Questions tagged [sql-injection]

SQL injection is a technique used to take advantage of vulnerabilities arising from non-validated input on web applications to pass SQL commands through for execution on a backend database.

4
votes
0answers
245 views

Obtaining large data sets for research: MySQL, PHP, Apache, etc

I have been looking around the web for large data sets (specifically web related log files - MySQL, PHP, Apache, and so on) that contains data of attempted intrusions/exploits. I am doing some ...
3
votes
0answers
56 views

How Can Exploit Xss and Sqli via HTTP Verb Tampering?

I was reading a paper about 'HTTP Verb Tampering' here: https://blog.jeremiahgrossman.com/2008/06/what-you-need-to-know-about-http-verb.html The author said: 2) HTTP Verb tampering is generally ...
3
votes
0answers
75 views

Vulnerable web application - sql-injection that's hard to find with a regular scanner like sqlmap

I am creating a "vulnerable web application". Is there a way to create a sql-injection vulnerability that is easy to spot during manual testing, but very hard (or impossible) for a regular sqli-...
2
votes
0answers
251 views

How do I use sqlmap to dump the OWASP Juice Shop schema?

EDIT 4/12/19: Added reproduction steps. I cannot seem to get sqlmap to successfully exploit and retrieve schema information from OWASP's deliberately vulnerable Juice Shop web application. I've ...
2
votes
0answers
190 views

SQLmap on Login. Expect 401 reponse

I'm using sqlmap to test a login. When using invalid credentials, the webserver sends back a 401 response. However, sqlmap interprets this response as I'm not authorized to call this page and needs ...
2
votes
0answers
157 views

Does MySQL error “Illegal mix of collations” imply an SQL injection vulnerability?

The user input of a given query is being sanitized (PHP, real_escape_string), yet the query fails with "Illegal mix of collations". This query is below: SELECT * FROM `table` WHERE `column` = "�½��ļ��...
2
votes
0answers
899 views

SQLMap Strange Dump Result

Using SQLMap in this way: sqlmap -u "xxxxx" --dbms=MySql --dbs --user-agent="Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0" -D xxxxx -T "#__xxxxx" --columns I am obtaining ...
2
votes
0answers
148 views

SQL injection weird web app behaviour

I'm playing with SQL injection (for educational purpose only blah blah) and I got stuck on this weird (to me) web application behaviour: I successfully injected the following payload page.php?id=-1 ...
1
vote
0answers
62 views

WAF is set to Alert, not block. We are seeing thousands of XSS and SQL Injection attacks. How can I tell if any were actually successful?

I'm pretty inexperienced with WAFs and the events/alerts it generates. I'm wondering how I can tell if any of those were successful? For example, in the last 24 hours we saw over 50K alerts/events ...
1
vote
0answers
259 views

SQLmap check sql burp vulnerability

Burp suggests me that an application has an SQL injection point. First request: GET /restrict/menuApc.do?MVPG=ApcAssistitoTSRicercaPre&ASSISTITO_ID=*SRVZOSA40002294'&s_ELIMINATI=1&...
1
vote
0answers
196 views

How to find no of columns using sql injection

I'm new to web penetration testing and when I tried to test a website, I found that when I entered ' in the text box, I would get the following error: OraOLEDB error '80004005' ORA-01756: quoted ...
1
vote
0answers
285 views

SQLmap error (what happen if i have no parameters)

I have an error when I use sqlmap. The problem is: I use this dork https://www.exploit-db.com/ghdb/4301/ but I do not know how to use sqlmap with this type of sql injection. I use the classic: ...
1
vote
0answers
1k views

is it possible to insert data using sql injection in select statement?

First of all i am testing it on my server for learning purpose. The condition here is i want to insert a entry in test table in database and SELECT * FROM `student` WHERE `name` LIKE '% ".$name." %';...
1
vote
0answers
557 views

DVWA cant be injected with SQLMAP [id is not injectionable]

I'm trying to catch SQL Injection attacks from DVWA with sqlmap, I'm using the most simple option it provides, but it's strange that sometimes it works and other it doesn't, showing a message similar ...
1
vote
0answers
1k views

Change injection payload in SQLmap

I know you can change parameters and all, but can you change the payload that you’re sending? Like if I wanted to send a payload that would put a txt in someone’s database, is that possible? I’m new ...
1
vote
0answers
190 views

MySQL Injection

The following line of vulnerable code makes the user input always upper case: mysql_query("select * from " . strtoupper($_GET['table'])); In a scenario where MySQL's "lower_case_table_names" is set ...
1
vote
0answers
146 views

How to distinguish between SQLi and ORMi

The OWASP Testing Guide (more precisely: Chapter 4 therein) provides a methodology to pentest web applications. It is currently being overhauled, Version 5 is scheduled for beginning of 2018. One of ...
1
vote
0answers
157 views

I want to know if exist a vulnerability in using sp_send_dbmail of SQL Server?

