Questions tagged [sql-injection]

SQL injection is a technique used to take advantage of vulnerabilities arising from non-validated input on web applications to pass SQL commands through for execution on a backend database.

Filter by
Sorted by
Tagged with
0
votes
4answers
176 views

Is it possible to verify if a website is vulnerable to SQLi by viewing its source code?

I've heard the eval() function is vulnerable to SQLi. Can I check for vulnerabilities by simply viewing the website source code?
1
vote
0answers
83 views

SQL Injection in a simple form [closed]

There is a form that I'm trying to crack it. It has two fields: username & password. When I enter 1'; WAITFOR DELAY '00:00:15' -- in username, it tries to load for about 40 seconds, then it shows ...
1
vote
2answers
975 views

DVWA: “Hacking attempt detected…”

Hello and good evening, i've recently tried to improve my pentesting skills and learn more about it with metasploitable 2. I am trying some things on the DVWA. For the moment, i am learning the ...
0
votes
2answers
753 views

SQL Injection : How to begin when the id parameter value is not numeric

I am learning SQL injection currently and I feel I am quite comfortable doing Basic SQL injection. I am learning it by solving online challenges and so far I have only come across situations where the ...
-1
votes
1answer
222 views

Attempting SQLi against website with WAF filter [closed]

I was pentesting a website when I discovered that the URL included the id parameter. Because of this, I knew that the id parameter might be vulnerable to SQLi. I received a 200 response and found no ...
0
votes
1answer
428 views

can a token be used for sql injection

I have a token that is restricted to read only access. If someone obtains that token, can they use it to do a sql injection attack? Given that the token is permissioned for read only, can someone ...
1
vote
1answer
69 views

Is the hosting OS safe to sql injection hackers by hiding admin ID?

We are 1-3 guys maintaining a fairly large but clumsy developed-in-house website. With around 900+ mysql tables, and a lot of data access code in PHP. Let's say it is huge amount of code for just 1 or ...
13
votes
6answers
8k views

What pages are vulnerable to SQL injection?

I believe I understand the basics of SQL injection. I also know using prepared statements with PHP files is the best way to prevent SQL injection. I was always told that SQL injection happens most ...
1
vote
1answer
993 views

Can website get hacked by iframe injection?

My website has been hacked. I am observing how hacker accesses my site. Though I have been using bindparam to prevent from sql injection and direct access restriction for backdoor attack, hacker's ...
3
votes
2answers
141 views

Is it plausible to enforce authorisation on SQL generated from “Client-side”?

Background We know that SQL Injection (OWASP Top 10) is the most prevalent security vulnerability on websites today. The strategies for mitigating the risk are well known. But are these only ...
2
votes
1answer
372 views

Impact of SQL injection on SELECT statement

During a routine penetration test I encountered a possibility for SQL injection. The following criteria apply: Microsoft SQL Server (2016); Query has to start with SELECT; The semicolon ; is not ...
1
vote
1answer
99 views

Using a transaction as mitigation against SQL injection

Considering a generic stored procedure that is subject to SQL injection: CREATE PROC usp_badproc @sql NVARCHAR(8000) AS BEGIN EXEC(@sql) END and operating under the assumptions that the ...
1
vote
0answers
1k views

is it possible to insert data using sql injection in select statement?

First of all i am testing it on my server for learning purpose. The condition here is i want to insert a entry in test table in database and SELECT * FROM `student` WHERE `name` LIKE '% ".$name." %';...
0
votes
1answer
306 views

Applying regexp for user input validation using JavaScript

As a full-stack developer I am buliding an webapp for tennis club in codeignitor framework. During making html forms on client side and writing scripts for validation of user input. i thought would ...
0
votes
1answer
135 views

About SQL Injection Mysql

I'm trying to test SQL injection on a site (PHP, uses MySQL Database). When I put an apostrophe in the username field and leave the password box blank, after submitting, the form reloads and the ...
-2
votes
1answer
267 views

Can just adding an apostrophe to input lead to SQLi that makes changes in the database?

If I try to find a SQL injection vulnerability in an admin login form by putting an apostrophe after the username (username') and write a password, will this vulnerability checking effect or modify ...
0
votes
3answers
101 views

SQL injection with filtered column names

I have the following MySQL query susceptible to an injection and I need to extract the password of a given user: SELECT * FROM users WHERE login='$login' and password='$password' However from the ...
34
votes
11answers
10k views

How to limit the impact of and reduce the risk of SQL injection for existing website?

