Questions tagged [sql-injection]

SQL injection is a technique used to take advantage of vulnerabilities arising from non-validated input on web applications to pass SQL commands through for execution on a backend database.

70 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
0answers
255 views

Obtaining large data sets for research: MySQL, PHP, Apache, etc

I have been looking around the web for large data sets (specifically web related log files - MySQL, PHP, Apache, and so on) that contains data of attempted intrusions/exploits. I am doing some ...
3
votes
0answers
99 views

How Can Exploit Xss and Sqli via HTTP Verb Tampering?

I was reading a paper about 'HTTP Verb Tampering' here: https://blog.jeremiahgrossman.com/2008/06/what-you-need-to-know-about-http-verb.html The author said: 2) HTTP Verb tampering is generally ...
3
votes
0answers
82 views

Vulnerable web application - sql-injection that's hard to find with a regular scanner like sqlmap

I am creating a "vulnerable web application". Is there a way to create a sql-injection vulnerability that is easy to spot during manual testing, but very hard (or impossible) for a regular sqli-...
3
votes
1answer
888 views

False positive SQL Injection by ZAP with adding new parameter query

I have a spring MVC web application and am running ZAP Active scan on it. I noticed that ZAP will modify URL , and add additional parameter named query and value query+AND+1%3D1+--+ to test SQL ...
2
votes
0answers
231 views

SQLmap on Login. Expect 401 reponse

I'm using sqlmap to test a login. When using invalid credentials, the webserver sends back a 401 response. However, sqlmap interprets this response as I'm not authorized to call this page and needs ...
2
votes
0answers
198 views

Does MySQL error “Illegal mix of collations” imply an SQL injection vulnerability?

The user input of a given query is being sanitized (PHP, real_escape_string), yet the query fails with "Illegal mix of collations". This query is below: SELECT * FROM `table` WHERE `column` = "�½��ļ��...
2
votes
0answers
943 views

SQLMap Strange Dump Result

Using SQLMap in this way: sqlmap -u "xxxxx" --dbms=MySql --dbs --user-agent="Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0" -D xxxxx -T "#__xxxxx" --columns I am obtaining ...
2
votes
0answers
148 views

SQL injection weird web app behaviour

I'm playing with SQL injection (for educational purpose only blah blah) and I got stuck on this weird (to me) web application behaviour: I successfully injected the following payload page.php?id=-1 ...
1
vote
0answers
59 views

how to create random request time delay in sqlmap?

How can i configure sql-map to try payloads at random time delay? as an example time between first and second request can be 0.10s and second and third might 0.25 and so on. i know there is --delay ...
1
vote
1answer
30 views

How to input generic type or determine data types for selected values in UNION ALL SQL injection attack?

I've determined that the application is vulnerable to SQL injection and the proper amount of values to SELECT in the corresponding UNION ALL query: foo' UNION ALL SELECT '1','1','1','1','1','1','1','...
1
vote
0answers
69 views

WAF is set to Alert, not block. We are seeing thousands of XSS and SQL Injection attacks. How can I tell if any were actually successful?

I'm pretty inexperienced with WAFs and the events/alerts it generates. I'm wondering how I can tell if any of those were successful? For example, in the last 24 hours we saw over 50K alerts/events ...
1
vote
1answer
148 views

What kind of attack is a request like this?

The number of request strings like this one seems to have increased over the last weeks. They all have in common, that they contain a combination of google adwords / google adsense parameters and sql ...
1
vote
1answer
525 views

Sql injection bypass against KONA(akmai) WAF

I have been trying to find sql injection against a site in bug bounty.I tried a few parameters via sql map.One such query was shown to be injectible. Parameter: query (GET) Type: boolean-based ...
1
vote
2answers
390 views

SQL-injection, unable to get it to work!

I've recently found a SQL-injection vulnerability in one of our web applications. I've been able to exploit this SQLi, but only able to extract some very basic information. I'm not an expert pentester ...
1
vote
0answers
245 views

How to find no of columns using sql injection

I'm new to web penetration testing and when I tried to test a website, I found that when I entered ' in the text box, I would get the following error: OraOLEDB error '80004005' ORA-01756: quoted ...
1
vote
0answers
305 views

SQLmap error (what happen if i have no parameters)

I have an error when I use sqlmap. The problem is: I use this dork https://www.exploit-db.com/ghdb/4301/ but I do not know how to use sqlmap with this type of sql injection. I use the classic: ...
1
vote
2answers
975 views

DVWA: “Hacking attempt detected…”

Hello and good evening, i've recently tried to improve my pentesting skills and learn more about it with metasploitable 2. I am trying some things on the DVWA. For the moment, i am learning the ...
1
vote
0answers
1k views

is it possible to insert data using sql injection in select statement?

