Questions tagged [sql-injection]

SQL injection is a technique used to take advantage of vulnerabilities arising from non-validated input on web applications to pass SQL commands through for execution on a backend database.

Filter by
Sorted by
Tagged with
3
votes
1answer
313 views

Is SQL Injection Possible without double and single quotes?

Let's assume we're building a SQL query like this: SELECT * FROM users WHERE username = 'Username' AND password='password' If we blocked the characters " and ', will an attacker be able to hack into ...
1
vote
1answer
411 views

Sql injection bypass against KONA(akmai) WAF

I have been trying to find sql injection against a site in bug bounty.I tried a few parameters via sql map.One such query was shown to be injectible. Parameter: query (GET) Type: boolean-based ...
1
vote
2answers
368 views

SQL-injection, unable to get it to work!

I've recently found a SQL-injection vulnerability in one of our web applications. I've been able to exploit this SQLi, but only able to extract some very basic information. I'm not an expert pentester ...
0
votes
1answer
114 views

SQL injection that bypasses website's firewall that filters table by its prefix

There is a website I am assessing for security breaches. It has Joomla 1.5.x with MySQL 5.5.24 and PHP 5.3.2. I am doing a penetration test, that exploits SQL injection. The thing is that WAF filters ...
0
votes
0answers
170 views

How trying to fetch limited entries using sqlmap?

I have 1 table (eg: users) with more than 1 million entries. But when using Sqlmap try to --start and --stop it's not Working. For example the query is: sqlmap.py -u http://example.com/index.php?id=...
1
vote
1answer
238 views

What type of attack is the below SQL injection?

Today in the apache access log I saw something like this https://xxxxx/xxxx/xx/something.html' or (1,2)=(select*from(select name_const(CHAR(103,119,111,107,69,82,84,99,118),1),name_const(CHAR(103,119,...
0
votes
0answers
61 views

Introduce a SQLi in a testing application

So I was building an application to demonstrate SQL injection via cookies and wrote some code to run SQL statements if the statement are passed within a redir cookie header but when using sqlmap to ...
4
votes
1answer
451 views

Is forbiding the ; char enough to prevent SQL injection?

Disclaimer: Parameterized queries are the way to go, no need to discuss about that :) I've seen the following code at a friends place: var query = "SELECT * FROM students WHERE name = " + name; ...
1
vote
0answers
212 views

How to find no of columns using sql injection

I'm new to web penetration testing and when I tried to test a website, I found that when I entered ' in the text box, I would get the following error: OraOLEDB error '80004005' ORA-01756: quoted ...
0
votes
2answers
150 views

SQLi with quote filter?

I'm doing some hacking courses, and in one of the lessons, I have a possible SQLi, but in the Python source code there's an if clause just before the SQL statement, which filters the quote symbol: ...
0
votes
1answer
528 views

SQl Injection MariaDB

Im found a sql query that is injectable below "car_info = query("select models, color, running from cars where manual = 1 AND UID = '{}' LIMIT 1".format(uid))") Where '{}' is the point of injection. ...
0
votes
1answer
415 views

SQL inject MariaDB with SQLMAP

I'm fairly new to sqlmap but I have tried a lot of attacks and have been successful except for this one attack that I have tried. SQLMAP won't detect this nor try to inject an error like this. So how ...
3
votes
2answers
162 views

Possible SQLi with self-made prepared statements and real_escape_string?

My current assignment is to find a possible SQL injection in a PHP WebApp. While looking at the source code, I noticed that the way the script is handling prepared statments is weird. $query = db::...
3
votes
1answer
353 views

What is this injection attack trying to accomplish?

My site has been repeatedly hit with this query. I am wondering what the attacker is trying to gain? The URL is: my.site/content/page.aspx?myID=15641111111111111%20UNION%20SELECT%20cAsT(0x2d78312d512d%...
1
vote
1answer
126 views

SQL injection with an auto-incrementing parameter

I'm currently performing an API Pentest and I suspect an SQLi in one of the API calls. It updates a certain item of the web-service and requires an increase of the version number for each request. ...
2
votes
0answers
200 views

SQLmap on Login. Expect 401 reponse

I'm using sqlmap to test a login. When using invalid credentials, the webserver sends back a 401 response. However, sqlmap interprets this response as I'm not authorized to call this page and needs ...
2
votes
1answer
294 views

SQL injection on PostgreSQL in integer field?

