Questions tagged [sql-injection]

SQL injection is a technique used to take advantage of vulnerabilities arising from non-validated input on web applications to pass SQL commands through for execution on a backend database.

Filter by
Sorted by
Tagged with
3
votes
2answers
648 views

Why did this particular input work for SQL injection?

I'm studying infosec, starting to make my way through some of the online wargames out there. Have recently been working on Natas by OverTheWire (http://overthewire.org/wargames/natas/) and it's been ...
3
votes
2answers
602 views

Is my site about to be SQL injected/hacked?

I'm running Opencart, an ecommerce CMS on a public website. About a week ago I noticed a decent spike in direct traffic in Google Analytics (meaning these users input my URL directly rather than ...
6
votes
7answers
3k views

Protecting encrypted data in case of SQL injection

Let's say there is a web application, with encrypted data. e.g. a website where patients leave notes to their doctors. A patient logs in, leave a note, that note is encrypted using symmetric ...
0
votes
0answers
183 views

Detecting SQL injection HIPS and WAF

WAF and HIPS detect SQL injection based on rules. For example 1" OR 1=1 -- Both devices will block it. How about `1" OR 300+1-300+0=50+57-6 -- ? In my scenario HIPS doesn't seem to be able detect ...
1
vote
2answers
4k views

What are the possible ways to exploit a login page? [closed]

In a recent interview I was asked how can you bypass a login page, all it has is Username, password and login button. I was able to come up with below possible ways, SQL Injection Phishing ...
1
vote
2answers
2k views

SQLMAP injection point

I'm busy testing SQLMAP on a custom app I wrote, but SQLMAP is not detecting the injection point. For example, http://127.0.0.1/index.php?id=10-1 displays the content of id=9. But SQLMAP is not ...
2
votes
3answers
439 views

How does an SQL injection inject HTML?

I've discovered two attempts at SQL injection in my webserver logs: declare @c cursor; set @c=cursor for select TABLE_NAME,c.COLUMN_NAME FROM sysindexes AS i INNER JOIN sysobjects AS o ON i.id=o.id ...
5
votes
1answer
2k views

Malicious script through sql-injection

One of my customers had a problem making a post at his blog, and when I looked into the database I found out that the newsletter table (which sends emails about the blog posts) had a malicious script. ...
-2
votes
3answers
801 views

PHP get parameter code vulnerability [closed]

I have an URL like this: mywebsite.com?id=12345678 I retrieve id and pass it to a function like this: $id = $_GET["id"]; if(isset($id)){ dosomething($id); } I'm new to php and really don't ...
0
votes
1answer
2k views

SQL Injection - “order by” clause does not work [closed]

I am learning web development and at the same time I want to learn web hacking in order to better protect my websites in the future. Now I learning SQL injection and I am hacking into a hackme domain. ...
2
votes
1answer
483 views

SQL table column number changes with injection query?

A very basic sql injection question here, I found a SQLi on a mysql website with product.php?id=200. I first tired ORDER BY to figure out the column number of that table by product.php?id=200 order ...
2
votes
1answer
354 views

SQL-Injection file upload when database and webserver are on different machines

I have two servers, one for the database (mysql) and one for the website (apache) and there is a sql injection on my web application. Is it possible now to upload a shell to my webserver or does the ...
10
votes
1answer
874 views

How vulnerable is connecting Android App to PHP API with prewritten queries

I have built a PHP API which queries data from some tables in an online SQL database. The credentials with which it connects to the database are saved in another file, and are loaded at start. The ...
7
votes
3answers
1k views

Continuous SQL injection testing

We have a set of internal Python/Django web applications that are pretty well tested functionality-wise, but from time to time we do discover vulnerabilities and, specifically, places where SQL and ...
3
votes
3answers
747 views

Is this Perl database connection vulnerable to SQL Injection

I have this (stripped down) Perl database query, and I wonder if this can be exploited in any way. This is from a challenge, so I know things could be done different, the task is to exploit this. To ...
-4
votes
2answers
2k views

Using base64 to avoid SQL injections?

