Questions tagged [sql-injection]

SQL injection is a technique used to take advantage of vulnerabilities arising from non-validated input on web applications to pass SQL commands through for execution on a backend database.

0
votes
0answers
4 views

Understanding SQLMAP payload

I was participating in a CTF and there was a SQL Injection challenge. There is a Wordpress page with a vulnerable plugin parameter (let's call the website https://vulnerable.com/), and the solution ...
3
votes
1answer
77 views

Security concerns in disseminating database design?

I work for a government agency, and we've been requested via a freedom of information request for the layout of the tables of one of our systems, a data dictionary and schema design request. What are ...
0
votes
0answers
40 views

How to send file with SQLMap

Note: this is a challenge in a past CTF. There is a webapp where you can submit an image that contains some text and the app will run an OCR and search for the text in a database. The app is ...
2
votes
3answers
12k views

SQLMap: How to dump tables that begin with a specific letter?

I would like to know the command of SQLMap, which permits me to retreive just tables that begin with a special letter. Example with letter "T": sqlmap.py -u www.website -D database -T tables (...)
1
vote
2answers
354 views

SQL-injection, unable to get it to work!

I've recently found a SQL-injection vulnerability in one of our web applications. I've been able to exploit this SQLi, but only able to extract some very basic information. I'm not an expert pentester ...
1
vote
1answer
361 views

Sql injection bypass against KONA(akmai) WAF

I have been trying to find sql injection against a site in bug bounty.I tried a few parameters via sql map.One such query was shown to be injectible. Parameter: query (GET) Type: boolean-based ...
1
vote
1answer
918 views

Custom post data JSON payload format in sqlmap?

I want to perform SQL injection but I don't know how to use the command. So far, I have tried this: --data="{'user_id':'6','user_with:5*'}" --prefix=" OR user_to = 5)" --suffix="#" -vvv` I use ' ...
2
votes
1answer
839 views

What is the nature of this SQL injection attack?

I rather foolishly allowed SQL injection into my server under certain circumstances. However I can't quite see what the attack achieves, and how to repair whatever-it-is that was done. This is the ...
15
votes
6answers
21k views

xp_cmdshell: should it ever be used?

Can xp_cmdshell ever be used safely within a stored proc and are there any situations for which there really is no other option? In other words, should its usage within a stored proc always be flagged ...
0
votes
0answers
40 views

Boolean blind SQLi with sqlmap

I am trying to run sqlmap in order to find a flag for a CTF. The injection string is sent via a POST request in the parameter called search. The response is received as either 1, 2, or 3 (error codes),...
0
votes
1answer
412 views

From SQL Injection in SQLite to shell

I need to obtain a shell from an SQL injection over an application with sqlite database. Currently my exploit looks like the following: lucian@0x90:~/$ proxychains nc 10.185.10.55 1101 ProxyChains-3....
1
vote
1answer
84 views

What kind of attack is a request like this?

The number of request strings like this one seems to have increased over the last weeks. They all have in common, that they contain a combination of google adwords / google adsense parameters and sql ...
0
votes
0answers
131 views

'=' 'OR' SQL Injection Login Bypass Question [duplicate]

I was testing SQLI Cheatsheets on a vulnerable test site. This particular injection '=' 'OR' seems to work on the login page. Why does that injection work? What's the back-end SQL code, if I could ...
-1
votes
1answer
93 views

SQLI Login Bypass Cheat-sheets Question [duplicate]

Assuming you are authorized to pentest a live website that's login page is vulnerable to SQL Injection. Lets say your backpack has only 2 crafted queries by you which is admin' -- and '=' 'OR'. Your ...
2
votes
1answer
304 views

' OR 1=1/* SQL Injection Login Bypass Question

Recently I came across a SQL Injection Cheat Sheet which contains this particular cheat sheet which I am confused by ' or 1=1/* Assuming I am testing it on this server-side code below. SELECT * FROM ...
0
votes
1answer
178 views

SQL injection authentication bypass

I am testing a SQLi login bypass on the PHP code below: if(isset($_POST["login"]) && isset($_POST["password"])) { $sql="select * from users where login='{$_POST["login"]}' and password='{$...
5
votes
1answer
2k views

SQLmap injection not working, manually it works fine

I have built a vulnerable web application to demonstrate SQL injection. I want to show both manual injection and automated injection. The injection requires a) the user to be logged in (session cookie)...
0
votes
1answer
138 views

Bypass login with SQL injection with additional password check

I'm having some fun with SQL injection attacks, and I'm currently attempting to bypass a login using SQLi. I think I've figured out the SQL query just fine, however this module also implemented an ...
12
votes
4answers
19k views

How does stored procedure prevents SQL injection?