I was trying https://server/shared/sendemail?sendto=" and got this response: Database operation "0or1row" failed (exception ERROR, "ERROR: invalid input syntax for integer:""" LINE 4: where user_id ...
27
votes
1answer
7k views

Why should we sometimes use --+ instead of — in SQL injection to comment the rest of the query?

I have encountered some websites that when I used -- to comment the rest of the query it didn't work, but when I tried --+ it worked. In the MySQL official documentation there is no such thing as --+ ...
0
votes
2answers
261 views

Blind SQL Injection on Amazon RDS

I found a vulnerability which allows me to run any query on an Amazon RDS server. I was able to extract the user hashes by using the --passwords parameter of sqlmap, and one of the hashes was cracked ...
0
votes
3answers
741 views

Is SQL-injection a client-side or a server-side attack?

What type of attack is SQL-injection? I am confused because this type of attack is done through the client-side. However, the attackers target is a database which is "behind" a server. Most attacks ...
1
vote
2answers
367 views

Is SQL Injection possible in String Concatenation When all Variables are created by the Program

Say I have a program that returns some date strings from a function in javascript. function getDates() { var yesterday = [some code that gets current time with yesterday's date]; var today = [...
0
votes
1answer
547 views

Running sqlmap against a parameter inside a parameter

I have a domain in the format: example.com?host=http://anotherexample.com?bar=1 I want to attack the "bar" param, but sqlmap (correctly) parses the second url as a value of the foo param. Therefore I ...
0
votes
0answers
141 views

sqlmap: Upload file to get UUID to submit with main request?

I've been looking for a way to use sqlmap with a file-upload form that, when submitted, first uploads the given file to get back a UUID, which is then send along with the user information in another ...
-2
votes
2answers
462 views

What file types might be vulnerable to SQL injection? [closed]

I am learning about SQL injection and Google dorks. I have seen that there are three file types that can be vulnerable to SQL injection, .php, .aspx and one more. I can't find the third one... The ...
0
votes
2answers
134 views

Php parameters (username, password) in link

Little Info: I am not a web developer, I am a beginner to php and sql. Trying to learn in my free time. I was examining a web site on a remote server and i saw something like; www.myurl.com/login....
0
votes
3answers
1k views

Is SQL injection still a thing? [duplicate]

I was wondering whether SQL injection is still a thing or if it is mainly extinct due to the fact that I don't hear about corporations being hit by this vulnerability, And the last time I heard an ...
0
votes
1answer
482 views

bWAPP- SQL injection Hack displays a white screen?

I've been following this video(https://www.youtube.com/watch?v=XDCZ8FC856s) to install bWAPP on Parrot OS and everything works fine except SQL Injection. I've checked the database and its active. As ...
1
vote
1answer
160 views

Is this parameter vulnerable to SQL Injection?

The backend server is running Tomcat 8.5 (Java backend). The URL in question is: https://website.com/application/servlet.do?currentOID=abc12300000000 I found that when I give an incomplete OID (i.e ...
1
vote
1answer
346 views

How this Unique SQL injection works?

I found a challenge which was vulnerable to SQL injection and it was very very pretty hard to find So, How this unique SQL works? I found this on login form where when I send user=\&pass=||1# as ...
0
votes
1answer
1k views

How to use custom injection in sqlmap?

This is post data, normally looks like this {"end_date":"2018-8-26","start_date":"2018-8-26","success":1} Below resulting "You have an error ..." {"end_date":"2018-8-26'","start_date":"2018-8-26","...
1
vote
1answer
180 views

The role of Machine Learning In Cybersecurity Defense [closed]

Hackers and malware are one step ahead of cybersecurity experts, and every time technology is released to the market, vulnerabilities will be quickly discovered and exploited. How effective can ...
0
votes
1answer
152 views

I'm not sure if this Website is SQL Injectable

I think I found an SQL vulnerability; the request and response can be found below. I'm not sure because it is showing a normal error (it's in French) instead of showing an SQL error. I also tried to ...
0
votes
1answer
180 views

Is it SQL Injection Vuln? [closed]

Today my friend asking help to test and prevent his website from sql injection.. After i tried basic sql injection like 1 OR 1=1, ' OR 1--',' '1'='1 There is no mysql error displayed.. But After i ...
1
vote
1answer
125 views

