Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [sql-injection]

SQL injection is a technique used to take advantage of vulnerabilities arising from non-validated input on web applications to pass SQL commands through for execution on a backend database.

4
votes
0answers
244 views

Obtaining large data sets for research: MySQL, PHP, Apache, etc

I have been looking around the web for large data sets (specifically web related log files - MySQL, PHP, Apache, and so on) that contains data of attempted intrusions/exploits. I am doing some ...
3
votes
0answers
52 views

How Can Exploit Xss and Sqli via HTTP Verb Tampering?

I was reading a paper about 'HTTP Verb Tampering' here: https://blog.jeremiahgrossman.com/2008/06/what-you-need-to-know-about-http-verb.html The author said: 2) HTTP Verb tampering is generally ...
3
votes
0answers
73 views

Vulnerable web application - sql-injection that's hard to find with a regular scanner like sqlmap

I am creating a "vulnerable web application". Is there a way to create a sql-injection vulnerability that is easy to spot during manual testing, but very hard (or impossible) for a regular sqli-...
2
votes
0answers
179 views

How do I use sqlmap to dump the OWASP Juice Shop schema?

EDIT 4/12/19: Added reproduction steps. I cannot seem to get sqlmap to successfully exploit and retrieve schema information from OWASP's deliberately vulnerable Juice Shop web application. I've ...
2
votes
0answers
164 views

SQLmap on Login. Expect 401 reponse

I'm using sqlmap to test a login. When using invalid credentials, the webserver sends back a 401 response. However, sqlmap interprets this response as I'm not authorized to call this page and needs ...
2
votes
0answers
142 views

Does MySQL error “Illegal mix of collations” imply an SQL injection vulnerability?

The user input of a given query is being sanitized (PHP, real_escape_string), yet the query fails with "Illegal mix of collations". This query is below: SELECT * FROM `table` WHERE `column` = "�½��ļ��...
2
votes
0answers
885 views

SQLMap Strange Dump Result

Using SQLMap in this way: sqlmap -u "xxxxx" --dbms=MySql --dbs --user-agent="Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0" -D xxxxx -T "#__xxxxx" --columns I am obtaining ...
2
votes
0answers
148 views

SQL injection weird web app behaviour

I'm playing with SQL injection (for educational purpose only blah blah) and I got stuck on this weird (to me) web application behaviour: I successfully injected the following payload page.php?id=-1 ...
1
vote
0answers
58 views

WAF is set to Alert, not block. We are seeing thousands of XSS and SQL Injection attacks. How can I tell if any were actually successful?

I'm pretty inexperienced with WAFs and the events/alerts it generates. I'm wondering how I can tell if any of those were successful? For example, in the last 24 hours we saw over 50K alerts/events ...
1
vote
0answers
174 views

SQLmap check sql burp vulnerability

Burp suggests me that an application has an SQL injection point. First request: GET /restrict/menuApc.do?MVPG=ApcAssistitoTSRicercaPre&ASSISTITO_ID=*SRVZOSA40002294'&s_ELIMINATI=1&...
1
vote
0answers
166 views

How to find no of columns using sql injection

I'm new to web penetration testing and when I tried to test a website, I found that when I entered ' in the text box, I would get the following error: OraOLEDB error '80004005' ORA-01756: quoted ...
1
vote
0answers
278 views

SQLmap error (what happen if i have no parameters)

I have an error when I use sqlmap. The problem is: I use this dork https://www.exploit-db.com/ghdb/4301/ but I do not know how to use sqlmap with this type of sql injection. I use the classic: ...
1
vote
0answers
884 views

is it possible to insert data using sql injection in select statement?

First of all i am testing it on my server for learning purpose. The condition here is i want to insert a entry in test table in database and SELECT * FROM `student` WHERE `name` LIKE '% ".$name." %';...
1
vote
0answers
526 views

DVWA cant be injected with SQLMAP [id is not injectionable]

I'm trying to catch SQL Injection attacks from DVWA with sqlmap, I'm using the most simple option it provides, but it's strange that sometimes it works and other it doesn't, showing a message similar ...
1
vote
0answers
1k views

Change injection payload in SQLmap

I know you can change parameters and all, but can you change the payload that you’re sending? Like if I wanted to send a payload that would put a txt in someone’s database, is that possible? I’m new ...
1
vote
0answers
185 views

MySQL Injection

The following line of vulnerable code makes the user input always upper case: mysql_query("select * from " . strtoupper($_GET['table'])); In a scenario where MySQL's "lower_case_table_names" is set ...
1
vote
0answers
145 views

How to distinguish between SQLi and ORMi

The OWASP Testing Guide (more precisely: Chapter 4 therein) provides a methodology to pentest web applications. It is currently being overhauled, Version 5 is scheduled for beginning of 2018. One of ...
1
vote
0answers
157 views

I want to know if exist a vulnerability in using sp_send_dbmail of SQL Server?

