Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [sql-injection]

SQL injection is a technique used to take advantage of vulnerabilities arising from non-validated input on web applications to pass SQL commands through for execution on a backend database.

-4
votes
2answers
2k views

Using base64 to avoid SQL injections?

It it a good or bad idea if I put a base64 layer over the user input before inserting into SQL? Everything gets encoded (not encrypted) withbase 64 before it reaches SQL queries to stop any SQL ...
0
votes
1answer
91 views

Experiencing injection / brute force attacks

I'm handling a hosting services for website via WHM. Few months ago, I've been experiencing some automated attacks on the websites that I'm handling. See screenshots below: Are there any remedy for ...
2
votes
1answer
116 views

SQL Security Questions

The CISO of my company is currently away and as IT manager I have been asked to send some security questions to a company hoping to implement an SQL database to manage salaries, orders etc. I have ...
1
vote
2answers
2k views

How to know if an ASP web page is vulnerable to SQL injection?

I've some experiences of working with PHP web applications vulnerable to SQL injection and exploiting this type of vulnerability successfully but never tried to do this on a ASP based web application. ...
1
vote
1answer
2k views

SQL Injection - LIKE Clause

As part of a capture-the-flag assignment, I'm supposed to perform SQL injection using the LIKE clause to obtain the flag. I'm new to this and I've tried the following injections: (The username ...
4
votes
1answer
26k views

SQL injection: how to find urls to attack to [closed]

The last days I've been reading about SQL injection and most of the url examples I see are like the following: get_int_filtered.php?id=1 get_int_groupby.php?id=1 get_int_having.php?id=1 get_int_img....
6
votes
1answer
3k views

SQL injection with 500 error code

I'm trying to inject SQL into a website, so when I write and on the input field the server returns error code 500 and the response delay is 30s. When I try to add order by or group by the server ...
1
vote
3answers
2k views

What HTTP status codes indicate that there is a SQLi vulnerability?

In this blogpost describing a pentest, the author adds ' to a field requiring some value, and concludes that there is an SQLi vulnerability: Upon further investigation adding a single quote would ...
11
votes
3answers
13k views

Sanitizing input for parameterized queries

If I use fully parameterized queries everywhere, is it still necessary and/or security-relevant to somehow sanitize input? E.g. check that mail addresses are valid before sending a parameterized query ...
0
votes
1answer
219 views

What is the difference between this SQLi queries?

I was performing a Web Pentest and I found this when i was doing sqli in a search field: ' or 1=1-- returns 15 results ' or '1'='1 returns 30 different results ' or '1'='1-- returns 0 ...
-1
votes
2answers
8k views

Bypass login page with SQL injection [closed]

I am using a vulnerable webpage for practicing OWASP attacks. In the current scenario I have a login page which I am trying to bypass. I have tried Burp suite and manual cheat sheets but couldn't ...
1
vote
1answer
211 views

User authentication SQL injection [closed]

Is this authentication mechanism vulnerable to SQL injection? If so, how could one exploit it, and what is the most effective way to mitigate this? if (isset($_POST['userid']) && isset($_POST[...
2
votes
1answer
258 views

How does limiting the number of results from a SQL query help?

This highly upvoted answer asserts that as a protection against SQL injection, one should always use bound parameters and limit how many results get returned (emphasis mine) Obviously, the advice ...
-1
votes
1answer
417 views

Is it true that blind SQL injection does not work on MariaDB?

I was told by someone on the network that MariaDB was not susceptible to blind SQL injection. I was not aware of this. Can anyone elaborate? I am using it on my server and was told not to switch to ...
4
votes
1answer
536 views

Trying to tunnel a reverse shell out of an internal network

I am practicing performing a pentest and getting stuck trying to get an interactive reverse shell from an internal machine to my attacker machine. This is what I have done so far: Me(attacker): 67....
1
vote
1answer
141 views

PCI - Backend Applications and SQL Injection

Currently pursuing PCI certification and our internal team is mandating that all inline SQL be moved to parameterized queries. No question this makes sense for web applications. I'm wondering about ...
70
votes
3answers
13k views

Is this a SQL injection attack or is it some sort of bug?

