Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [sql-injection]

SQL injection is a technique used to take advantage of vulnerabilities arising from non-validated input on web applications to pass SQL commands through for execution on a backend database.

Filter by
Sorted by
Tagged with
0 votes
1 answer
27 views

SQL Injection "Error 1 - Operand should contain 1 column(s)"

I am injecting: -35' and updatexml(null,concat(0x3a,(0x0a,(select database()))),null)-- - and I am receiving: Error 1 - Operand should contain 1 column(s) Any idea how to fix this? I am trying to ...
user avatar
0 votes
0 answers
22 views

What are vulnerabilities of saving user input directly in wordpress plugin?

I have a WordPress plugin that helps create an organization chart/tree and then generates a URL where the chart is available to be viewed by the public. The plugin dashboard looks like this the plugin ...
user avatar
1 vote
1 answer
87 views

Why does this SQL injection have an equals symbol?

I was reading into the basics of SQL injection attacks on w3schools here. In the second example, I was curious as to why the equal sign was used. I have quoted within the line below. " or "&...
user avatar
0 votes
0 answers
17 views

How does the --os-shell parameter in Sqlmap work? Is it still anonymous over Tor?

How does the --os-shell parameter in Sqlmap work? I know its uploading a backdoor, but how is sqlmap uploading it and is the file just a normal reverse shell trojan? And is it still anonymous when ...
user avatar
1 vote
3 answers
133 views

What account do you enter when using ' or '1'='1?

So I'm writing a paper on sql injection for my db class and one thing I don't understand is this. I assumed that one of the reasons a lot of sites don't allow duplicate usernames is that they use ...
user avatar
  • 13
4 votes
1 answer
195 views

What is this attacker trying to do by making edits to Stack Exchange posts?

While reviewing the suggested edits for the Personal Finance & Money Stack Exchange site, I came across some strange proposed edits: Example 1: Example 2: This looks like some kind of attempt at ...
user avatar
  • 583
0 votes
1 answer
25 views

What is the wisdom of using the ASCII function in exploit SQLi?

I mean, I can exploit the vulnerability using a substring function and without using an ASCII function like: SELECT username FROM users WHERE id = 1 AND (SELECT substring(password,1,1) FROM users ...
user avatar
1 vote
1 answer
75 views

How secure and anonymous is the --tor parameter in Sqlmap?

How secure and anonymous is the --tor parameter in Sqlmap? Does it really send every request over Tor and does it have any IP/DNS/STUN requests leak loopholes?
user avatar
1 vote
0 answers
66 views

SQL Injection in an Update clause SQLite engine - Affect other tables?

I have an SQL Injection in an update SQL query that is run against an SQLite database in it's default configuration. The query itself is somewhat similar to the following: "UPDATE user SET active ...
user avatar
  • 111
1 vote
0 answers
167 views

Bypass sql injection filtering (whitespace, /, *) [closed]

I want to bypass a sql injection waf that replaces /,* and whitespaces. This is a payload I want use : ?parameter=22321'union select CAST(normal_column AS bigint),'a','b' from normal_table-- But the ...
user avatar
  • 11
0 votes
0 answers
36 views

How to modify a database through SQL injection UNION?

I need help with an sqli exercise. I used sqlmap to find a UNION vulnerability. I managed to get the H2 version with this payload: string') UNION ALL SELECT NULL,H2VERSION(),NULL,NULL,NULL-- But I ...
user avatar
4 votes
1 answer
141 views

Does "row-level security" actually serve a security purpose?

Row-level security is often an industry requirement in secure environments, such as those dealing with payment cards. It's supported by most major relational databases, including PostgreSQL, Microsoft ...
user avatar
  • 5,308
3 votes
1 answer
88 views

Bypassing "OR" SQLi filter

I am trying to bypass a filter on a black-box SQL injection CTF that likely looks like /or/i. I suspect the filter is in a WAF somewhere in between me and the target. To get the OR keyword, I use ||. ...
user avatar
1 vote
2 answers
230 views

SQL Injection detected

I was loading my sites front end and watching the responses in burpsuite when I noticed a response which contained a very verbose sql error "message": "SQLSTATE[22P02]: Invalid text ...
user avatar
  • 95
0 votes
0 answers
71 views

SQL injection into LIMIT in MySQL 8

Given a query such as: SELECT * FROM users limit 1,$limit Is there a way to exploit this when using MySQL 8 and the standard PHP MySQL functions (ie no multi_query)? What I have tried (unsuccessfully)...
user avatar
  • 29k
0 votes
1 answer
144 views

Cloudflare SQLinjection protection

I'm testing for vulnerabilities for a specific site using sqlmap. However, the site has a cloudflare firewall which blocks queries including for example *, ANY or OR. I sort of found a bypass while ...
user avatar
0 votes
1 answer
153 views

How to bypass this silly SQL injection protection?

