Questions tagged [sql-injection]

SQL injection is a technique used to take advantage of vulnerabilities arising from non-validated input on web applications to pass SQL commands through for execution on a backend database.

Filter by
Sorted by
Tagged with
2
votes
1answer
73 views

bypassing metacharacter filtering

So I am trying to bypass metacharacter filtering. I want to know how do you start an injection. For example if the ' is filtered how do you begin the input. If i did ' or 1=1# without filtering it ...
0
votes
1answer
123 views

SQL injection and XSS prevention

I would kindly ask you to review the following code and tell me if it's enough to prevent most of SQL injection and XSS attacks. SQL injection: treated via PDO prepared statements; XSS: All user's ...
0
votes
1answer
53 views

sql injection mitigation by signed db entries?

In a php/mysql based system I work on, they recently found several SQL injection vulnerabilities. Those come from 3rd party plugins, and I must assume there are more to be discovered. My major concern ...
0
votes
0answers
18 views

.php code in .txt file with eval() function [duplicate]

I have found three files with name as below: a.phpfile.txt b.phpfile.txt c.phpfile.txt when i open, each file contained with the following code: <?php @eval($_POST[x]); I have deleted all ...
0
votes
2answers
183 views

SQLMap Cookie Injectioin with Working Manual SQLi

I'm using an existing exploit which calls for a cookie called wp_sap to be set with the following value: ["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,@@version,11#"] This works ...
1
vote
1answer
75 views

ORDER BY sort direction is exploitable in SQL Injection?

I am testing an internal application and come across a page where if I am able to make the application display a SQL error because it does not recognize the payload for ORDER BY sort direction. The ...
0
votes
1answer
101 views

How can I write a function that will log a user in an old system without knowing any username or password? [closed]

I'm studying Internet Security and I learned something about code injection in older websites (using the string ' OR 1 == 1 // as a username will log in with any password provided); but what if a ...
0
votes
1answer
51 views

How to best limit SQL injection attacks that are being funneled through an Apache proxy I control

I use an Apache proxy to funnel traffic to an IIS server. The IIS server sends me emails if some bad actor attacks my site with an sql injection attack. It captures their IP address, and sends me the ...
8
votes
7answers
31k views

Are there any tools for scanning for SQL injection vulnerabilities while logged in?

Some pages of my website were vulnerable to SQL injection. The injection worked only when the user was logged in. I have now fixed this problem, and now I want to make sure that no similar problems ...
0
votes
0answers
42 views

SQLmap automation

I'm automating SQL injection using sqlmap. Is there someone who managed to parse sqlmap console output to only report critical findings (vulnerable pages to SQL injection)? The tool doesn't support ...
1
vote
1answer
61 views

Multi-byte character exploit

I read this answer, It explains how a multi-byte character exploit works in a decent way, the only way I could think of avoiding this problem is whitelisting all single-byte characters because of the ...
2
votes
2answers
7k views

Sqlmap and multipart/form-data forms

I'm working on some security for a website that is built in classic ASP and MS SQL 2000. I've successfully found a couple of flawed forms that allowed SQL injections through the form fields by using ...
0
votes
1answer
55 views

Having problems with SQL injection with mysqli extension PHP

I am new to SQL injections, and people on Reddit asked me do the portswigger labs. Which I did up till before 2nd order ones. So I am pretty comfortable with usual SQL injections. Now I have myself ...
16
votes
6answers
24k views

xp_cmdshell: should it ever be used?

Can xp_cmdshell ever be used safely within a stored proc and are there any situations for which there really is no other option? In other words, should its usage within a stored proc always be flagged ...
1
vote
2answers
699 views

SQL-injection, unable to get it to work!

I've recently found a SQL-injection vulnerability in one of our web applications. I've been able to exploit this SQLi, but only able to extract some very basic information. I'm not an expert pentester ...
1
vote
1answer
2k views

Sql injection bypass against KONA(akmai) WAF

I have been trying to find sql injection against a site in bug bounty.I tried a few parameters via sql map.One such query was shown to be injectible. Parameter: query (GET) Type: boolean-based ...
1
vote
1answer
2k views

Custom post data JSON payload format in sqlmap?