May be I am not much clear about the stored procedure. Can someone explain me how stored procedure prevents SQL injection with a simple example using MySql.
2
votes
1answer
118 views

Got warnings last night from a SQL injection attack - What were they trying to do?

In sum, they tried 10 different commands. The site is ran on Wordpress, but has a security plugin that, "blocked a page visit to your site." I'm curious as to what they were trying to go after though....
0
votes
1answer
382 views

SQL inject MariaDB with SQLMAP

I'm fairly new to sqlmap but I have tried a lot of attacks and have been successful except for this one attack that I have tried. SQLMAP won't detect this nor try to inject an error like this. So how ...
3
votes
2answers
158 views

Possible SQLi with self-made prepared statements and real_escape_string?

My current assignment is to find a possible SQL injection in a PHP WebApp. While looking at the source code, I noticed that the way the script is handling prepared statments is weird. $query = db::...
3
votes
0answers
56 views

How Can Exploit Xss and Sqli via HTTP Verb Tampering?

I was reading a paper about 'HTTP Verb Tampering' here: https://blog.jeremiahgrossman.com/2008/06/what-you-need-to-know-about-http-verb.html The author said: 2) HTTP Verb tampering is generally ...
0
votes
2answers
103 views

Exploiting SQL Injection Vulnerability Using Logical Errors [closed]

<?php /* CREATE TABLE `message` ( `remote_addr` TEXT NOT NULL , `user_agent` TEXT NOT NULL , `name` TEXT NOT NULL , `text` TEXT NOT NULL ) ENGINE = MYISAM ; INSERT INTO `message` (`remote_addr`, `...
0
votes
0answers
73 views

SQLMAP injection with dynamic token?

I've a web app that has an injection point in POST data. POST data requires 4 params and one of these is a session-custom token. The problem is that every time request is made i need to get a new ...
1
vote
1answer
202 views

Mysql Information schema column_privileges empty

I can try some SQL-injection against a ad-hoc damn web application in my virtual enviroment for educational purpose. In one of these I obtain the table column_privileges (of Mysql Information schema) ...
9
votes
3answers
6k views

SQL Injection Escaping Challenge Security Shepherd

I am using Security Shepherd as a training tool and I am now in challenge SQL Injection Escaping Challenge. The challenge is as it can be seen below: When I makae a query just like the one above (...
0
votes
0answers
280 views

How to use binary search for blind SQL injection queries

From what I read online, it's possible to apply binary search to exploit blind SQL injection vulnerabilities, and that is probably what tools like sqlmap use to lower the number of queries that need ...
1
vote
2answers
848 views

DVWA: “Hacking attempt detected…”

Hello and good evening, i've recently tried to improve my pentesting skills and learn more about it with metasploitable 2. I am trying some things on the DVWA. For the moment, i am learning the ...
0
votes
2answers
1k views

SQL Injection with an uninjectable URL

I was recently given a subdomain to try and exploit with SQLi: gov.ns.agency. Unlike what I would see in most tutorials, I can't really inject parameters into the URL like I would see everywhere else. ...
0
votes
2answers
652 views

Getting the column names of a table by brute force blind SQL injection

Is there a way of getting the column names of a table by brute force blind SQL injection in MySQL. so the query would be: select column_name from information_schema.columns WHERE table_name = ‘...
0
votes
1answer
3k views

How to Perform SQL insert or update command using SQL injection

I have a URL http://localhost/usernfo.php?id=8 on which SQL injection can be performed. How can I perform an Update, Insert or Delete command from this link after I have got the structure of the ...
1
vote
0answers
62 views

WAF is set to Alert, not block. We are seeing thousands of XSS and SQL Injection attacks. How can I tell if any were actually successful?

I'm pretty inexperienced with WAFs and the events/alerts it generates. I'm wondering how I can tell if any of those were successful? For example, in the last 24 hours we saw over 50K alerts/events ...
3
votes
1answer
722 views

False positive SQL Injection by ZAP with adding new parameter query

I have a spring MVC web application and am running ZAP Active scan on it. I noticed that ZAP will modify URL , and add additional parameter named query and value query+AND+1%3D1+--+ to test SQL ...
2
votes
0answers
251 views

How do I use sqlmap to dump the OWASP Juice Shop schema?

