Questions tagged [sql-injection]

SQL injection is a technique used to take advantage of vulnerabilities arising from non-validated input on web applications to pass SQL commands through for execution on a backend database.

Filter by
Sorted by
Tagged with
2
votes
3answers
172 views

How are biometrics tougher to crack than a pin?

When I hear that bio-metrics are tougher to crack, it's left ambiguous as to whether they refer to the term 'hack' as simply getting through the system by guessing the password or mimicking the person....
27
votes
12answers
8k views

Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql real escape string() function

Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql_real_escape_string() function?
-4
votes
3answers
95 views

Why is using prepared statements in PHP considered best practice?

Let me first start by stating that I am by no means a webdeveloper, so please do point out if I'm going in the wrong somewhere in my story. I think most people agree with the idea that using prepared ...
0
votes
1answer
366 views

SQLMAP Redirect using xampp

I am learning SQLi using sqlmap and xampp. I set up my lab the same way as per tutorial but when I run sqlmap.py -u "http://localhost/bwapp/sqli_1.php?title=1*" the error got 302 redirected to ...
0
votes
0answers
176 views

Out-of-band Sql Injection

When I was doing some security research, I found an unexpected query in a POST request like this: q=select%20*%20from%20x%20where%20a%20%3D%20'%7B%22something%22%3A%22blah%22%2C...%7D' Where the ...
1
vote
1answer
456 views

SQL injection with no output

So I found this section of a webpage, which is a basic "feedback box". It had all the characteristics of an SQL injectable element. Scanned it with OWASP, it was true. Tried SQLmap, it gave me ...
3
votes
3answers
257 views

Is SQL injection still a bad thing if the user is restricted to non-harmful queries?

Suppose I have a very simple PHP application that acts as a front-end for an SQL database. The user enters their query into a box, and the app shows the query results in a table. To prevent a user ...
3
votes
1answer
170 views

Sql map Manual Vulnerability Assessment

I am trying to do penetration testing for one of my client. The platform is Code ignitor. There is an endpoint /find/1 The function queries the vehicle table where vehicle ID is 1 with no sanity check....
50
votes
1answer
10k views

In SQL injections why do they put "-- -" at the end of the URL?

I understand when they put a + at the end, URL treats it like a space. I want to know what -- - does. I do know what the "double dash" does. Including the double dash with a "space at the end". I ...
1
vote
1answer
2k views

There seems to have been an attempt to attack my website [duplicate]

I am using PHP as a server side language. And I don't use CMS or Framework. From the nginx log the website attack seems obvious. I wonder what kind of attack the attacker attempted. The attacker ...
4
votes
1answer
154 views

Making SQL/HTML Injection attacks programmatically impossible

Apparently having 100% prevention of SQL Injection and XSS attacks is easier said than done, but why? Can't static code analysis tools ensure that all user supplied input vectors (including user ...
1
vote
0answers
846 views

XSS / SQL Injection Attacks with Character Encoding Mixups

Are there any character encoding mixup attacks that are still a threat in 2020? Such as with XSS or SQL injection being the most obvious. Some examples: Tricking a browser to display a page in UTF-...
4
votes
0answers
223 views

Whats the meaning of ] symbol in a SQL query?

I have come across a CTF challenge that has a part with an SQL injection (MySQL DB). I have completed it, but I do not know why or how the injection works. The query in the PHP application would ...
2
votes
3answers
231 views

Are injection vulnerabilities a design or an implementation flaw?

Are injection vulnerabilities mainly a design or an implementation problem? I'm using SQL injection as an example; I'm interested in other injection vulnerabilities as well. I believe that it is the ...
0
votes
1answer
230 views

Is my Java code still vulnerable to SQL injection? [duplicate]

We have a Java web application that was vulnerable to blind SQL injection attacks. Our developers fixed the code by using the replaceAll() function to convert single quotes to two single quotes. I am ...
1
vote
0answers
482 views

SQLMAP with single URL application

I have a local application which will be accessible only after login. Its single URL application, URL of application won't change, just it use 'XMLHttpRequest' to refresh the content of screen based ...
1
vote
1answer
341 views

It this a safe way to filter input into an SQL query

Is this a safe way to filter strings into an SQL query in java or could this be bypassed? I understand that I should just parameterize everything but this is an ancient code base where it makes more ...
0
votes
0answers
203 views

Response seems to get redirected if SQL injection query succeeds, if not then it doesn't get redirected

Under the authorization of my friend, I am testing his website against potential vulnerabilities. I was trying to find if I was able to inject a SQL query into a POST request parameter hi' or 1=1 --: ...
0
votes
0answers
901 views

Is this SQLMap query is correct?