I want to perform SQL injection but I don't know how to use the command. So far, I have tried this: --data="{'user_id':'6','user_with:5*'}" --prefix=" OR user_to = 5)" --suffix="#" -vvv` I use ' ...
0
votes
0answers
53 views

Sqlmap waf bypass

This is my first post here, sorry for my english. Im making some test around, because i want to learn more about sql injection. Im not really good as manual sql injection, so im using sqlmap. what ...
0
votes
1answer
54 views

SQLmap finds injectable 'id' parameter but the response is 'Internal Server Error'

I am trying to understand the SQLi so I ran SQLMap with '-vvv' parameter 4: Show also HTTP requests. I did scan one of the vulnerable and 'free to hack' sites. In one of the requests sent, the ...
1
vote
2answers
112 views

Develop and test a vulnerable login system

I'm a beginner on course to be an expert (hopefully) and I've been set assignments to test security systems on the web. The whole assignment is to prepare, test and document the results to correlate ...
0
votes
0answers
91 views

What type of attack is this? '[0]

This is the example query: GET directory/file.txt?lang=it'[0] HTTP/1.1 I don't know what language it is. The ' (single quote) reminds me of a SQL Injection. I don't think it's a typo because I saw ...
0
votes
1answer
64 views

How to find vulnerable PHP parameter such as `.php?id=` as found in Kioptrix 3?

This is part of my preparation for OSCP. According to https://www.vulnhub.com/entry/kioptrix-level-12-3,24/, Kioptrix 3 is vulnerable to SQL Injection. However, I found that SQLi challenge on ...
2
votes
4answers
9k views

Simple SQL injection to bypass login in MariaDB

I'm trying out SQL Injection on my localhost. I have a simple HTML form, with a username, password and a submit button. So after clicking on the submit, user is redirected from login.html to a page ...
0
votes
1answer
64 views

How are biometrics tougher to crack than a pin?

When I hear that bio-metrics are tougher to crack, it's left ambiguous as to whether they refer to the term 'hack' as simply getting through the system by guessing the password or mimicking the person....
1
vote
1answer
39 views

How do SRP (and PAKE generally) protect against verifier leak

I have been reading into PAKE protocols, specifically starting with SRP RFC2945 The gist of the requirement on the server is that the server saves triplet (username, verifier (v), salt (s)) in the ...
0
votes
2answers
185 views

In SQL injection why don't we use OR 1 or OR 2>1 instead of OR 1=1?

I read everywhere regarding SQL injection where it is said that if SQL query is: SELECT * FROM table_name where username='xxxxx' AND password ='xxxx' and if you want to enter always true condition ...
0
votes
1answer
2k views

SQL inject MariaDB with SQLMAP

I'm fairly new to sqlmap but I have tried a lot of attacks and have been successful except for this one attack that I have tried. SQLMAP won't detect this nor try to inject an error like this. So how ...
1
vote
0answers
65 views

Possibility of dynamically generated prepared statements and stored procedure SQL injection?

I am working on Java application which generate SQL prepared statements and stored procedure query strings using user inputs and executes with PreparedStatement.execute() or CallableStatement.execute()...
0
votes
1answer
41 views

What to do if right table has more columns than left table for UNION injection?

I'm trying an injection on the following SQL statement: SELECT * FROM Products WHERE ((name LIKE '%Apple%' OR description LIKE '%Apple') I've determined that the Products table has 9 columns, and ...
0
votes
0answers
44 views

Drupal 8 - Create REST API vulnerable to SQL Injection for CTF purposes

Recently I started creating a CTF challenge based on Drupal 8. I want to create a REST API parameter that will be vulnerable to SQLi. Even if this isn't something I should ask for here, I decided to ...
1
vote
3answers
122 views

Prevent SQL injections on the old PHP website using software

A friend of mine works for a company which owns a 15-ish years old website written in PHP using Apache/MySQL/home brew CMS and outdated hosting on OS Debian 8 "jessie". SSH allows passwords (with no ...
0
votes
0answers
30 views

Unable to exploit SQL injection in the parameter

During my testing I have found a vulnerable parameter in an API (/api/v1/documents/?direction=desc&limit=30&mode=reports**&page=1**) and its parameter is page=1 at the end. Upon giving the ...
3
votes
1answer
49 views

Sql map Manual Vulnerability Assessment

I am trying to do penetration testing for one of my client. The platform is Code ignitor. There is an endpoint /find/1 The function queries the vehicle table where vehicle ID is 1 with no sanity check....
1
vote
1answer
83 views

What does the last single quote of the sql injection query: ' or “1”=“1” ' mean

I couldn't fully grasp why the last single quote of the sql query: ' or "1"="1" ' is necessary. So I understand the part until the last single quote '. The first single quote enables to inject the sql ...
21
votes
2answers
34k views

Cross site scripting when the greater than and less than signs are escaped?

