Questions tagged [sql-injection]

SQL injection is a technique used to take advantage of vulnerabilities arising from non-validated input on web applications to pass SQL commands through for execution on a backend database.

0
votes
1answer
132 views

About SQL Injection Mysql

I'm trying to test SQL injection on a site (PHP, uses MySQL Database). When I put an apostrophe in the username field and leave the password box blank, after submitting, the form reloads and the ...
-2
votes
1answer
244 views

Can just adding an apostrophe to input lead to SQLi that makes changes in the database?

If I try to find a SQL injection vulnerability in an admin login form by putting an apostrophe after the username (username') and write a password, will this vulnerability checking effect or modify ...
0
votes
3answers
95 views

SQL injection with filtered column names

I have the following MySQL query susceptible to an injection and I need to extract the password of a given user: SELECT * FROM users WHERE login='$login' and password='$password' However from the ...
34
votes
11answers
10k views

How to limit the impact of and reduce the risk of SQL injection for existing website?

Our website is 100% API based (with an SPA client). Recently, a hacker managed to get our admin's password (hashed with SHA-256) through SQL injection (and cracking pwd) like this: https://example....
9
votes
3answers
553 views

How could our passwords be cracked so easily?

We are saving password in a database using PHP: return hash('sha256', PASSWORD_SALT . $password); Recently a (fortunately) good hacker SQL-injected us and cracked some passwords including the admin ...
4
votes
1answer
362 views

Possible SQL injection vulnerability?

I'm a developer and I'm creating a script to interface with game servers to update player stats. I was sending a POST request with multipart form data and on the last boundary accidentally had the ...
0
votes
1answer
53 views

SQL Query Sanatization

It seems to me SQL injection could be avoided by just converting everything to a simple encoding like base64 that doesn't have any harmful symbols. In the classic query "SELECT * FROM users WHERE ...
0
votes
2answers
1k views

SQL Injection with an uninjectable URL

I was recently given a subdomain to try and exploit with SQLi: gov.ns.agency. Unlike what I would see in most tutorials, I can't really inject parameters into the URL like I would see everywhere else. ...
81
votes
19answers
16k views

Good analogy needed: Sec issues due to different coders implementing the same features in different ways for the same app

I have to give a school presentation about vulnerabilities found in the Moodle platform. Of course, they only apply to a legacy version which has since been patched. The catch is that the ...
5
votes
1answer
196 views

Blind SQL Injection and HTTP Version Dependency?

I Recently came across a Virtual Machine that has Blind SQL Injection in the X-Forwarded-For header. I used sleep() to detect the vulnerability. The Payload worked in HTTP/1.0 and not in HTTP/1.1 . ...
3
votes
0answers
153 views

Is possible attack vector? [closed]

So I was bored and decided to get into some bug bounty hunting. I went on a website that has a bug bounty program and this website is for downloading apps. I went to the enter a gift card code field ...
1
vote
2answers
2k views

Is it possible to include a PHP Function while performing SQL Injection?

Consider this code: ?id=' UNION SELECT 1,2;"; phpinfo();//-- -&Submit=Submit Will this work out? SQL Query: if(isset( $_GET[ 'submit' ] ) ) { // Get input $id = $_GET[ 'id' ]; // Check ...
0
votes
2answers
426 views

How to extract data using SQL injection on a vulnerable ASP.NET application?

I managed to find a vulnerability in a so-called friend of mines website and I want to show him that his website is vulnerable to data extraction. When I use something like yes')-- as post I get the ...
1
vote
0answers
557 views

DVWA cant be injected with SQLMAP [id is not injectionable]

I'm trying to catch SQL Injection attacks from DVWA with sqlmap, I'm using the most simple option it provides, but it's strange that sometimes it works and other it doesn't, showing a message similar ...
0
votes
1answer
257 views

Integrate OData pentesting tool to ZAP add-on [closed]

We are currently working on a ZAP (Zed Attack Proxy) add-on designed to facilitate the pentesting of our new framework. Our solution is using OData so we were wondering if their was existing tools ...
2
votes
0answers
157 views

Does MySQL error “Illegal mix of collations” imply an SQL injection vulnerability?

