Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [sql-injection]

SQL injection is a technique used to take advantage of vulnerabilities arising from non-validated input on web applications to pass SQL commands through for execution on a backend database.

0
votes
4answers
155 views

Security risks other than those [closed]

I'm working on ASP.NET core MVC website, and I don't know if I'm missing any security risks that I need to watch out for (other than logical ones) Here is a list of what I've studied and what I've ...
1
vote
1answer
1k views

How to get Sqlmap to detect insertion point with sleep payload?

I have a server which seems to be vulnerable to SQL injection with the following payload detected by BurpSuite: param=value,(select*from(select(sleep(10)))a) The application takes twice the time ...
1
vote
2answers
625 views

Preventing XSS and SQL-injection attacks

I have a question about XSS and SQL-injection attacks. All of the prevention methods against these attacks that I've read about rely on changing the application itself. Validating, filtering and ...
-1
votes
2answers
511 views

SQL injection - NEw attacks discovered on my site. Please advise

Recently discover someone doing the following seacrch queries on my website! 1 AND 1=2 UNION SELECT 0x6461726b31636f6465,0x6461726b32636f6465,0x6461726b33636f6465,0x6461726b34636f6465-- 2620 3 ...
0
votes
1answer
2k views

SQL injection does not work with mysqli

I am creating a simple mocking website that demonstrates SQL injection. It looks like this: The back end is written in PHP. <?php $query = $_GET['query']; $min_length = 3; if(...
2
votes
1answer
647 views

Find vulnerability in node.js web service to reveal secret key for admin

I've tried to solve the following "hacking" challenge in order to get experience with web vulnerabilities. The service is programmed in node.js and is accessible as http://lbs-course.askarov.net:...
4
votes
1answer
3k views

How to update table with sqlmap and without stacked queries?

down vote favorite I'm trying to use following code sqlmap -u "http://exp.com/portal/pd.jsp action=edit&info=products&sub_info=price" --cookie="JSESSIONID....." --dbms Oracle -D PRODUCTS -T ...
-1
votes
1answer
1k views

Sql injection strings dataset (for ML) [closed]

I'm looking for a dataset that contains sql injection attack strings. Have you ever seen one? I need it in order to train a machine learning classifier.
2
votes
1answer
545 views

Runtitme Error page is being displayed for XSS or SQL injection payloads

When I have manipulated the URI of an application with some SQL or XSS payloads I am able to see a runtime error page. Can we come to a conclusion that the application is vulnerable to SQL Injection ...
0
votes
2answers
475 views

Defending from POST requests from BURP?

On my site, I restrict access to forms through assigning a $_SESSION['id'] if they are logged in. If there is no $_SESSION['id'], to form page will redirect to a login page. But I ran burpsuite on ...
1
vote
1answer
346 views

Are all SQL injections exploitable through time-based attacks?

Suppose I am fuzzing for SQL injections, instead of trying all other approaches (error-based, boolean-based, union-based, stack-based), would telling my engine to only look for time-based discover all ...
1
vote
0answers
168 views

Prevent SQL Injection via Permissions?

For an application that I am planning, I have the requirement that input comes from about 30 to 50 SQL server source tables, and needs to be inserted into one target table. The source tables have ...
2
votes
1answer
224 views

Any known issues with ColdFusion 9 isNumeric check?

I'm probably just being paranoid again about security. The latest thing keeping me up at night is the checks that one of our websites uses. It runs ColdFusion 9 on windows environment and we check a ...
5
votes
2answers
4k views

Postgres protection from SQL Injection

Postgres allows dynamic code execution, which might leave it vulnerable to SQL injection. What protective measures does it have against this?
1
vote
1answer
650 views

techniques of sql injection (boolean based, UNION query-based, stacked queries and time-based blind) [closed]

I would like to know about these 2 SQL Injection techniques. I completed my studies in SQL databases and my teacher told me about SQL injection, then I became interested in this topic. I discovered a ...
51
votes
8answers
17k views

Is there a field length that is too short to allow harmful SQL injection?

I was reading about SQL injection and saw this, which got me thinking: input fields as small as possible to reduce the likelihood of a hacker being able to squeeze SQL code into the field without ...
2
votes
1answer
476 views

Someone searching “0x6461726b33636f6465” - what kind of exploit is this?