I'm using the next stored procedure sp_send_dbmail in SQL Server 2012, the DBA ask me if it possible make SQL Injection using this SP, or SMTP Injection? In the configuration of the Database ...
1
vote
0answers
169 views

Prevent SQL Injection via Permissions?

For an application that I am planning, I have the requirement that input comes from about 30 to 50 SQL server source tables, and needs to be inserted into one target table. The source tables have ...
1
vote
0answers
93 views

Exploting Query Selector injection in ExpressJS

So I have a vulnerable web page which uses Express framework for NodeJS. The vulnerable web page accepts the following traffic and returns a json data GET /findInfo?user=12345678 HTTP/1.1 Host: ...
1
vote
0answers
4k views

SQLMAP - POST JSON data as body

Hi I'm trying to do a SQL injection in a login form. With BurpSuite I intercept the request: POST /xxxx/web/Login HTTP/1.1 Host: 10.0.0.70:42020 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10....
1
vote
0answers
360 views

Microsoft IIS 7.5 from Time Based SQLi DBA to shell

I am dealing with a time-based SQLi in a Microsoft IIS 7.5 Server and I want to upload a shell. My approach is to get the internal application path, and then, try to upload a file with sqlmap --file-...
1
vote
0answers
491 views

How to use SQLMap/Burp to perform SQL injection on a form that is behind another form

I have a form that takes in an IP address and loads that page (Acts as a Web Application Proxy). The page that gets loaded has an SQL injection vulnerability. How can I use SQLMap or BURP to exploit ...
1
vote
0answers
286 views

How to start server for SQLiPy manually as well as in burp?

I have recently started using Burp and came across SQLiPy and I am stuck how to use it. python sqlmapapi.py -s -H <ip> -p <port> Can you please guide me what needs to be entered in the ...
1
vote
0answers
513 views

The database sqlmap is trying to read is too big. I time out every time

So I found the database and then the table and the columns and I'm trying to dump the column data but it is too big. It keep taking ~2 mins then timing out.
1
vote
0answers
155 views

How to see the result of your query in SQL injection on the webpage?

I have a webpage which is vulnerable to SQL injection. As I know the number of columns so I inserted 'union select 1,db_name(),3,4,5-- and got database name listed in the second column of a table ...
1
vote
0answers
370 views

Can you use null byte injection to exploit SQLi in Postgres?

While testing, I do get an error when passing the input asdf%00 to my applications username. The database in the backend spits an error, because Postgre can't handle 0x00 in text fields. <h4>...
1
vote
0answers
2k views

Dumping Large table using Sqlmap

I am learning/working on sqlmap and I was trying to dump a large table with 11K entries on my localhost. The command I used is: python sqlmap.py -u "http://localhost/searchre.php" --data="search=' ...
1
vote
0answers
135 views

Oracle PL/SQL SQL Injection Test from Unicode to Windows-1252

I have a DB using windows-1252 character encoding and dynamic SQL that does simple single quote escaping like this... l_str := REPLACE(TRIM(someUserInput),'''',''''''); Because the DB is windows-...
1
vote
0answers
383 views

Encoding payloads for GWT version 7

I'm auditing a website built with Google Web Toolkit. It uses serialization version 7, so the tools from GDS Security won't work (they only work till version 5). Using this technique I got all classes,...
1
vote
0answers
4k views

How to tell sqlmap to resume an exploit from results-*.csv file?

How to notify SQLMap to resume an exploit from results-*.csv file? Example: ~/.sqlmap/output/results-xxxxxxxxxx.csv Target URL,Place,Parameter,Techniques http://example.com:80/login.php,POST,...
1
vote
0answers
902 views

How to identify column types during sql injection with “union all select” construct?

Situation is following: I have identified sql injection attack vector, and have following information about target table: It has six columns. (Identified using "order by"). I can see output of 3 of ...
1
vote
0answers
119 views

Which enterprise-class DBMS allow forbiddance of (No)SQL comments?