Our website is 100% API based (with an SPA client). Recently, a hacker managed to get our admin's password (hashed with SHA-256) through SQL injection (and cracking pwd) like this: https://example....
9
votes
3answers
568 views

How could our passwords be cracked so easily?

We are saving password in a database using PHP: return hash('sha256', PASSWORD_SALT . $password); Recently a (fortunately) good hacker SQL-injected us and cracked some passwords including the admin ...
4
votes
1answer
391 views

Possible SQL injection vulnerability?

I'm a developer and I'm creating a script to interface with game servers to update player stats. I was sending a POST request with multipart form data and on the last boundary accidentally had the ...
0
votes
1answer
55 views

SQL Query Sanatization

It seems to me SQL injection could be avoided by just converting everything to a simple encoding like base64 that doesn't have any harmful symbols. In the classic query "SELECT * FROM users WHERE ...
0
votes
2answers
1k views

SQL Injection with an uninjectable URL

I was recently given a subdomain to try and exploit with SQLi: gov.ns.agency. Unlike what I would see in most tutorials, I can't really inject parameters into the URL like I would see everywhere else. ...
81
votes
19answers
16k views

Good analogy needed: Sec issues due to different coders implementing the same features in different ways for the same app

I have to give a school presentation about vulnerabilities found in the Moodle platform. Of course, they only apply to a legacy version which has since been patched. The catch is that the ...
5
votes
1answer
232 views

Blind SQL Injection and HTTP Version Dependency?

I Recently came across a Virtual Machine that has Blind SQL Injection in the X-Forwarded-For header. I used sleep() to detect the vulnerability. The Payload worked in HTTP/1.0 and not in HTTP/1.1 . ...
3
votes
0answers
162 views

Is possible attack vector? [closed]

So I was bored and decided to get into some bug bounty hunting. I went on a website that has a bug bounty program and this website is for downloading apps. I went to the enter a gift card code field ...
1
vote
2answers
2k views

Is it possible to include a PHP Function while performing SQL Injection?

Consider this code: ?id=' UNION SELECT 1,2;"; phpinfo();//-- -&Submit=Submit Will this work out? SQL Query: if(isset( $_GET[ 'submit' ] ) ) { // Get input $id = $_GET[ 'id' ]; // Check ...
0
votes
2answers
473 views

How to extract data using SQL injection on a vulnerable ASP.NET application?

I managed to find a vulnerability in a so-called friend of mines website and I want to show him that his website is vulnerable to data extraction. When I use something like yes')-- as post I get the ...
1
vote
0answers
628 views

DVWA cant be injected with SQLMAP [id is not injectionable]

I'm trying to catch SQL Injection attacks from DVWA with sqlmap, I'm using the most simple option it provides, but it's strange that sometimes it works and other it doesn't, showing a message similar ...
0
votes
1answer
323 views

Integrate OData pentesting tool to ZAP add-on [closed]

We are currently working on a ZAP (Zed Attack Proxy) add-on designed to facilitate the pentesting of our new framework. Our solution is using OData so we were wondering if their was existing tools ...
2
votes
0answers
198 views

Does MySQL error “Illegal mix of collations” imply an SQL injection vulnerability?

The user input of a given query is being sanitized (PHP, real_escape_string), yet the query fails with "Illegal mix of collations". This query is below: SELECT * FROM `table` WHERE `column` = "�½��ļ��...
0
votes
0answers
133 views

Blind SQL injection - Get a time out and don't know why

During a CTF, I had the intuition that there was a blind SQL injection entry point in the URL. I tried to inject: ' UNION SLEEP(5);-- I was expecting to receive a response after 5s, but actually, I ...
5
votes
1answer
515 views

Possible to use sqlmap when URL changes after each request?

