge. There is a Wordpress page with a vulnerable plugin parameter (let's call the website https://vulnerable.com/), and the solution ...
3
votes
1answer
83 views
Security concerns in disseminating database design?
I work for a government agency, and we've been requested via a freedom of information request for the layout of the tables of one of our systems, a data dictionary and schema design request.
What are ...
0
votes
0answers
108 views
How to send file with SQLMap
Note: this is a challenge in a past CTF.
There is a webapp where you can submit an image that contains some text and the app will run an OCR and search for the text in a database. The app is ...
0
votes
0answers
107 views
Boolean blind SQLi with sqlmap
I am trying to run sqlmap in order to find a flag for a CTF. The injection string is sent via a POST request in the parameter called search. The response is received as either 1, 2, or 3 (error codes),...
-1
votes
1answer
257 views
SQLI Login Bypass Cheat-sheets Question [duplicate]
Assuming you are authorized to pentest a live website that's login page is vulnerable to SQL Injection.
Lets say your backpack has only 2 crafted queries by you which is admin' -- and '=' 'OR'.
Your ...
0
votes
0answers
134 views
'=' 'OR' SQL Injection Login Bypass Question [duplicate]
I was testing SQLI Cheatsheets on a vulnerable test site.
This particular injection '=' 'OR' seems to work on the login page.
Why does that injection work? What's the back-end SQL code, if I could ...
0
votes
1answer
285 views
Bypass login with SQL injection with additional password check
I'm having some fun with SQL injection attacks, and I'm currently attempting to bypass a login using SQLi.
I think I've figured out the SQL query just fine, however this module also implemented an ...
2
votes
1answer
131 views
Got warnings last night from a SQL injection attack - What were they trying to do?
In sum, they tried 10 different commands. The site is ran on Wordpress, but has a security plugin that, "blocked a page visit to your site." I'm curious as to what they were trying to go after though....
2
votes
1answer
726 views
' OR 1=1/* SQL Injection Login Bypass Question
Recently I came across a SQL Injection Cheat Sheet which contains this particular cheat sheet which I am confused by ' or 1=1/*
Assuming I am testing it on this server-side code below.
SELECT * FROM ...
0
votes
1answer
195 views
SQL injection authentication bypass
I am testing a SQLi login bypass on the PHP code below:
if(isset($_POST["login"]) && isset($_POST["password"])) {
$sql="select * from users where login='{$_POST["login"]}' and password='{$...
3
votes
0answers
101 views
How Can Exploit Xss and Sqli via HTTP Verb Tampering?
I was reading a paper about 'HTTP Verb Tampering' here:
https://blog.jeremiahgrossman.com/2008/06/what-you-need-to-know-about-http-verb.html
The author said:
2) HTTP Verb tampering is generally ...
0
votes
0answers
152 views
SQLMAP injection with dynamic token?
I've a web app that has an injection point in POST data.
POST data requires 4 params and one of these is a session-custom token. The problem is that every time request is made i need to get a new ...
0
votes
2answers
118 views
Exploiting SQL Injection Vulnerability Using Logical Errors [closed]
<?php
/*
CREATE TABLE `message` (
`remote_addr` TEXT NOT NULL ,
`user_agent` TEXT NOT NULL ,
`name` TEXT NOT NULL ,
`text` TEXT NOT NULL
) ENGINE = MYISAM ;
INSERT INTO `message` (`remote_addr`, `...
1
vote
0answers
70 views
WAF is set to Alert, not block. We are seeing thousands of XSS and SQL Injection attacks. How can I tell if any were actually successful?
I'm pretty inexperienced with WAFs and the events/alerts it generates. I'm wondering how I can tell if any of those were successful? For example, in the last 24 hours we saw over 50K alerts/events ...
3
votes
1answer
453 views
How do I use sqlmap to dump the OWASP Juice Shop schema?
I cannot seem to get sqlmap to successfully exploit and retrieve schema information from OWASP's deliberately vulnerable Juice Shop web application.
I've tried to be very specific in my sqlmap ...
1
vote
1answer
148 views
What kind of attack is a request like this?
The number of request strings like this one seems to have increased over the last weeks. They all have in common, that they contain a combination of google adwords / google adsense parameters and sql ...
0
votes
1answer
102 views
Is removing semi-colons an effective defense against SQL injection?
So obviously there is a security error if I have some code like this
execute("Select * where {} = {}".format(input1, input2))
As someone can simply, for input1, send in 1=1; DROP Table Users-- and ...
1
vote
2answers
80 views
When to perform secure code review?
OWASP recommends that secure code review to be performed throughout the SDLC process. Although it makes sense to perform secure code review before moving codes to production, could anyone here help ...
0
votes
1answer
62 views
SQL injection in Windows Services?
I have many Windows services which run on the server side only. It performs few CRUD operations on a database (MySQL).
There is a client application which allows a user to upload files through it to ...
1
vote
1answer
118 views
Sqlmap, update query and risk param
I was reading about the 'risk' param for sqlmap, and the docs contain information, that risk 3 level can update tables. What does it mean? As far as I understand, this can happen either in the app ...
0
votes
0answers
37 views
SQL injection in Go with database/sql lib
Is it possible to inject SQL statements with fmt.Sprintf instead of Db.qwery with the ? and not %s parameter? I know it's a bad habit to use it but I wonder if it's possible or not.
Example :
query :...
1
vote
1answer
187 views
“Malformed URL” string when trying to inject SQL
I'm trying to check if a particular form of a web app belonging to a bug bounty project is vulnerable to SQL injection.
After inserting a malformed URL, I get this message on my browser: "Malformed ...
1
vote
1answer
277 views
SQL Injection after Like Operator with continuing query
is it possible to add a new query like update in between this?:
SELECT characters.id as charId
FROM characters
WHERE characters.name
LIKE '%<User-Input-Here>%'
ORDER BY `level` DESC, exp DESC
...
-2
votes
3answers
270 views
How can I stay anonymous in a LAN without Internet access?
I need to perform attacks (SQL injection) on a server. I thought of using a proxy to be anonymous, but the topology is a LAN without Internet access. I have no idea of the protocols used in the ...
0
votes
1answer
438 views
sqlmap - Testing parameters when reading request from file
After hours of trial an error I decided to ask here for some advice.
I am currently trying to perform a sqlinj using using sqlmap on a system that was specifically designed to be attacked.
The API ...
0
votes
1answer
183 views
Is this website vulnerable to an SQL injection?
I have a SquirrelMail server setup, and when I play with the mailbox parameter in the following GET query
example.com/src/right_main.php?PG_SHOWALL=0&sort=0&startMessage=1&mailbox=Drafts%...
0
votes
1answer
473 views
SQL injection using union statement
I have a table with lots of user info - email, password and others. The server performs this query without using prepared statements:
SELECT * FROM login where email = '$_POST';
I want to do an SQL ...
1
vote
2answers
596 views
SQL Injection on MariaDB
I am trying to exploit (legally) a MariaDb database with an SQLi vulnerability.
I have identified the vulnerability here...
/?o=1&page=app
The o=* is vulnerable and produces the following error....
0
votes
1answer
313 views
What would be an example of an attack that exploits escape characters?
As far as I know escape characters are characters which change the meaning of the following character. In HTML for example the & is an escape character that declares the beginning of an entity ...
