Questions tagged [sql-injection]

SQL injection is a technique used to take advantage of vulnerabilities arising from non-validated input on web applications to pass SQL commands through for execution on a backend database.

Filter by
Sorted by
Tagged with
0
votes
0answers
35 views

manual SQL injection syntax error on MySQL

I am doing a SQL injection training with TryHackMe as shown below. https://tryhackme.com/room/ccpentesting task 18 I am trying to do it the manual way. From the guide online I know that to get the SQL ...
0
votes
0answers
36 views

Sqlmap won't pick up injection point. Tweak?

I manually found an injection point, on CTF VM, located on POST form. I found it with the following manual payload : 1' OR SLEEP(1)-- t I would like to use sqlmap. I ended with following call : ...
10
votes
3answers
6k views

No -*|%/ and no whitespace, is this SQL injectable?

I have an SQL query like "select * from records where record like '%" + user_input + "%'" My goal here is to get all the records. So far everything I have tried involves using ...
0
votes
0answers
13 views

Sql injection how does getting data outside from susposed rows works? [duplicate]

Let's say there is some vulnerable page and it gets SQL injected. PHP on the backend only returns specific rows and does not return passwords in any way. How do people get the passwords using that?
1
vote
0answers
80 views

SQL Injection Prevention WAF Generic Rule for Wordpress

We are trying to develop a GENERIC WAF Rule for SQLI Prevention for WordPress-based websites that can provide some level of effectiveness with a very low probability of having false positives. From my ...
1
vote
0answers
75 views

Attack on a string created by a developer

Go and Java have "compile time constants", and JavaScript will soon get a feature that allows "Distinguishing strings from a trusted developer from strings that may be attacker ...
0
votes
0answers
176 views

SQLMap - Invalid character detected. retrying

I recently discovered an time-based blind SQL injection attack on one of the websites. I was able to dump the data with 100 threads (By default, SQLmap doesn't allow more than 10 but, I modified the ...
1
vote
1answer
76 views

Bypass input validation

I'm trying to create a vulnerable sandbox environment for pentesting challenges. As part of the challenge, I want to include some elements of XSS or SQLi if possible. However, I do not wish to make ...
0
votes
0answers
57 views

how to dump all first row of table in several database using SQLmap? [duplicate]

I have several databases in each one, several tables, I am trying to extract the first row from each table from several databases using sqlmap.
0
votes
1answer
50 views

Escaping out of a select query to run a statement that modifies data in the database

Lets say you use SELECT * FROM ($query) sub where you can swap $query to any query you wish. Is there a way to escape this select and run a command that modifies data in the database?
0
votes
0answers
126 views

SQL injection to RCE with load_file , into outfile etc

I know it is possible to get RCE with SQLi but I can't write to web root, I can only write files to /tmp folder. I can upload shell.php in /tmp without problems, but I'm curious is there any other way ...
1
vote
1answer
258 views

Using sqlmap for detecting SQLi on Juice shop's login page

New Sqlmap user, so please be patient :) I've started looking at the tool and I'm curious about its use. For instance, the login page of OWASP's Juice shop is vulnerable to sql injection (' OR 1=1-- ...
0
votes
1answer
107 views

SQL Injection with Filters

I have a SQLite Query, which is something like: SELECT id FROM demo WHERE name="insertname". In this case, double-quotes are disabled, which means that insertname cannot contain double-...
0
votes
1answer
124 views

How to configure SQLMap to attack JSON parameter?

Part of a box I'm doing, I can successfully pass basic SQL query 'or'1'='1 with no errors, {"search":"'or'1'='1"} Output: HTTP/1.0 200 OK Trying to error the query {"search&...
1
vote
3answers
216 views

Can you protect against SQLi without using prepared statements?

I am learning about SQLi (SQL injection) and I know that the solution to avoid them is prepared statements. However, does this mean that without them we are sure that we can get hacked? Are prepared ...
0
votes
2answers
56 views

SQL Injection syntax inquiry-commented injections

I have some programming experience, but am having trouble with SQL injection code. I don't understand why there's sometimes SQL syntax after the comment character (such as -- or #). I know that -- - ...
1
vote
0answers
102 views

Can sqlmap be used to extract data if the attack is blind?