I am testing a website login that is constantly changing its URL after each request. The first request does a POST login request to /login?0-1.FormSubmit, the next login attempt has to POST to /login?...
0
votes
2answers
317 views

SQL injection evasion

I know that filtering bad keyword is not a good approach to preventing SQL injection. However, when I couldn't answer why this is not a good approach, here is my rule: 1) When I see ;, I make it to '...
0
votes
2answers
745 views

SQL injection via update statement

I'm working on a capture the flag assignment. We were told there was a flag if you can login with credentials admin. The main page does not seem to be vulnerable to SQL injection but the forgot ...
2
votes
4answers
6k views

Simple SQL injection to bypass login in MariaDB

I'm trying out SQL Injection on my localhost. I have a simple HTML form, with a username, password and a submit button. So after clicking on the submit, user is redirected from login.html to a page ...
0
votes
1answer
2k views

How to make Sqlmap obtain administrator rights for database?

I'm using sqlmap to exploit databases in a DVWA-project. However, after having exploited the database, I executed the following command to learn that the user is dvwa@%: sqlmap -u "http://192.168....
3
votes
3answers
274 views

What is the benefit of the database's information_schema for a hacker?

What is the benefit of the database's information_schema for a hacker? I am talking about SQL injection exploitation.
4
votes
1answer
158 views

What can I do with blind SQLi if the database is encrypted?

During a pentest engagement, I found a blind SQLi and I can read all tables and data in them. There is just one problem. They are using a static AES key (defined in web.config and I don't have access ...
-1
votes
1answer
618 views

SQL Injection ByPass

$result = $db->query('SELECT * FROM USERS WHERE password="'.$_GET['password'].'"'); if($result->fetchArray()) $step1=true; $result = $db->query('SELECT * FROM USERS WHERE password=\''.$_GET['...
-4
votes
1answer
2k views

Hex in the SQL Injection query [closed]

What would these hashes be in the query? How can I generate them? http://www.example.com?id=-29/!50000UNION/ /!50000SELECT/ 1,2,...
6
votes
1answer
565 views

Using sqlmap and testing parameters inside SEF URL alias

I would like to use sqlmap and set parameters, that are concatenated inside the URL parts. I know that a following URL is possible to track with defining of parameter by putting an asterisk behind ...
0
votes
1answer
2k views

Bypass WAF/IDS with SQLMAP? [closed]

How can I use SQLMAP to run tests on a website with a WAF/IDS? Suppose I want to run something like this: python sqlmap.py -u http://www.xxxxxxxxxxxxxx.com/standard.html&id=30 --dbs How can I ...
3
votes
2answers
166 views

preventing SQL injection with string length [duplicate]

This is far from best practice, but I just saw a piece of code that I found very interesting to say the least. The code was executing some SQL, and it was not using prepared statements so it is wide ...
-1
votes
1answer
82 views

Can this be bypassed with SQL Injection?

This is my php code: $uname = $_POST['username']; $pwd = md5($_POST['password']); $sql = "SELECT * FROM `user` WHERE username = '$uname' AND password = '$pwd'"; My friend gave me this code but I’d ...
3
votes
1answer
452 views

Validate database column and table names to prevent SQLi?

There are some types of software, such as ORMs and query builders, that has to concatenate column and table names into SQL queries. Since developers apparently put untrusted data in all sorts of ...
2
votes
1answer
118 views

Can native SQL code be vulnerable? To what?

I was able to find an article that mentions that SQL injection can be done to SQL code in the following scenarios where stored procedures are involved: EXEC statements Dynamic Cursors Assuming SQLi ...
1
vote
1answer
1k views

Custom post data JSON payload format in sqlmap?

I want to perform SQL injection but I don't know how to use the command. So far, I have tried this: --data="{'user_id':'6','user_with:5*'}" --prefix=" OR user_to = 5)" --suffix="#" -vvv` I use ' ...
1
vote
0answers
1k views

Change injection payload in SQLmap

I know you can change parameters and all, but can you change the payload that you’re sending? Like if I wanted to send a payload that would put a txt in someone’s database, is that possible? I’m new ...
7
votes
4answers
1k views

SIP UDP request breaking through iptables

I have been investigating a few instances recently where SIP UDP traffic has been somehow evading the ruleset defined in iptables leading me to suspect that there is a hole in our rules so i'm looking ...
4
votes
2answers
858 views

Can 4 single quotes still be escaped producing a sql injection on sql server? [duplicate]

I found a simple breakout in a where clause in one of our projects where the code is so old that they claim they can't use parameters to communicate with ms SQL server. It's written in C++, I can't ...