This question could be renamed "Would forbidding SQL comments inside transactions prevent some SQL injections?", but I'd like to know if some DBMS allow this first. The goal is to reduce the attack ...
1
vote
0answers
262 views

Hacking attempts: SQL injection adding script in.js

A client of mine keeps getting hacked by seemingly SQL injection where a script tag containing a link to an in.js file is added. Sometimes from a domain called sportserve.co.uk, other times from ...
0
votes
0answers
5 views

Understanding SQLMAP payload

I was participating in a CTF and there was a SQL Injection challenge. There is a Wordpress page with a vulnerable plugin parameter (let's call the website https://vulnerable.com/), and the solution ...
0
votes
0answers
40 views

How to send file with SQLMap

Note: this is a challenge in a past CTF. There is a webapp where you can submit an image that contains some text and the app will run an OCR and search for the text in a database. The app is ...
0
votes
0answers
40 views

Boolean blind SQLi with sqlmap

I am trying to run sqlmap in order to find a flag for a CTF. The injection string is sent via a POST request in the parameter called search. The response is received as either 1, 2, or 3 (error codes),...
0
votes
0answers
73 views

SQLMAP injection with dynamic token?

I've a web app that has an injection point in POST data. POST data requires 4 params and one of these is a session-custom token. The problem is that every time request is made i need to get a new ...
0
votes
0answers
31 views

SQL injection in Go with database/sql lib

Is it possible to inject SQL statements with fmt.Sprintf instead of Db.qwery with the ? and not %s parameter? I know it's a bad habit to use it but I wonder if it's possible or not. Example : query :...
0
votes
0answers
126 views

Error based SQL Injection Oracle

I have this valid GET request: GET /restrict/menuApc.do?ID_ASSISTITO=ciao&MVPG=ApcAssistitiRicerca&s_TIPO_ASSISTITO=&s_ASSISTITO=giovanni&s_TIPO_SOGGETTO= HTTP/1.1 Host: test:8080 ...
0
votes
0answers
145 views

Exploiting MairaDB Sql Injection with procedure analyse and extractvalue()

I am testing a sql injection to a website. And spending several hours i just become to get the version of the database. test.com/abc.php?query=1&limit=3 procedure analyse(extractvalue(rand(),...
0
votes
0answers
37 views

WAF tuning for SQLi

We have a record tracking application behind WAF. Everytime end users submit a record with special chars such as ' or " or () it blocks it as SQLi even when the payload is completely benign. At the ...
0
votes
0answers
49 views

How to make --os-shell command work on UBUNTU 16.04 ( Digital Ocean )?

I have made a vulnerable SQLi website ( to teach students ). I am able to dump the database but I am not able to run os commands or upload os-shell. I want to show them how to use --os-shell option ...
0
votes
0answers
150 views

How trying to fetch limited entries using sqlmap?

I have 1 table (eg: users) with more than 1 million entries. But when using Sqlmap try to --start and --stop it's not Working. For example the query is: sqlmap.py -u http://example.com/index.php?id=...
0
votes
0answers
60 views

Introduce a SQLi in a testing application

So I was building an application to demonstrate SQL injection via cookies and wrote some code to run SQL statements if the statement are passed within a redir cookie header but when using sqlmap to ...
0
votes
0answers
137 views

sqlmap: Upload file to get UUID to submit with main request?

I've been looking for a way to use sqlmap with a file-upload form that, when submitted, first uploads the given file to get back a UUID, which is then send along with the user information in another ...
0
votes
0answers
280 views

How to use binary search for blind SQL injection queries

From what I read online, it's possible to apply binary search to exploit blind SQL injection vulnerabilities, and that is probably what tools like sqlmap use to lower the number of queries that need ...
0
votes
0answers
115 views

Blind SQL injection - Get a time out and don't know why

During a CTF, I had the intuition that there was a blind SQL injection entry point in the URL. I tried to inject: ' UNION SLEEP(5);-- I was expecting to receive a response after 5s, but actually, I ...
0
votes
0answers
161 views

Detecting SQL injection HIPS and WAF

WAF and HIPS detect SQL injection based on rules. For example 1" OR 1=1 -- Both devices will block it. How about `1" OR 300+1-300+0=50+57-6 -- ? In my scenario HIPS doesn't seem to be able detect ...
0
votes
0answers
190 views

How does the Evil Twin SQL injection query works?

I have been reading about SQL injection and got hit at Evil Twin SQL injection here. There are two queries mentioned in the article as follows. -1' union select 1,2,3,(select (@) from (select(@:=0x00)...