I'm using the next stored procedure sp_send_dbmail in SQL Server 2012, the DBA ask me if it possible make SQL Injection using this SP, or SMTP Injection? In the configuration of the Database ...
1
vote
0answers
165 views

Prevent SQL Injection via Permissions?

For an application that I am planning, I have the requirement that input comes from about 30 to 50 SQL server source tables, and needs to be inserted into one target table. The source tables have ...
1
vote
0answers
92 views

Exploting Query Selector injection in ExpressJS

So I have a vulnerable web page which uses Express framework for NodeJS. The vulnerable web page accepts the following traffic and returns a json data GET /findInfo?user=12345678 HTTP/1.1 Host: ...
1
vote
0answers
3k views

SQLMAP - POST JSON data as body

Hi I'm trying to do a SQL injection in a login form. With BurpSuite I intercept the request: POST /xxxx/web/Login HTTP/1.1 Host: 10.0.0.70:42020 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10....
1
vote
0answers
350 views

Microsoft IIS 7.5 from Time Based SQLi DBA to shell

I am dealing with a time-based SQLi in a Microsoft IIS 7.5 Server and I want to upload a shell. My approach is to get the internal application path, and then, try to upload a file with sqlmap --file-...
1
vote
0answers
490 views

How to use SQLMap/Burp to perform SQL injection on a form that is behind another form

I have a form that takes in an IP address and loads that page (Acts as a Web Application Proxy). The page that gets loaded has an SQL injection vulnerability. How can I use SQLMap or BURP to exploit ...
1
vote
0answers
281 views

How to start server for SQLiPy manually as well as in burp?

I have recently started using Burp and came across SQLiPy and I am stuck how to use it. python sqlmapapi.py -s -H <ip> -p <port> Can you please guide me what needs to be entered in the ...
1
vote
0answers
503 views

The database sqlmap is trying to read is too big. I time out every time

So I found the database and then the table and the columns and I'm trying to dump the column data but it is too big. It keep taking ~2 mins then timing out.
1
vote
0answers
154 views

How to see the result of your query in SQL injection on the webpage?

I have a webpage which is vulnerable to SQL injection. As I know the number of columns so I inserted 'union select 1,db_name(),3,4,5-- and got database name listed in the second column of a table ...
1
vote
0answers
367 views

Can you use null byte injection to exploit SQLi in Postgres?

While testing, I do get an error when passing the input asdf%00 to my applications username. The database in the backend spits an error, because Postgre can't handle 0x00 in text fields. <h4>...
1
vote
0answers
2k views

Dumping Large table using Sqlmap

I am learning/working on sqlmap and I was trying to dump a large table with 11K entries on my localhost. The command I used is: python sqlmap.py -u "http://localhost/searchre.php" --data="search=' ...
1
vote
0answers
132 views

Oracle PL/SQL SQL Injection Test from Unicode to Windows-1252

I have a DB using windows-1252 character encoding and dynamic SQL that does simple single quote escaping like this... l_str := REPLACE(TRIM(someUserInput),'''',''''''); Because the DB is windows-...
1
vote
0answers
375 views

Encoding payloads for GWT version 7

I'm auditing a website built with Google Web Toolkit. It uses serialization version 7, so the tools from GDS Security won't work (they only work till version 5). Using this technique I got all classes,...
1
vote
0answers
4k views

How to tell sqlmap to resume an exploit from results-*.csv file?

How to notify SQLMap to resume an exploit from results-*.csv file? Example: ~/.sqlmap/output/results-xxxxxxxxxx.csv Target URL,Place,Parameter,Techniques http://example.com:80/login.php,POST,...
1
vote
0answers
895 views

How to identify column types during sql injection with “union all select” construct?

Situation is following: I have identified sql injection attack vector, and have following information about target table: It has six columns. (Identified using "order by"). I can see output of 3 of ...
1
vote
0answers
119 views

Which enterprise-class DBMS allow forbiddance of (No)SQL comments?