Single quotes ' not sanitized

I'm trying to find security issues on my friend's site. There is an input box for subscription. I can enter my email address: Henry<IMG SRC=# onmouseover="alert('xxs')">@gmail.com After ...
0
votes
0answers
292 views

How to use binary search for blind SQL injection queries

From what I read online, it's possible to apply binary search to exploit blind SQL injection vulnerabilities, and that is probably what tools like sqlmap use to lower the number of queries that need ...
3
votes
1answer
765 views

False positive SQL Injection by ZAP with adding new parameter query

I have a spring MVC web application and am running ZAP Active scan on it. I noticed that ZAP will modify URL , and add additional parameter named query and value query+AND+1%3D1+--+ to test SQL ...
0
votes
3answers
3k views

SQL Injection on POST JSON request

I have a web application vulnerable to SQL injections. I'm using BurpSuite to intercept the requests. More specifically, the data variable below is vulnerable. I added my own data to aggregates and ...
0
votes
1answer
63 views

Possibility of SQL injection by static or predefined values

Using direct variables is vulnerable to sql injection. So to prevent attacks we use parameters. $result->bindParam(":id",$_POST['id'],PDO::PARAM_INT) but I am confused regarding the following ...
0
votes
2answers
354 views

Using single or double quotes to prevent XSS and SQLi?

Why it is recommended to put single or double quotes around HTML attribute values? It is recommended to prevent XSS, but why? Same goes for SQL injection: It is recommended to use single or double ...
0
votes
1answer
431 views

From SQL Injection in SQLite to shell

I need to obtain a shell from an SQL injection over an application with sqlite database. Currently my exploit looks like the following: lucian@0x90:~/$ proxychains nc 10.185.10.55 1101 ProxyChains-3....
0
votes
2answers
504 views

Can an ampersand (&) be used in SQL injection?

With SQL Server, does the ampersand pose as a threat related to SQL injection? I'm working on a project that includes this as a blacklisted character. I'm aware that there's a threat related to Oracle ...
0
votes
0answers
23 views

Replacing single quote with double single quote (SQL Injection sanitation) [duplicate]

Let's say I want to sql inject into a site, and the textbox is for my name. My name is U'ser Smith. The code is handling the single quote by replacing any instance of ' with '' on the users input only....
1
vote
0answers
291 views

SQLmap error (what happen if i have no parameters)

I have an error when I use sqlmap. The problem is: I use this dork https://www.exploit-db.com/ghdb/4301/ but I do not know how to use sqlmap with this type of sql injection. I use the classic: ...
0
votes
4answers
162 views

Is it possible to verify if a website is vulnerable to SQLi by viewing its source code?

I've heard the eval() function is vulnerable to SQLi. Can I check for vulnerabilities by simply viewing the website source code?
1
vote
0answers
79 views

SQL Injection in a simple form [closed]

There is a form that I'm trying to crack it. It has two fields: username & password. When I enter 1'; WAITFOR DELAY '00:00:15' -- in username, it tries to load for about 40 seconds, then it shows ...
1
vote
2answers
882 views

DVWA: “Hacking attempt detected…”

Hello and good evening, i've recently tried to improve my pentesting skills and learn more about it with metasploitable 2. I am trying some things on the DVWA. For the moment, i am learning the ...
0
votes
2answers
702 views

SQL Injection : How to begin when the id parameter value is not numeric

I am learning SQL injection currently and I feel I am quite comfortable doing Basic SQL injection. I am learning it by solving online challenges and so far I have only come across situations where the ...
-1
votes
1answer
213 views

Attempting SQLi against website with WAF filter [closed]

I was pentesting a website when I discovered that the URL included the id parameter. Because of this, I knew that the id parameter might be vulnerable to SQLi. I received a 200 response and found no ...
0
votes
1answer
350 views

can a token be used for sql injection

I have a token that is restricted to read only access. If someone obtains that token, can they use it to do a sql injection attack? Given that the token is permissioned for read only, can someone ...
1
vote
1answer
69 views

Is the hosting OS safe to sql injection hackers by hiding admin ID?

We are 1-3 guys maintaining a fairly large but clumsy developed-in-house website. With around 900+ mysql tables, and a lot of data access code in PHP. Let's say it is huge amount of code for just 1 or ...