I'm currently dealing with a SQL injection problem that involves an input being taken and put through a function that replaces all ' with \' and all \ with \\. I've tried a lot of things but I don't ...
user avatar
0 votes
0 answers
148 views

SQLMAP payloads don't work manually, why?

I was trying out SQLMAP on DVWA (medium security for SQL injection), and I did get a set of payloads (sqlmap chucked out a few payloads that should have worked). But entered manually, I couldn't get ...
user avatar
  • 1
0 votes
1 answer
59 views

SQLi with error messages but no output

With the authorization of the owner, I was testing a website and when I put in some sql query and has some syntax error, it shows me, but when I test it with a parameter like p.php?id=66+/*!...
user avatar
  • 9
0 votes
2 answers
132 views

Is SQL Injection possible in ORDER BY before LIMIT?

I'm using MySQL with Mybatis library. And I found the code below: SELECT * FROM tableA WHERE xxx ORDER BY ${inputA} ${inputB} LIMIT #{inputC} I know there are many ways to inject the ORDER BY, but ...
user avatar
1 vote
1 answer
115 views

API Sql Injection Need help

I need some help with sqli in API. Webserver IIS 8.5 GET request looks like this ... https://example.com/api/Search?q=Landing Response look like this HTTP/1.1 200 OK ... [{"pageId":1,"...
user avatar
  • 11
0 votes
0 answers
87 views

Is this stored procedure vulnerable to SQL injection?

My question is about what exploits are possible given the following, not how to prevent SQL injection. I would not use this code in a real application. Using MSSQL Server 2019, imagine a stored ...
user avatar
  • 1
0 votes
0 answers
78 views

How could this SQL injection with a `SHOW` statement be exploited?

I have the following scenario: The mysql request looks like SHOW INDEX FROM `<table>` from `<database>` The <database> is a user input and is vulnerable to injection. For example I ...
user avatar
0 votes
0 answers
127 views

Possible no sql injection?

We are developing a application in Dotnet MVC with mongodb as a database. We use below mentioned query in order fetch the data from the database. Controller code: [Get("getmsg")] Public ...
user avatar
0 votes
0 answers
78 views

How can I replicate or mitigate this reported SQL Injection vulnerability?

We have a .Net WebForms-based website, hosted on IIS10 behind HAProxy on pfSense. We've performed many vulnerability scans and penetration tests on the site over the years, with only minor issues ever ...
user avatar
  • 101
0 votes
0 answers
126 views

Blind MSSQL Injection - Stacked query in cookies

I am currently working on a bug bounty program and in one subdomain of my target there is a Blind SQL flaw in a cookie. The back-end is MSSQL/ASP.net however, since cookies are separated by semicolons ...
user avatar
0 votes
2 answers
93 views

What are the security vulnerability of letting users insert anything to a nvarchar sql column?

I have several Web APIs that are used by the UI, for these APIs I have several validations that prevent users from adding invalid data. On the other hand, I have some APIs that are not used by any UI, ...
user avatar
  • 101
0 votes
0 answers
139 views

Sqlmap, All tested parameters do not appear to be injectable

I am new to SQLMAP, I have been practicing with the Altoro Mutual portal which is a vulnerable portal, just enter the code 'OR 1 = 1 - in one of its forms (Login) and we will obtain administrator ...
user avatar
0 votes
0 answers
114 views

manual SQL injection syntax error on MySQL

I am doing a SQL injection training with TryHackMe as shown below. https://tryhackme.com/room/ccpentesting task 18 I am trying to do it the manual way. From the guide online I know that to get the SQL ...
user avatar
0 votes
1 answer
195 views

Sqlmap won't pick up injection point. Tweak?

I manually found an injection point, on CTF VM, located on POST form. I found it with the following manual payload : 1' OR SLEEP(1)-- t I would like to use sqlmap. I ended with following call : ...
user avatar
  • 103
10 votes
3 answers
6k views

No -*|%/ and no whitespace, is this SQL injectable?