This question could be renamed "Would forbidding SQL comments inside transactions prevent some SQL injections?", but I'd like to know if some DBMS allow this first. The goal is to reduce the attack ...
1
vote
0answers
256 views

Hacking attempts: SQL injection adding script in.js

A client of mine keeps getting hacked by seemingly SQL injection where a script tag containing a link to an in.js file is added. Sometimes from a domain called sportserve.co.uk, other times from ...
0
votes
0answers
35 views

SQLMAP injection with dynamic token?

I've a web app that has an injection point in POST data. POST data requires 4 params and one of these is a session-custom token. The problem is that every time request is made i need to get a new ...
0
votes
0answers
52 views

What kind of attack is a request like this?

The number of request strings like this one seems to have increased over the last weeks. They all have in common, that they contain a combination of google adwords / google adsense parameters and sql ...
0
votes
0answers
30 views

SQL injection in Go with database/sql lib

Is it possible to inject SQL statements with fmt.Sprintf instead of Db.qwery with the ? and not %s parameter? I know it's a bad habit to use it but I wonder if it's possible or not. Example : query :...
0
votes
0answers
94 views

Error based SQL Injection Oracle

I have this valid GET request: GET /restrict/menuApc.do?ID_ASSISTITO=ciao&MVPG=ApcAssistitiRicerca&s_TIPO_ASSISTITO=&s_ASSISTITO=giovanni&s_TIPO_SOGGETTO= HTTP/1.1 Host: test:8080 ...
0
votes
0answers
102 views

Exploiting MairaDB Sql Injection with procedure analyse and extractvalue()

I am testing a sql injection to a website. And spending several hours i just become to get the version of the database. test.com/abc.php?query=1&limit=3 procedure analyse(extractvalue(rand(),...
0
votes
0answers
35 views

WAF tuning for SQLi

We have a record tracking application behind WAF. Everytime end users submit a record with special chars such as ' or " or () it blocks it as SQLi even when the payload is completely benign. At the ...
0
votes
0answers
46 views

How to make --os-shell command work on UBUNTU 16.04 ( Digital Ocean )?

I have made a vulnerable SQLi website ( to teach students ). I am able to dump the database but I am not able to run os commands or upload os-shell. I want to show them how to use --os-shell option ...
0
votes
0answers
113 views

How trying to fetch limited entries using sqlmap?

I have 1 table (eg: users) with more than 1 million entries. But when using Sqlmap try to --start and --stop it's not Working. For example the query is: sqlmap.py -u http://example.com/index.php?id=...
0
votes
0answers
58 views

Introduce a SQLi in a testing application

So I was building an application to demonstrate SQL injection via cookies and wrote some code to run SQL statements if the statement are passed within a redir cookie header but when using sqlmap to ...
0
votes
0answers
132 views

sqlmap: Upload file to get UUID to submit with main request?

I've been looking for a way to use sqlmap with a file-upload form that, when submitted, first uploads the given file to get back a UUID, which is then send along with the user information in another ...
0
votes
0answers
238 views

How to use binary search for blind SQL injection queries

From what I read online, it's possible to apply binary search to exploit blind SQL injection vulnerabilities, and that is probably what tools like sqlmap use to lower the number of queries that need ...
0
votes
0answers
355 views

From SQL Injection in SQLite to shell

I need to obtain a shell from an SQL injection over an application with sqlite database. Currently my exploit looks like the following: lucian@0x90:~/$ proxychains nc 10.185.10.55 1101 ProxyChains-3....
0
votes
0answers
111 views

Blind SQL injection - Get a time out and don't know why

During a CTF, I had the intuition that there was a blind SQL injection entry point in the URL. I tried to inject: ' UNION SLEEP(5);-- I was expecting to receive a response after 5s, but actually, I ...
0
votes
0answers
143 views

Detecting SQL injection HIPS and WAF

WAF and HIPS detect SQL injection based on rules. For example 1" OR 1=1 -- Both devices will block it. How about `1" OR 300+1-300+0=50+57-6 -- ? In my scenario HIPS doesn't seem to be able detect ...
0
votes
0answers
186 views

How does the Evil Twin SQL injection query works?

I have been reading about SQL injection and got hit at Evil Twin SQL injection here. There are two queries mentioned in the article as follows. -1' union select 1,2,3,(select (@) from (select(@:=0x00)...
0
votes
0answers
1k views

MySQL SQL Injection - Get User Password

I've used SQLMAP to check for SQL injection. I've managed to retrieve the name of just one database (dbInfo) However, using SQLMAP I can't enumerate anything else - where it is tables within the DB ...