Recently spotted someone searching: 1 and 1 2 union select 0x6461726b31636f6465-- And a bunch of variations. What type of exploit is this and what does it attempt to do? I don't believe I'm at ...
1
vote
3answers
419 views

Is it possible to breach prepared statement and stored procedures with unsafe sql query string

Recently when I was looking through some code which looks more or less like this: $query = "call someProcedure(?,?,{$unsafeString})"; Then there is some code where the list of arguments is prepared ...
3
votes
1answer
6k views

jquery.js Dynamic Code Evaluation: Code Injection on setTimeout() line

I am working on fixing a potential security issue. I ran my HP fortify SCA and I got a critical priority report on my jquery.js file. Category : Dynamic Code Evaluation: Code Injection (3 Issues). ...
2
votes
0answers
896 views

SQLMap Strange Dump Result

Using SQLMap in this way: sqlmap -u "xxxxx" --dbms=MySql --dbs --user-agent="Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0" -D xxxxx -T "#__xxxxx" --columns I am obtaining ...
1
vote
1answer
2k views

Trying to understand how to use comment in SQL injection

I'm trying to inject basic query but I think I'm missing how to comment the end of those query. I tough using # or --' would work but I'm still ending with those kind of error: Syntax error or ...
2
votes
2answers
1k views

Sqlmap: bypass website security filtering SQL reserved words

I'm using sqlmap to get a website's DB and found out that the site is time-based boolean vulnerable; but the target is showing SQL errors, which made me think that it would be an injection error. I ...
1
vote
1answer
2k views

SQL injection possible with hidden GET parameters?

I was asked by my friend to play around with his family's new website and report any bugs I may encounter. Going through the pages, I noticed one that very much looks like it's prone to SQL injection. ...
1
vote
0answers
93 views

Exploting Query Selector injection in ExpressJS

So I have a vulnerable web page which uses Express framework for NodeJS. The vulnerable web page accepts the following traffic and returns a json data GET /findInfo?user=12345678 HTTP/1.1 Host: ...
2
votes
1answer
8k views

sqlmap load https request using “-r REQUESTFILE Load HTTP request from a file”

I'm testing a site that automatically redirects http request to https. When I'm using Burp I set the target to use https and the request goes through without a problem. However when I use the same ...
1
vote
2answers
86 views

I am unable to get rid of extra charecters with comments in SQL injection payload

I am practicing SQL injection with DVWA, but for some reason the server keeps giving me an error even when I comment out extra '. For example, here is what I inputed in my website: http://localhost/...
1
vote
1answer
557 views

someone trying to SQLi server using sqlmap

Someone is trying to SQLi my domain using sqlmap. I'm getting a lot of errors from mysql. My server access log shows: - - HTTP/1.1" 200 10559 "-" "sqlmap/1.0.4.0#dev (http://sqlmap.org)" ...
16
votes
2answers
4k views

Why is CSP needed to protect against img-src leak?

GitHub explains the problem with img-src in "GitHub's post-CSP journey": A tag with an unclosed quote will capture all output up to the next matching quote. This could include security sensitive ...
1
vote
0answers
159 views

Sql error at Login Page [closed]

I am testing an application where I am getting this SQL error message: RT_userName :test'; RT_userPassword fg Exceptionjava.sql.SQLException: Invalid SQL statement or JDBC escape, terminating ''' not ...
2
votes
0answers
148 views

SQL injection weird web app behaviour

I'm playing with SQL injection (for educational purpose only blah blah) and I got stuck on this weird (to me) web application behaviour: I successfully injected the following payload page.php?id=-1 ...
2
votes
1answer
270 views

First time penetration testing code check

In the following scenario the website allows users to upload an excel document that contains information that will be loaded to the database, and stored as values that can later be accessed by the ...
0
votes
1answer
200 views

SQL Injection Possibilities in my code

This is an sql query for a registration page. I want to know what are the possible injection queries if I use the below code in my web app registration page. $stud_reg_query = "INSERT INTO `...
3
votes
1answer
337 views

SQL injection in limited space

This might seem like a noob question. I am currently trying SQL injection on a VM. This is what I am trying union select group_concat(table_name) from information_schema.tables# And the injection ...
2
votes
4answers
246 views

How bad is allow edit a database field containing an sql from a form?