I'm solving this challenge/lab where SQLi is inside the cookie parameter. After solving it manually, I thought to check if it can extract data. I used sqlmap with --cookie=COOKIE* (Notice * that's the ...
0
votes
0answers
51 views

sqlmap: why use concat and JSON_ARRAYAGG

I have run sqlmap through burpsuite and to get the existing databases it ran this query 1 UNION ALL SELECT NULL,NULL,CONCAT(0x7171717671,JSON_ARRAYAGG(CONCAT_WS(0x6a716a6c6a68,schema_name)),...
1
vote
0answers
51 views

Server response delays without having provided a time-based blind SQL injection input

I am new to SQL injection. When I was researching a bug bounty site protected by cloudflare, unsurprisingly, entering email@gmail.com' OR 1=1--, to test SQL injection, did not work. So later, trying ...
0
votes
0answers
89 views

Backendly preventing database injections on simple web forms [duplicate]

I have a simple PHP-HTML-CSS contact form which saves emails to a local email client's database (in my case, Roundcube's database, which is a standalone MySQL database, I think --- I haven't used the ...
1
vote
0answers
214 views

Is it possible to enumerate Microsoft Access database using sqlmap?

I'm trying to enumerate a Microsoft Access database using sqlmap, in particular I run this command: sqlmap -r http.txt --risk 2 --dump-all Anyway it seems is not retrieving a single information. Am I ...
14
votes
2answers
3k views

SQL injection inside XSS

Is it possible to perform an SQL injection inside an XSS attack? And if so, where can I find information on this or some examples?
1
vote
1answer
93 views

Blind SQL Injection POC in Java

I am looking for some java applications (other than Manage Engine) vulnerable to Blind SQL Injection attacks for Authentication Bypass. I explored exploitdb and others but didn't find anything ...
1
vote
1answer
50 views

Is it possible to get an sql injection after importing a sql dump?

Is it possible that after I dump a SQL Database created with prepared statements as an ".sql" file, and then I import it again, that the import may be vulnerable to SQL Injections?
1
vote
2answers
186 views

Cannot perform SQL injection because of the weird postgresql syntax that is used

I have a website that uses ManageEngine Service Plus and it has a SQL injection vulnerability the linksays that with the help of the following url we would be able to inject postgresql commands to get ...
1
vote
1answer
237 views

Sqlmap Sleepy User-Agent

I was testing Burp Suite Crawl on some old php sites I made and it found Sleepy User-Agent SQL injection vulnerability User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, ...
0
votes
2answers
57 views

How to connect to a MariaDB database after collecting data about users and passwords with a SQLI? [closed]

I'm trying to breach a dummy MariaDB database which is vulnerable to SQLI and is storing sensitive data about its users and their passwords. I've collected all the data I could collect, but now how am ...
1
vote
0answers
63 views

SQL Injection Problem

I was practising on OWASP Mutillidae, and I met a problem. There's a task that examines our knowledge of UNION query. The vulnerable query is: SELECT * FROM accounts WHERE username=' The accounts ...
1
vote
1answer
120 views

Blind SQL Injection

I am participating in a program that when I write in the url parameter ' or 1=1;-- it gives me Forbidden 403 and when I write in the parameter ' or 1=2;-- it shows me the page. Is the website and ...
0
votes
0answers
72 views

What tools/checklists can help determine the presence of malicious code in a database? MS SQL specifically

Consider a scenario, where your AV / EDR software has to exclude paths of database files as suggested by vendors to avoid affecting performance or stability issues. You want to review your database ...
0
votes
1answer
69 views

SQL Injection with long data type

All the examples of an SQL injections that I've seen have a user controlled string variable that was directly used to construct the SQL query but, I was wondering if it's possible to perform an SQL ...
1
vote
1answer
88 views

SQLinjection prevention: parser + blacklist?

I know the best way to prevent SQL-injection is parameterized queries. But this is not possible in the specific use case because the client has to be able to input SQL statements directly. So what my ...
0
votes
0answers
64 views

Is that SQL query exploitable for really malicious things

I have following SQL query in my WordPress plugin, SELECT `ID`, `post_content` FROM `wp_posts` WHERE `post_type` = 'movie' AND `post_status` = 'publish' OR `post_status` = 'private' AND `ID` NOT ...
0
votes
2answers
87 views

Is union based mysql injection able to read files outside database?