The user input of a given query is being sanitized (PHP, real_escape_string), yet the query fails with "Illegal mix of collations". This query is below: SELECT * FROM `table` WHERE `column` = "�½��ļ��...
0
votes
0answers
115 views

Blind SQL injection - Get a time out and don't know why

During a CTF, I had the intuition that there was a blind SQL injection entry point in the URL. I tried to inject: ' UNION SLEEP(5);-- I was expecting to receive a response after 5s, but actually, I ...
5
votes
1answer
466 views

Possible to use sqlmap when URL changes after each request?

I am testing a website login that is constantly changing its URL after each request. The first request does a POST login request to /login?0-1.FormSubmit, the next login attempt has to POST to /login?...
0
votes
2answers
292 views

SQL injection evasion

I know that filtering bad keyword is not a good approach to preventing SQL injection. However, when I couldn't answer why this is not a good approach, here is my rule: 1) When I see ;, I make it to '...
0
votes
2answers
689 views

SQL injection via update statement

I'm working on a capture the flag assignment. We were told there was a flag if you can login with credentials admin. The main page does not seem to be vulnerable to SQL injection but the forgot ...
2
votes
4answers
5k views

Simple SQL injection to bypass login in MariaDB

I'm trying out SQL Injection on my localhost. I have a simple HTML form, with a username, password and a submit button. So after clicking on the submit, user is redirected from login.html to a page ...
0
votes
1answer
1k views

How to make Sqlmap obtain administrator rights for database?

I'm using sqlmap to exploit databases in a DVWA-project. However, after having exploited the database, I executed the following command to learn that the user is dvwa@%: sqlmap -u "http://192.168....
3
votes
3answers
253 views

What is the benefit of the database's information_schema for a hacker?

What is the benefit of the database's information_schema for a hacker? I am talking about SQL injection exploitation.
4
votes
1answer
148 views

What can I do with blind SQLi if the database is encrypted?

During a pentest engagement, I found a blind SQLi and I can read all tables and data in them. There is just one problem. They are using a static AES key (defined in web.config and I don't have access ...
-1
votes
1answer
582 views

SQL Injection ByPass

$result = $db->query('SELECT * FROM USERS WHERE password="'.$_GET['password'].'"'); if($result->fetchArray()) $step1=true; $result = $db->query('SELECT * FROM USERS WHERE password=\''.$_GET['...
-4
votes
1answer
1k views

Hex in the SQL Injection query [closed]

What would these hashes be in the query? How can I generate them? http://www.example.com?id=-29/!50000UNION/ /!50000SELECT/ 1,2,...
6
votes
1answer
496 views

Using sqlmap and testing parameters inside SEF URL alias

I would like to use sqlmap and set parameters, that are concatenated inside the URL parts. I know that a following URL is possible to track with defining of parameter by putting an asterisk behind ...
0
votes
1answer
2k views

Bypass WAF/IDS with SQLMAP? [closed]

How can I use SQLMAP to run tests on a website with a WAF/IDS? Suppose I want to run something like this: python sqlmap.py -u http://www.xxxxxxxxxxxxxx.com/standard.html&id=30 --dbs How can I ...
3
votes
2answers
157 views

preventing SQL injection with string length [duplicate]

This is far from best practice, but I just saw a piece of code that I found very interesting to say the least. The code was executing some SQL, and it was not using prepared statements so it is wide ...
-1
votes
1answer
79 views

Can this be bypassed with SQL Injection?

This is my php code: $uname = $_POST['username']; $pwd = md5($_POST['password']); $sql = "SELECT * FROM `user` WHERE username = '$uname' AND password = '$pwd'"; My friend gave me this code but I’d ...
3
votes
1answer
430 views

Validate database column and table names to prevent SQLi?

There are some types of software, such as ORMs and query builders, that has to concatenate column and table names into SQL queries. Since developers apparently put untrusted data in all sorts of ...
2
votes
1answer
111 views

Can native SQL code be vulnerable? To what?

I was able to find an article that mentions that SQL injection can be done to SQL code in the following scenarios where stored procedures are involved: EXEC statements Dynamic Cursors Assuming SQLi ...
1
vote
1answer
920 views

Custom post data JSON payload format in sqlmap?