I was looking through some data in our database when I came across a bunch of weird user_id entries: user_id -1080) ORDER BY 1# -1149 UNION ALL SELECT 79,79,79,79,79,79,79,79,79# -1359' UNION ALL ...
1
vote
1answer
468 views

Bypass PHP strtoupper() to perform SQL-injection on MySQL database?

I encountered a particularly weird situation where I have an SQL Injection vulnerability in the ORDER BY clause. The query is forged on backend and the injection payload is converted to upper case ...
1
vote
0answers
189 views

MySQL Injection

The following line of vulnerable code makes the user input always upper case: mysql_query("select * from " . strtoupper($_GET['table'])); In a scenario where MySQL's "lower_case_table_names" is set ...
2
votes
2answers
361 views

Database compromised (SQL-injection): how to handle the situaton, after the fact?

Situation We found out that one of our (MySQL) databases has been compromised through SQL-injection. The injection vector was a query that was vulnerable to SQL-injection due to string-concatenation ...
5
votes
2answers
4k views

Difference between Code Injection, Command Injection and Remote Code Execution

If one has to describe fundamental difference in between these three terms (i.e. Code Injection, Command Injection and Remote Code Execution) what will that be? How they are different from each other ...
2
votes
1answer
102 views

How Have SQL Injections Evolved? (Specific Question + Open Discussion) [closed]

First time posting on Security Stack but I have benefited a lot from previous posts. I am currently a security cyber security grad student and I am building up my thesis project right now: it is ...
0
votes
0answers
188 views

How does the Evil Twin SQL injection query works?

I have been reading about SQL injection and got hit at Evil Twin SQL injection here. There are two queries mentioned in the article as follows. -1' union select 1,2,3,(select (@) from (select(@:=0x00)...
2
votes
1answer
632 views

What is the risk of SQL injection using bind variables with a 'like' clause?

I was doing a code review and I came across a query that looked something like this: String sql = "SELECT * FROM users WHERE username LIKE '%' || :userName || '%'"; Seeing the string concatenation ...
0
votes
1answer
345 views

SQL Injection on double table

If an SQL Injection on the address bar (like ?ID=1) affects two tables (SELECT *FROM catalogue WHERE... and SELECT *FROM reviews WHERE...) with a different amount of columns, how could a hacker inject ...
0
votes
1answer
338 views

Mysql user privileges for update query

In Mysql DBMS is it possible to assign USAGE privileges to a user which can do an update query? In order to prevent SQL-injection.
5
votes
2answers
887 views

What can be accomplished with a site that is vulnerable to both XSS and SQLi

A comment on another question stated (quite simply): There are ways in which XSS and SQLi can be used together. This one is new to me, and I'm curious to hear what additional attack vectors might ...
1
vote
1answer
201 views

Mysql Information schema column_privileges empty

I can try some SQL-injection against a ad-hoc damn web application in my virtual enviroment for educational purpose. In one of these I obtain the table column_privileges (of Mysql Information schema) ...
1
vote
1answer
145 views

Anti-CSFR tokens and SQLi

I follow a SQLi tool on github and recently saw a conversation between the developer and a user. The user had tried to inject and gotten some errors, in the requests there was a anti-csfr token. The ...
1
vote
1answer
173 views

why they still exist webapps that are vulnerable to XSS and SQLi? [duplicate]

To protect your web application from XSS, it's enough to use the function htmlspecialchars($input, ENT_QUOTES); and mysqli_real_escape_string($var); for SQL Injection, it's a simple information and a ...
2
votes
3answers
1k views

Huge amount of hidden porn backlinks from legit WordPress sites, why they did it?

I was doing some backlink research and found a huge amount of legit websites linking to the site I was researching. The problem was that the anchor text of all the links where porn related terms.... ...
1
vote
0answers
145 views

How to distinguish between SQLi and ORMi

The OWASP Testing Guide (more precisely: Chapter 4 therein) provides a methodology to pentest web applications. It is currently being overhauled, Version 5 is scheduled for beginning of 2018. One of ...
24
votes
1answer
4k views

Understanding SQL injection payload

My server was hit by the following SQL injection payload:- ((/*!12345sELecT*/(@)from(/*!12345sELecT*/(@:=0x00),(/*!12345sELecT*/(@)from(`InFoRMAtiON_sCHeMa`.`ColUMNs`)where(`TAblE_sCHemA`=DatAbAsE/*...
1
vote
2answers
8k views

MariaDB SQL Injection vulnerability?