Can files outside database which are not part of any tables in database be read via union based SQL injection? For eg http://xyz.com/fetch?id=3 Consider id parameter is used at server side by cursor ...
1
vote
2answers
206 views

SQL injection using brute force?

I am studying about cyber defense lately for fun and found about a proposed method that as I understand it performs automated SQL injection using brute force by training a model. At some point it says ...
0
votes
1answer
119 views

Does Injection Attack Against SQL Server Require Semicolon or Comment?

In creating a blacklist function as part of our multi-pronged defense against SQL injection that includes parameterized queries and validating for length and type of input, we are creating a Blacklist ...
1
vote
0answers
52 views

When using parameterized SQL queries, is there still any *security* issue with simply blindly accepting user input variables?

Suppose I have this: parameterized_database_call('SELECT * FROM widgets WHERE id = $1', $_GET['widget_id']); The SQL query is parameterized, as I've done for many years now. (I'm trying to repress ...
0
votes
0answers
56 views

SQL Injection Training challenge including a PHP file

I’m currently trying to get some knowledge in SQL injection. In a pen test environment, there is a challenge on which you get the PHP file and you need to try to login using SQL Injection. I’ve ...
0
votes
1answer
120 views

SQLi Filter Bypass with banned table/column names

I've studying and practicing different approach to SQLi filter bypass and I faced a challenge. What if the WAF filters look for specific strings rather than SQL keywords? Example: Filter: /UNION/ SQLi:...
1
vote
2answers
197 views

What is this attack? id=1'[0]

I'm frequently getting these weird URLs. https://mywebsite.com/mymage.php?id=1'[0] The weird part is '[0]. The webpage pass the id to the database and the database expect an integer so we are ...
0
votes
0answers
138 views

Error Based SQL Injection

I have a MySQL lab challenge where I send id=1‘ and select @@version;# then manage to trigger an error. But the part of the error response that has my version info looks like it comes back in binary (...
0
votes
0answers
137 views

Understanding sqlmap's payload for blind sql injection

I am fairly new to sql injections and tried to solve a little hackit to understand everything better. I wasn't able to solve one of the levels so I ran sqlmap to see what it would do. The payloads ...
0
votes
1answer
76 views

Can attack to a website from a parked subdomain with different hosts?

I have a website like maindomain.com that hosted on a different hosting like 192.168.1.1 i want to add a subdomain from a different host like 192.168.1.2 to my main domain which my address will be ...
0
votes
2answers
627 views

SQL injection without the use of union and select

I was wondering if there is a way to use SELECT and UNION keywords without being caught by a algorithm (see below) that filters these keywords out. $filter = array('UNION', 'SELECT'); // Remove ...
0
votes
1answer
73 views

Trying to do an SQL injection into a login field [closed]

I have an assignment to make an SQL injection - I found a login field that spits out an error, but I can't seem to make queries work inside of it. For your information it's an Mysql server. What is ...
0
votes
1answer
345 views

SQL Injection and Hidden parameter modification

A friend of mine gave me a web application for me to test and find vulnerabilities. He told me that this web application can be purposefully modified and then made to run an SQL injection. I have ...
0
votes
0answers
131 views

Execute sqlmap in a javaScript object cookie

I am studying sqli and I found a blind sqli vulnerability in a cookie and I have exploited manually, however, I would like to detect and exploit it with sqlmap. Cookie looks like javascript object ...
1
vote
1answer
301 views

Blind SQL injection in sort direction

I have an SQL injection in a query where I control the sort direction parameter i.e: SELECT * from x where y=y ORDER BY COLUMN_NAME [SORT_DIRECTION] When I control the SORT_DIRECTION, which is ...
0
votes
2answers
2k views

Never use stored session in sqlmap

I am trying to make sqlmap to avoid fetch data from stored session. How do I achieve that? I have performed sqlmap check once on a target and now that target is offline, I want sqlmap to just stop the ...
-1
votes
1answer
400 views

How to continue performing checks on a site if sqlmap found an issue on a URL of the same site while using --batch option?

I have a file /tmp/urls which has following URLs: http://127.0.0.1:8081/?id=1 http://127.0.0.1:8081/?id2=1 I am using this command to perform checks on file URLs concurrently: python3 sqlmap.py --...

1
2 3 4 5
18