I want to perform SQL injection but I don't know how to use the command. So far, I have tried this: --data="{'user_id':'6','user_with:5*'}" --prefix=" OR user_to = 5)" --suffix="#" -vvv` I use ' ...
1
vote
0answers
1k views

Change injection payload in SQLmap

I know you can change parameters and all, but can you change the payload that you’re sending? Like if I wanted to send a payload that would put a txt in someone’s database, is that possible? I’m new ...
7
votes
4answers
1k views

SIP UDP request breaking through iptables

I have been investigating a few instances recently where SIP UDP traffic has been somehow evading the ruleset defined in iptables leading me to suspect that there is a hole in our rules so i'm looking ...
4
votes
2answers
778 views

Can 4 single quotes still be escaped producing a sql injection on sql server? [duplicate]

I found a simple breakout in a where clause in one of our projects where the code is so old that they claim they can't use parameters to communicate with ms SQL server. It's written in C++, I can't ...
3
votes
2answers
611 views

Why did this particular input work for SQL injection?

I'm studying infosec, starting to make my way through some of the online wargames out there. Have recently been working on Natas by OverTheWire (http://overthewire.org/wargames/natas/) and it's been ...
3
votes
2answers
597 views

Is my site about to be SQL injected/hacked?

I'm running Opencart, an ecommerce CMS on a public website. About a week ago I noticed a decent spike in direct traffic in Google Analytics (meaning these users input my URL directly rather than ...
6
votes
7answers
3k views

Protecting encrypted data in case of SQL injection

Let's say there is a web application, with encrypted data. e.g. a website where patients leave notes to their doctors. A patient logs in, leave a note, that note is encrypted using symmetric ...
0
votes
0answers
161 views

Detecting SQL injection HIPS and WAF

WAF and HIPS detect SQL injection based on rules. For example 1" OR 1=1 -- Both devices will block it. How about `1" OR 300+1-300+0=50+57-6 -- ? In my scenario HIPS doesn't seem to be able detect ...
1
vote
2answers
3k views

What are the possible ways to exploit a login page? [closed]

In a recent interview I was asked how can you bypass a login page, all it has is Username, password and login button. I was able to come up with below possible ways, SQL Injection Phishing ...
1
vote
2answers
1k views

SQLMAP injection point

I'm busy testing SQLMAP on a custom app I wrote, but SQLMAP is not detecting the injection point. For example, http://127.0.0.1/index.php?id=10-1 displays the content of id=9. But SQLMAP is not ...
2
votes
3answers
407 views

How does an SQL injection inject HTML?

I've discovered two attempts at SQL injection in my webserver logs: declare @c cursor; set @c=cursor for select TABLE_NAME,c.COLUMN_NAME FROM sysindexes AS i INNER JOIN sysobjects AS o ON i.id=o.id ...
5
votes
1answer
2k views

Malicious script through sql-injection

One of my customers had a problem making a post at his blog, and when I looked into the database I found out that the newsletter table (which sends emails about the blog posts) had a malicious script. ...
-2
votes
3answers
762 views

PHP get parameter code vulnerability [closed]

I have an URL like this: mywebsite.com?id=12345678 I retrieve id and pass it to a function like this: $id = $_GET["id"]; if(isset($id)){ dosomething($id); } I'm new to php and really don't ...
0
votes
1answer
2k views

SQL Injection - “order by” clause does not work [closed]

I am learning web development and at the same time I want to learn web hacking in order to better protect my websites in the future. Now I learning SQL injection and I am hacking into a hackme domain. ...
2
votes
1answer
450 views

SQL table column number changes with injection query?

A very basic sql injection question here, I found a SQLi on a mysql website with product.php?id=200. I first tired ORDER BY to figure out the column number of that table by product.php?id=200 order ...
2
votes
1answer
302 views

SQL-Injection file upload when database and webserver are on different machines

I have two servers, one for the database (mysql) and one for the website (apache) and there is a sql injection on my web application. Is it possible now to upload a shell to my webserver or does the ...
10
votes
1answer
847 views

How vulnerable is connecting Android App to PHP API with prewritten queries

I have built a PHP API which queries data from some tables in an online SQL database. The credentials with which it connects to the database are saved in another file, and are loaded at start. The ...
7
votes
3answers
986 views

Continuous SQL injection testing

We have a set of internal Python/Django web applications that are pretty well tested functionality-wise, but from time to time we do discover vulnerabilities and, specifically, places where SQL and ...