I have a table in a database (Mysql) which contains a field which stores sql strings on it. I mean complete queries as text (always select statements). To modify one of that queries is a "pain in the ...
1
vote
1answer
6k views

run sqlmap with http post request with encoding data

I have a target that http post request from that encoded As follows: data request post first url encoded and then base64 encoded. example request post from mentioned target As follows: POST /test/...
2
votes
2answers
717 views

Can the server crash while testing with the sqlmap tool?

When I was pentesting a cpanel web app I've got some passwords but while reading the tables the server went offline. I can exclude that my ip wasn't blocked because I tried to access the server ...
1
vote
1answer
818 views

Tools for Second Order SQL Injection [closed]

Was doing a CTF where 2nd order SQL injection was needed. It's all been done manually but was interested whether there were tools that could have automated the process. One page allowed you to add a ...
25
votes
2answers
7k views

Second order SQL injection protection

Normal SQL injections are no problem since I always use prepared statements, but how to protect oneself from second order SQL injections?
1
vote
3answers
969 views

How To Securely Run PHP From A Mysql Database [closed]

I have Mysql database with an API tied to it to call and run PHP code stored in that database. Yes, you heard right, PHP Code stored and run from a Mysql database. So, this is pretty serious from a ...
1
vote
1answer
1k views

Bypassing Directory Traversal Filter with separate Folder and File Inputs

I am trying to perform a Path Traversal attack on a very simple web only for educational purposes. What I have to do is access a file named passwords.txt located in \files\private\admin\passwords.txt,...
-4
votes
1answer
185 views

My website got hacked so what are the steps that I must take? [duplicate]

My website had to be shut down on being hacked by some sql injection and some XSS which has shown some of the loop holes in my script I used. So me being new to such situations My question is what ...
1
vote
1answer
134 views

Are these the only possible cases for DB injection?

After reading a bit on DB injections (whether SQL, NoSQL, or of any DB querying language whatsoever), I understand that there are only 3 possible cases for this kind of attack to be effective: When ...
2
votes
1answer
207 views

Why using bitmasking in Blind SQLi?

I'm following this tutorial on Pentesterlab about SQLi, and they're talking about Blind SQL. From what I thought blind SQLi was needed when you don't see (error) output from your target, and you can ...
22
votes
5answers
7k views

Could hashing prevent SQL injection?

On a whim I've recently decided to throw up the first proper website I created onto my local web server I use for development. I thought it'd be a great environment to throw some SQL at for injection ...
0
votes
1answer
449 views

Patching time based SQL injection?

During a third party website audit, I found that the User-Agent header is vulnerable to time based SQLi. Can anyone suggest me how to patch this vulnerability?
0
votes
2answers
190 views

Trying to replicate SQL injection attack

OK so I have a classic ASP website and it recently was victim of some SQL injection where some tables where updated. Nothing seriously happened as for I don't keep anything personal in the database. I'...
0
votes
1answer
90 views

Struggling to profile the query behind a SQLi vulnerability

I'm black-box pen testing a colleague's website for common vulnerabilities (mainly concerned with OWASP's top 10). I've found a SQL injection vulnerability in a form since the use of special ...
1
vote
2answers
539 views

using the CO2-Extension within Burp for sql injection

I am using the free version of Burp Suite and the CO2-Extension for sql injection attacks. Using the extension offers you two possible attacking ways: Either you copy the command which is ...
0
votes
1answer
1k views

Sql injection union select giving 500 internal error

I am trying to find a POC for an SQLI vulnerability, the backend db is Mysql on ASP.net using order by works fine, but union select give a 500 internal server error (which produce if there was any ...
0
votes
2answers
839 views

Can anyone bypass preg_replace for SQLi in my app?

In case of prevent SQLi happened I added this kind of check: preg_replace("#([\[\]\|\.\,:'])#s", " ", $data); This reg_ex should replace everything painfull, because the main query looks like ...