It it a good or bad idea if I put a base64 layer over the user input before inserting into SQL? Everything gets encoded (not encrypted) withbase 64 before it reaches SQL queries to stop any SQL ...
0
votes
1answer
93 views

Experiencing injection / brute force attacks

I'm handling a hosting services for website via WHM. Few months ago, I've been experiencing some automated attacks on the websites that I'm handling. See screenshots below: Are there any remedy for ...
2
votes
1answer
116 views

SQL Security Questions

The CISO of my company is currently away and as IT manager I have been asked to send some security questions to a company hoping to implement an SQL database to manage salaries, orders etc. I have ...
1
vote
2answers
2k views

How to know if an ASP web page is vulnerable to SQL injection?

I've some experiences of working with PHP web applications vulnerable to SQL injection and exploiting this type of vulnerability successfully but never tried to do this on a ASP based web application. ...
1
vote
1answer
2k views

SQL Injection - LIKE Clause

As part of a capture-the-flag assignment, I'm supposed to perform SQL injection using the LIKE clause to obtain the flag. I'm new to this and I've tried the following injections: (The username ...
4
votes
1answer
31k views

SQL injection: how to find urls to attack to [closed]

The last days I've been reading about SQL injection and most of the url examples I see are like the following: get_int_filtered.php?id=1 get_int_groupby.php?id=1 get_int_having.php?id=1 get_int_img....
8
votes
1answer
4k views

SQL injection with 500 error code?

I'm trying to inject SQL into a website. When I write and in the input field the server returns error code 500 and the response delay is 30 seconds. When I try to add order by or group by the server ...
1
vote
3answers
2k views

What HTTP status codes indicate that there is a SQLi vulnerability?

In this blogpost describing a pentest, the author adds ' to a field requiring some value, and concludes that there is an SQLi vulnerability: Upon further investigation adding a single quote would ...
13
votes
3answers
16k views

Sanitizing input for parameterized queries

If I use fully parameterized queries everywhere, is it still necessary and/or security-relevant to somehow sanitize input? E.g. check that mail addresses are valid before sending a parameterized query ...
1
vote
2answers
278 views

What is the difference between these SQLi queries?

I was performing a Web Pentest and I found this when i was doing sqli in a search field: ' or 1=1-- returns 15 results ' or '1'='1 returns 30 different results ' or '1'='1-- returns 0 ...
-1
votes
2answers
10k views

Bypass login page with SQL injection [closed]

I am using a vulnerable webpage for practicing OWASP attacks. In the current scenario I have a login page which I am trying to bypass. I have tried Burp suite and manual cheat sheets but couldn't ...
1
vote
1answer
215 views

User authentication SQL injection [closed]

Is this authentication mechanism vulnerable to SQL injection? If so, how could one exploit it, and what is the most effective way to mitigate this? if (isset($_POST['userid']) && isset($_POST[...
2
votes
1answer
275 views

How does limiting the number of results from a SQL query help?

This highly upvoted answer asserts that as a protection against SQL injection, one should always use bound parameters and limit how many results get returned (emphasis mine) Obviously, the advice ...
-1
votes
1answer
435 views

Is it true that blind SQL injection does not work on MariaDB?

I was told by someone on the network that MariaDB was not susceptible to blind SQL injection. I was not aware of this. Can anyone elaborate? I am using it on my server and was told not to switch to ...
4
votes
1answer
598 views

Trying to tunnel a reverse shell out of an internal network

I am practicing performing a pentest and getting stuck trying to get an interactive reverse shell from an internal machine to my attacker machine. This is what I have done so far: Me(attacker): 67....
1
vote
1answer
149 views

PCI - Backend Applications and SQL Injection

Currently pursuing PCI certification and our internal team is mandating that all inline SQL be moved to parameterized queries. No question this makes sense for web applications. I'm wondering about ...
70
votes
3answers
13k views

Is this a SQL injection attack or is it some sort of bug?

I was looking through some data in our database when I came across a bunch of weird user_id entries: user_id -1080) ORDER BY 1# -1149 UNION ALL SELECT 79,79,79,79,79,79,79,79,79# -1359' UNION ALL ...
1
vote
1answer
550 views

Bypass PHP strtoupper() to perform SQL-injection on MySQL database?

I encountered a particularly weird situation where I have an SQL Injection vulnerability in the ORDER BY clause. The query is forged on backend and the injection payload is converted to upper case ...
1
vote
0answers
198 views

MySQL Injection

The following line of vulnerable code makes the user input always upper case: mysql_query("select * from " . strtoupper($_GET['table'])); In a scenario where MySQL's "lower_case_table_names" is set ...
2
votes
2answers
404 views

Database compromised (SQL-injection): how to handle the situaton, after the fact?