First of all i am testing it on my server for learning purpose. The condition here is i want to insert a entry in test table in database and SELECT * FROM `student` WHERE `name` LIKE '% ".$name." %';...
1
vote
0answers
628 views

DVWA cant be injected with SQLMAP [id is not injectionable]

I'm trying to catch SQL Injection attacks from DVWA with sqlmap, I'm using the most simple option it provides, but it's strange that sometimes it works and other it doesn't, showing a message similar ...
1
vote
1answer
1k views

Custom post data JSON payload format in sqlmap?

I want to perform SQL injection but I don't know how to use the command. So far, I have tried this: --data="{'user_id':'6','user_with:5*'}" --prefix=" OR user_to = 5)" --suffix="#" -vvv` I use ' ...
1
vote
0answers
1k views

Change injection payload in SQLmap

I know you can change parameters and all, but can you change the payload that you’re sending? Like if I wanted to send a payload that would put a txt in someone’s database, is that possible? I’m new ...
1
vote
0answers
198 views

MySQL Injection

The following line of vulnerable code makes the user input always upper case: mysql_query("select * from " . strtoupper($_GET['table'])); In a scenario where MySQL's "lower_case_table_names" is set ...
1
vote
1answer
219 views

Mysql Information schema column_privileges empty

I can try some SQL-injection against a ad-hoc damn web application in my virtual enviroment for educational purpose. In one of these I obtain the table column_privileges (of Mysql Information schema) ...
1
vote
0answers
153 views

How to distinguish between SQLi and ORMi

The OWASP Testing Guide (more precisely: Chapter 4 therein) provides a methodology to pentest web applications. It is currently being overhauled, Version 5 is scheduled for beginning of 2018. One of ...
1
vote
0answers
159 views

I want to know if exist a vulnerability in using sp_send_dbmail of SQL Server?

I'm using the next stored procedure sp_send_dbmail in SQL Server 2012, the DBA ask me if it possible make SQL Injection using this SP, or SMTP Injection? In the configuration of the Database ...
1
vote
0answers
183 views

Prevent SQL Injection via Permissions?

For an application that I am planning, I have the requirement that input comes from about 30 to 50 SQL server source tables, and needs to be inserted into one target table. The source tables have ...
1
vote
0answers
94 views

Exploting Query Selector injection in ExpressJS

So I have a vulnerable web page which uses Express framework for NodeJS. The vulnerable web page accepts the following traffic and returns a json data GET /findInfo?user=12345678 HTTP/1.1 Host: ...
1
vote
0answers
4k views

SQLMAP - POST JSON data as body

Hi I'm trying to do a SQL injection in a login form. With BurpSuite I intercept the request: POST /xxxx/web/Login HTTP/1.1 Host: 10.0.0.70:42020 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10....
1
vote
0answers
381 views

Microsoft IIS 7.5 from Time Based SQLi DBA to shell

I am dealing with a time-based SQLi in a Microsoft IIS 7.5 Server and I want to upload a shell. My approach is to get the internal application path, and then, try to upload a file with sqlmap --file-...
1
vote
0answers
498 views

How to use SQLMap/Burp to perform SQL injection on a form that is behind another form

I have a form that takes in an IP address and loads that page (Acts as a Web Application Proxy). The page that gets loaded has an SQL injection vulnerability. How can I use SQLMap or BURP to exploit ...
1
vote
0answers
313 views

How to start server for SQLiPy manually as well as in burp?

I have recently started using Burp and came across SQLiPy and I am stuck how to use it. python sqlmapapi.py -s -H <ip> -p <port> Can you please guide me what needs to be entered in the ...
1
vote
0answers
571 views

The database sqlmap is trying to read is too big. I time out every time

So I found the database and then the table and the columns and I'm trying to dump the column data but it is too big. It keep taking ~2 mins then timing out.
1
vote
0answers
160 views

How to see the result of your query in SQL injection on the webpage?