I have an SQL query like "select * from records where record like '%" + user_input + "%'" My goal here is to get all the records. So far everything I have tried involves using ...
user avatar
0 votes
0 answers
13 views

Sql injection how does getting data outside from susposed rows works? [duplicate]

Let's say there is some vulnerable page and it gets SQL injected. PHP on the backend only returns specific rows and does not return passwords in any way. How do people get the passwords using that?
user avatar
1 vote
0 answers
130 views

SQL Injection Prevention WAF Generic Rule for Wordpress

We are trying to develop a GENERIC WAF Rule for SQLI Prevention for WordPress-based websites that can provide some level of effectiveness with a very low probability of having false positives. From my ...
user avatar
  • 11
1 vote
0 answers
117 views

Attack on a string created by a developer

Go and Java have "compile time constants", and JavaScript will soon get a feature that allows "Distinguishing strings from a trusted developer from strings that may be attacker ...
user avatar
0 votes
0 answers
861 views

SQLMap - Invalid character detected. retrying

I recently discovered an time-based blind SQL injection attack on one of the websites. I was able to dump the data with 100 threads (By default, SQLmap doesn't allow more than 10 but, I modified the ...
user avatar
  • 606
1 vote
1 answer
462 views

Bypass input validation

I'm trying to create a vulnerable sandbox environment for pentesting challenges. As part of the challenge, I want to include some elements of XSS or SQLi if possible. However, I do not wish to make ...
user avatar
  • 15
0 votes
1 answer
92 views

Escaping out of a select query to run a statement that modifies data in the database

Lets say you use SELECT * FROM ($query) sub where you can swap $query to any query you wish. Is there a way to escape this select and run a command that modifies data in the database?
user avatar
1 vote
1 answer
844 views

Using sqlmap for detecting SQLi on Juice shop's login page

New Sqlmap user, so please be patient :) I've started looking at the tool and I'm curious about its use. For instance, the login page of OWASP's Juice shop is vulnerable to sql injection (' OR 1=1-- ...
user avatar
0 votes
1 answer
175 views

SQL Injection with Filters

I have a SQLite Query, which is something like: SELECT id FROM demo WHERE name="insertname". In this case, double-quotes are disabled, which means that insertname cannot contain double-...
user avatar
1 vote
1 answer
317 views

How to configure SQLMap to attack JSON parameter?

Part of a box I'm doing, I can successfully pass basic SQL query 'or'1'='1 with no errors, {"search":"'or'1'='1"} Output: HTTP/1.0 200 OK Trying to error the query {"search&...
user avatar
1 vote
3 answers
382 views

Can you protect against SQLi without using prepared statements?

I am learning about SQLi (SQL injection) and I know that the solution to avoid them is prepared statements. However, does this mean that without them we are sure that we can get hacked? Are prepared ...
user avatar
0 votes
2 answers
124 views

SQL Injection syntax inquiry-commented injections

I have some programming experience, but am having trouble with SQL injection code. I don't understand why there's sometimes SQL syntax after the comment character (such as -- or #). I know that -- - ...
user avatar
1 vote
0 answers
347 views

Can sqlmap be used to extract data if the attack is blind?

I'm solving this challenge/lab where SQLi is inside the cookie parameter. After solving it manually, I thought to check if it can extract data. I used sqlmap with --cookie=COOKIE* (Notice * that's the ...
user avatar
  • 11
1 vote
0 answers
104 views

Server response delays without having provided a time-based blind SQL injection input

I am new to SQL injection. When I was researching a bug bounty site protected by cloudflare, unsurprisingly, entering email@gmail.com' OR 1=1--, to test SQL injection, did not work. So later, trying ...
user avatar
0 votes
0 answers
91 views

Backendly preventing database injections on simple web forms [duplicate]

I have a simple PHP-HTML-CSS contact form which saves emails to a local email client's database (in my case, Roundcube's database, which is a standalone MySQL database, I think --- I haven't used the ...
user avatar
1 vote
0 answers
523 views

Is it possible to enumerate Microsoft Access database using sqlmap?

I'm trying to enumerate a Microsoft Access database using sqlmap, in particular I run this command: sqlmap -r http.txt --risk 2 --dump-all Anyway it seems is not retrieving a single information. Am I ...
user avatar
  • 477
14 votes
1 answer
4k views

SQL injection inside XSS

Is it possible to perform an SQL injection inside an XSS attack? And if so, where can I find information on this or some examples?
user avatar
  • 243
1 vote
1 answer
177 views

Blind SQL Injection POC in Java

I am looking for some java applications (other than Manage Engine) vulnerable to Blind SQL Injection attacks for Authentication Bypass. I explored exploitdb and others but didn't find anything ...
user avatar
  • 201
1 vote
1 answer
99 views

Is it possible to get an sql injection after importing a sql dump?

Is it possible that after I dump a SQL Database created with prepared statements as an ".sql" file, and then I import it again, that the import may be vulnerable to SQL Injections?
user avatar
  • 113
1 vote
2 answers
737 views

Cannot perform SQL injection because of the weird postgresql syntax that is used

I have a website that uses ManageEngine Service Plus and it has a SQL injection vulnerability the linksays that with the help of the following url we would be able to inject postgresql commands to get ...
user avatar

1
2 3 4 5
18