EDIT 4/12/19: Added reproduction steps. I cannot seem to get sqlmap to successfully exploit and retrieve schema information from OWASP's deliberately vulnerable Juice Shop web application. I've ...
0
votes
1answer
310 views

sqlmap - Testing parameters when reading request from file

After hours of trial an error I decided to ask here for some advice. I am currently trying to perform a sqlinj using using sqlmap on a system that was specifically designed to be attacked. The API ...
0
votes
1answer
98 views

Is removing semi-colons an effective defense against SQL injection?

So obviously there is a security error if I have some code like this execute("Select * where {} = {}".format(input1, input2)) As someone can simply, for input1, send in 1=1; DROP Table Users-- and ...
1
vote
2answers
76 views

When to perform secure code review?

OWASP recommends that secure code review to be performed throughout the SDLC process. Although it makes sense to perform secure code review before moving codes to production, could anyone here help ...
0
votes
1answer
59 views

SQL injection in Windows Services?

I have many Windows services which run on the server side only. It performs few CRUD operations on a database (MySQL). There is a client application which allows a user to upload files through it to ...
1
vote
1answer
84 views

Sqlmap, update query and risk param

I was reading about the 'risk' param for sqlmap, and the docs contain information, that risk 3 level can update tables. What does it mean? As far as I understand, this can happen either in the app ...
0
votes
0answers
31 views

SQL injection in Go with database/sql lib

Is it possible to inject SQL statements with fmt.Sprintf instead of Db.qwery with the ? and not %s parameter? I know it's a bad habit to use it but I wonder if it's possible or not. Example : query :...
1
vote
1answer
143 views

“Malformed URL” string when trying to inject SQL

I'm trying to check if a particular form of a web app belonging to a bug bounty project is vulnerable to SQL injection. After inserting a malformed URL, I get this message on my browser: "Malformed ...
1
vote
1answer
184 views

SQL Injection after Like Operator with continuing query

is it possible to add a new query like update in between this?: SELECT characters.id as charId FROM characters WHERE characters.name LIKE '%<User-Input-Here>%' ORDER BY `level` DESC, exp DESC ...
-2
votes
3answers
214 views

How can I stay anonymous in a LAN without Internet access?

I need to perform attacks (SQL injection) on a server. I thought of using a proxy to be anonymous, but the topology is a LAN without Internet access. I have no idea of the protocols used in the ...
3
votes
1answer
327 views

What is this injection attack trying to accomplish?

My site has been repeatedly hit with this query. I am wondering what the attacker is trying to gain? The URL is: my.site/content/page.aspx?myID=15641111111111111%20UNION%20SELECT%20cAsT(0x2d78312d512d%...
0
votes
1answer
176 views

SQLmap after burp possible injection point

Burp states that a GET request have surely a SQL injection point. I am using python sqlmap.py -r file_with_that_request.txt --level 5 --risk 3 --dbms=oracle but the injectiont doesn't work. Am I ...
0
votes
1answer
178 views

Is this website vulnerable to an SQL injection?

I have a SquirrelMail server setup, and when I play with the mailbox parameter in the following GET query example.com/src/right_main.php?PG_SHOWALL=0&sort=0&startMessage=1&mailbox=Drafts%...
0
votes
0answers
126 views

Error based SQL Injection Oracle

I have this valid GET request: GET /restrict/menuApc.do?ID_ASSISTITO=ciao&MVPG=ApcAssistitiRicerca&s_TIPO_ASSISTITO=&s_ASSISTITO=giovanni&s_TIPO_SOGGETTO= HTTP/1.1 Host: test:8080 ...
1
vote
0answers
259 views

SQLmap check sql burp vulnerability

Burp suggests me that an application has an SQL injection point. First request: GET /restrict/menuApc.do?MVPG=ApcAssistitoTSRicercaPre&ASSISTITO_ID=*SRVZOSA40002294'&s_ELIMINATI=1&...
0
votes
1answer
334 views

SQL injection using union statement

I have a table with lots of user info - email, password and others. The server performs this query without using prepared statements: SELECT * FROM login where email = '$_POST'; I want to do an SQL ...