If a website encodes < to &lt; and > becomes &gt;, is it still possible to perform cross site scripting? What would you enclose the script tags in? For example, on one of my sites I can ...
1
vote
1answer
247 views

Mysql Information schema column_privileges empty

I can try some SQL-injection against a ad-hoc damn web application in my virtual enviroment for educational purpose. In one of these I obtain the table column_privileges (of Mysql Information schema) ...
26
votes
12answers
6k views

Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql real escape string() function

Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql_real_escape_string() function?
-4
votes
3answers
63 views

Why is using prepared statements in PHP considered best practice?

Let me first start by stating that I am by no means a webdeveloper, so please do point out if I'm going in the wrong somewhere in my story. I think most people agree with the idea that using prepared ...
0
votes
2answers
2k views

SQL Injection with an uninjectable URL

I was recently given a subdomain to try and exploit with SQLi: gov.ns.agency. Unlike what I would see in most tutorials, I can't really inject parameters into the URL like I would see everywhere else. ...
0
votes
0answers
73 views

Out-of-band Sql Injection

When I was doing some security research, I found an unexpected query in a POST request like this: q=select%20*%20from%20x%20where%20a%20%3D%20'%7B%22something%22%3A%22blah%22%2C...%7D' Where the ...
1
vote
1answer
106 views

SQL injection with no output

So I found this section of a webpage, which is a basic "feedback box". It had all the characteristics of an SQL injectable element. Scanned it with OWASP, it was true. Tried SQLmap, it gave me ...
3
votes
1answer
1k views

False positive SQL Injection by ZAP with adding new parameter query

I have a spring MVC web application and am running ZAP Active scan on it. I noticed that ZAP will modify URL , and add additional parameter named query and value query+AND+1%3D1+--+ to test SQL ...
3
votes
3answers
156 views

Is SQL injection still a bad thing if the user is restricted to non-harmful queries?

Suppose I have a very simple PHP application that acts as a front-end for an SQL database. The user enters their query into a box, and the app shows the query results in a table. To prevent a user ...
50
votes
1answer
9k views

In SQL injections why do they put “— -” at the end of the URL?

I understand when they put a + at the end, URL treats it like a space. I want to know what -- - does. I do know what the "double dash" does. Including the double dash with a "space at the end". I ...
0
votes
0answers
48 views

SQLsus injections failed

I’m trying to inject a website using sqlsus tool on Kali, but i keep getting a failure message, I’ve changed the website I’m testing even though I’m sure it’s vulnerable, but still a failure message. ...
0
votes
1answer
2k views

sqlmap - Testing parameters when reading request from file

After hours of trial an error I decided to ask here for some advice. I am currently trying to perform a sqlinj using using sqlmap on a system that was specifically designed to be attacked. The API ...
1
vote
1answer
43 views

How to input generic type or determine data types for selected values in UNION ALL SQL injection attack?

I've determined that the application is vulnerable to SQL injection and the proper amount of values to SELECT in the corresponding UNION ALL query: foo' UNION ALL SELECT '1','1','1','1','1','1','1','...
1
vote
1answer
256 views

There seems to have been an attempt to attack my website [duplicate]

I am using PHP as a server side language. And I don't use CMS or Framework. From the nginx log the website attack seems obvious. I wonder what kind of attack the attacker attempted. The attacker ...
3
votes
1answer
97 views

Making SQL/HTML Injection attacks programmatically impossible

Apparently having 100% prevention of SQL Injection and XSS attacks is easier said than done, but why? Can't static code analysis tools ensure that all user supplied input vectors (including user ...
1
vote
0answers
105 views

XSS / SQL Injection Attacks with Character Encoding Mixups

Are there any character encoding mixup attacks that are still a threat in 2020? Such as with XSS or SQL injection being the most obvious. Some examples: Tricking a browser to display a page in UTF-...

1
2 3 4 5
17