Situation We found out that one of our (MySQL) databases has been compromised through SQL-injection. The injection vector was a query that was vulnerable to SQL-injection due to string-concatenation ...
5
votes
2answers
4k views

Difference between Code Injection, Command Injection and Remote Code Execution

If one has to describe fundamental difference in between these three terms (i.e. Code Injection, Command Injection and Remote Code Execution) what will that be? How they are different from each other ...
2
votes
1answer
110 views

How Have SQL Injections Evolved? (Specific Question + Open Discussion) [closed]

First time posting on Security Stack but I have benefited a lot from previous posts. I am currently a security cyber security grad student and I am building up my thesis project right now: it is ...
0
votes
0answers
206 views

How does the Evil Twin SQL injection query works?

I have been reading about SQL injection and got hit at Evil Twin SQL injection here. There are two queries mentioned in the article as follows. -1' union select 1,2,3,(select (@) from (select(@:=0x00)...
2
votes
1answer
697 views

What is the risk of SQL injection using bind variables with a 'like' clause?

I was doing a code review and I came across a query that looked something like this: String sql = "SELECT * FROM users WHERE username LIKE '%' || :userName || '%'"; Seeing the string concatenation ...
0
votes
1answer
375 views

SQL Injection on double table

If an SQL Injection on the address bar (like ?ID=1) affects two tables (SELECT *FROM catalogue WHERE... and SELECT *FROM reviews WHERE...) with a different amount of columns, how could a hacker inject ...
0
votes
1answer
359 views

Mysql user privileges for update query

In Mysql DBMS is it possible to assign USAGE privileges to a user which can do an update query? In order to prevent SQL-injection.
4
votes
2answers
891 views

What can be accomplished with a site that is vulnerable to both XSS and SQLi

A comment on another question stated (quite simply): There are ways in which XSS and SQLi can be used together. This one is new to me, and I'm curious to hear what additional attack vectors might ...
1
vote
1answer
219 views

Mysql Information schema column_privileges empty

I can try some SQL-injection against a ad-hoc damn web application in my virtual enviroment for educational purpose. In one of these I obtain the table column_privileges (of Mysql Information schema) ...
1
vote
1answer
166 views

Anti-CSFR tokens and SQLi

I follow a SQLi tool on github and recently saw a conversation between the developer and a user. The user had tried to inject and gotten some errors, in the requests there was a anti-csfr token. The ...
1
vote
1answer
179 views

why they still exist webapps that are vulnerable to XSS and SQLi? [duplicate]

To protect your web application from XSS, it's enough to use the function htmlspecialchars($input, ENT_QUOTES); and mysqli_real_escape_string($var); for SQL Injection, it's a simple information and a ...
2
votes
3answers
1k views

Huge amount of hidden porn backlinks from legit WordPress sites, why they did it?

I was doing some backlink research and found a huge amount of legit websites linking to the site I was researching. The problem was that the anchor text of all the links where porn related terms.... ...
1
vote
0answers
153 views

How to distinguish between SQLi and ORMi

The OWASP Testing Guide (more precisely: Chapter 4 therein) provides a methodology to pentest web applications. It is currently being overhauled, Version 5 is scheduled for beginning of 2018. One of ...
24
votes
1answer
4k views

Understanding SQL injection payload

My server was hit by the following SQL injection payload:- ((/*!12345sELecT*/(@)from(/*!12345sELecT*/(@:=0x00),(/*!12345sELecT*/(@)from(`InFoRMAtiON_sCHeMa`.`ColUMNs`)where(`TAblE_sCHemA`=DatAbAsE/*...
1
vote
2answers
9k views

MariaDB SQL Injection vulnerability?

I'm testing for SQL Injection on a website. Basically, I'm trying it in the following url: http://example.org/webpage/* where in place of the * the payload should be injected. When I try to put in ...
1
vote
1answer
700 views

bypass SQL injection waf [closed]

The server I am pentesting has blind boolean SQL injection, so I was able to guess the DB name to be apps_community. But it detects words like "information_schema" and drops the connection request. It ...