I'm testing for SQL Injection on a website. Basically, I'm trying it in the following url: http://example.org/webpage/* where in place of the * the payload should be injected. When I try to put in ...
1
vote
1answer
662 views

bypass SQL injection waf [closed]

The server I am pentesting has blind boolean SQL injection, so I was able to guess the DB name to be apps_community. But it detects words like "information_schema" and drops the connection request. It ...
0
votes
1answer
350 views

This is a Stack Trace or Sql Injection?

Yesterday I posted a question about whether I could do an SQL injection with the following error code: httpStatus":400,"errorCode":"BAD_QUERY_PARAMETER","message":"java.lang.NumberFormatException: ...
3
votes
2answers
1k views

Is this vulnerable to Sql Injection?

It turns out that I have an application that when I insert a simple quote the following appears to me: httpStatus":400,"errorCode":"BAD_QUERY_PARAMETER","message":"java.lang.NumberFormatException: ...
2
votes
1answer
346 views

Current list of safe PHP Practices? [closed]

I'm new to working with PHP, and recently inherited a website project where the original developer had been sanitizing user input with mysqli_real_escape_string() before querying the MySQL database. ...
2
votes
3answers
320 views

What SQL injection tool generates queries in my access_log?

A website of my client was compromised by a person claiming he/she has now access to the database. From the fact that this person sent an email saying "contact me and I will tell you where the hole is"...
4
votes
1answer
7k views

what are the consequences of increasing the “--risk” option of sqlmap?

I use sqlmap to test the services of my company. I tried increasing the value of its "--level" option, but I do not find clear descriptions of the tests added with an increased "--risk" value. So, ...
2
votes
1answer
150 views

Please rate this SQL injection prevention strategy

Recently a vendor representative told me that the reason a user couldn't log in to their site was that the password (which they check using an LDAP connection to our server) contained two consecutive ...
1
vote
0answers
157 views

I want to know if exist a vulnerability in using sp_send_dbmail of SQL Server?

I'm using the next stored procedure sp_send_dbmail in SQL Server 2012, the DBA ask me if it possible make SQL Injection using this SP, or SMTP Injection? In the configuration of the Database ...
0
votes
3answers
990 views

Using hidden form fields to modify prices on a website

I came across this question on cybrary about the attack to be used to modify prices on a website. First off, I'm assuming that by prices they mean prices of a product like on an E-Commerce website.(...
5
votes
3answers
9k views

What can I do with an SQL shell using SQLMap?

I was just messing around with SQLMap on Kali and I have now got an --sql-shell on the main database. With this, I wondered what I can do now with this access. How would I insert data into the ...
-5
votes
1answer
185 views

What should i do now? [duplicate]

i'm a student cybercrime. I've tested sql injection on an indian site that sells properties etc.. I was vunerable so i kept going with testing. so after half an hour i managed to get all the ...
1
vote
1answer
964 views

SQLMap Failure, Manual SQL Injection Success

I'm trying to understand why SQLMap failed when I think it shouldn't have. On my local network, I have a VM loaded with a very basic SQL injection vulnerability. Manually running this code through ...
0
votes
2answers
104 views

What does this forever loading behavior tell us?

I have a form with just username and password fields. Now as usual I entered this " or 1=1 -- query in username field and just gave a random password. And then the page kept loading forever until This ...
1
vote
2answers
856 views

SQL injections don't seem to work

I'm trying to execute a SQLi but the mysql gives a error response. The input should comment everything from after the two dashes out so it can result in this: '%'. Instead it gives this error: '--%''. ...
2
votes
2answers
1k views

Manually exploiting blind SQL injection in SELECT statement in X-Forwarded-For header

I am struggling exploiting this vulnerability in the code below: <?php ini_set('display_errors', 0); define("INDEX", 1); include '../db.php'; if(isset($_SERVER['HTTP_X_FORWARDED_FOR']) &&...
0
votes
1answer
103 views

Somebody gained access to MySQL database [duplicate]

Somebody emailed me this morning informing me that they gained access to my clients MySQL database and offered to fix the issue in exchange for money. I've been doing some testing with a real estate ...