I have a webpage which is vulnerable to SQL injection. As I know the number of columns so I inserted 'union select 1,db_name(),3,4,5-- and got database name listed in the second column of a table ...
1
vote
0answers
387 views

Can you use null byte injection to exploit SQLi in Postgres?

While testing, I do get an error when passing the input asdf%00 to my applications username. The database in the backend spits an error, because Postgre can't handle 0x00 in text fields. <h4>...
1
vote
0answers
2k views

Dumping Large table using Sqlmap

I am learning/working on sqlmap and I was trying to dump a large table with 11K entries on my localhost. The command I used is: python sqlmap.py -u "http://localhost/searchre.php" --data="search=' ...
1
vote
0answers
144 views

Oracle PL/SQL SQL Injection Test from Unicode to Windows-1252

I have a DB using windows-1252 character encoding and dynamic SQL that does simple single quote escaping like this... l_str := REPLACE(TRIM(someUserInput),'''',''''''); Because the DB is windows-...
1
vote
0answers
403 views

Encoding payloads for GWT version 7

I'm auditing a website built with Google Web Toolkit. It uses serialization version 7, so the tools from GDS Security won't work (they only work till version 5). Using this technique I got all classes,...
1
vote
0answers
4k views

How to tell sqlmap to resume an exploit from results-*.csv file?

How to notify SQLMap to resume an exploit from results-*.csv file? Example: ~/.sqlmap/output/results-xxxxxxxxxx.csv Target URL,Place,Parameter,Techniques http://example.com:80/login.php,POST,...
1
vote
0answers
924 views

How to identify column types during sql injection with “union all select” construct?

Situation is following: I have identified sql injection attack vector, and have following information about target table: It has six columns. (Identified using "order by"). I can see output of 3 of ...
1
vote
0answers
119 views

Which enterprise-class DBMS allow forbiddance of (No)SQL comments?

This question could be renamed "Would forbidding SQL comments inside transactions prevent some SQL injections?", but I'd like to know if some DBMS allow this first. The goal is to reduce the attack ...
1
vote
0answers
286 views

Hacking attempts: SQL injection adding script in.js

A client of mine keeps getting hacked by seemingly SQL injection where a script tag containing a link to an in.js file is added. Sometimes from a domain called sportserve.co.uk, other times from ...
0
votes
1answer
38 views

Character filtration in globalisation supported application

I am working on building an application which will be used in various language , to secure from attacks like xss, SQL injection I thought implementing character filteration (whitelisting/blacking) but ...
0
votes
0answers
79 views

SQL Injection bypass UNION filter/restriciton

I've recently had an interesting interview exercise I haven't completed and it does puzzle me what kind of filter/protection they've used. The vuln app is a PHP with simple MariaDB (5.5.56) back-end, ...
0
votes
0answers
105 views

How to send file with SQLMap

Note: this is a challenge in a past CTF. There is a webapp where you can submit an image that contains some text and the app will run an OCR and search for the text in a database. The app is ...
0
votes
0answers
101 views

Boolean blind SQLi with sqlmap

I am trying to run sqlmap in order to find a flag for a CTF. The injection string is sent via a POST request in the parameter called search. The response is received as either 1, 2, or 3 (error codes),...
0
votes
0answers
148 views

SQLMAP injection with dynamic token?

I've a web app that has an injection point in POST data. POST data requires 4 params and one of these is a session-custom token. The problem is that every time request is made i need to get a new ...
0
votes
0answers
36 views

SQL injection in Go with database/sql lib

Is it possible to inject SQL statements with fmt.Sprintf instead of Db.qwery with the ? and not %s parameter? I know it's a bad habit to use it but I wonder if it's possible or not. Example : query :...
0
votes
1answer
430 views

sqlmap - Testing parameters when reading request from file

After hours of trial an error I decided to ask here for some advice. I am currently trying to perform a sqlinj using using sqlmap on a system that was specifically designed to be attacked. The API ...
0
votes
0answers
189 views

Exploiting MairaDB Sql Injection with procedure analyse and extractvalue()

I am testing a sql injection to a website. And spending several hours i just become to get the version of the database. test.com/abc.php?query=1&limit=3 procedure analyse(extractvalue(rand(),...
0
votes
0answers
41 views

WAF tuning for SQLi

We have a record tracking application behind WAF. Everytime end users submit a record with special chars such as ' or " or () it blocks it as SQLi even when the payload is completely benign. At the ...