I am practicing on some vulnerable application, and I am asked to find an injection vulnerability with a payload. it states there is a common and simple filter in place. Then I need to extract the ...
2
votes
2answers
2k views

SQL injection using URL query string (web application/php server)

Hacker is trying to attack the site by using the following SQL injection query to get the SQL version. Using URL site. example: www.abc.com/?queryParamString=(SELECT 9701 FROM(SELECT COUNT(*),...
3
votes
1answer
799 views

Is SQL Injection possible in this case (REGEXP)?

I'm on a website which have a program, there is a search input for keywords. When I input & or < or > and search, it returns Got error 'empty (sub)expression' from regexp error and when I ...
0
votes
1answer
77 views

Is a differentially private SQL database relatively more secure from an SQL injection?

I've been in security for a while now but I'm relatively new to privacy. I've been studying differential privacy and its application to databases. However I'm still a little confused about where ...
1
vote
1answer
1k views

Which symbols can I whitelist to remain safe against SQL injection, XSS, and all other injections attacks?

I have an input field in a web that is being saved. This field can be shown in other systems that I do not have control over and that's why I would like to limit what is allowed in this field, ...
0
votes
1answer
158 views

How can this sql query be injected?

I've a php code where I get the page number from a GET request and then run a sql query to select records from the database by the page number $maxPerPage = 20; $page = $_GET["p"]; $applicants = DB:...
1
vote
0answers
180 views

SQL Injection only with OR

I am doing a practise SQL injection in a search field and I don't understand the logic of what is happening. The following behaviours is what I noticed: Entering ' OR '1' = '1 shows all the results. ...
2
votes
0answers
187 views

How can an attacker use SQL injection in ALTER query?/What can an attacker do with an injectable ALTER statement? [closed]

Let's say you have a Java app which has a query which can unlock/reset passwords for users like: ALTER USER " + iD_Of_User.toUpperCase() + " IDENTIFIED BY " + password_Of_User + " ACCOUNT UNLOCK ...
2
votes
3answers
132 views

How can a restricted window for sql injections be abused?

I have a postgres 11 database with no confidential information in it and in the application an intruder can write queries inside the following update statement. UPDATE table SET col_a = val_b WHERE {...
2
votes
2answers
188 views

Allowing users to input raw SQL in update statement safely

I'm building an application and I have some very, very advanced users who can come up with endless filters they want. They know SQL so in the end gave them some of the filters and said in the bottom ...
2
votes
1answer
455 views

How exactly works this SQL injection example related to the DVWA application?

I am a software developer converting do application security and I have some doubts about SQL injection example. I am following a tutorial related the famous DVWA: http://www.dvwa.co.uk/ So I have ...
8
votes
1answer
724 views

Some doubts about SQL Injection examples, how exactly works?

I am a software developer starting studying application security and I have the following doubt related SQL injection. I am following a video course and there are these two examples: I have an ...
1
vote
1answer
1k views

Replaced single quote bypass for SQLi

I have this scenario on my lab. HTTP POST login form on a IIS server. ASP backend using MSSQL database, and a single simple query as this: sql="SELECT * FROM USERS_TABLE WHERE USER='" & user &...
2
votes
1answer
3k views

Server returns 403 when I try SQL injection

I am trying to pentest my friend's site. It is clearly vulnerable to SQL injection attack based on the error messages I get from entering different get parameters. Whenever I try very simple attacks ...
0
votes
2answers
9k views

How do you perform SQL injection on a login form that checks for email address format?

A recent employment test prompted me to perform an SQL injection to gain access into their website. Using manual and automated (Burp) methods, I was able to find out the form is definitely vulnerable ...
2
votes
1answer
183 views

bypassing metacharacter filtering

So I am trying to bypass metacharacter filtering. I want to know how do you start an injection. For example if the ' is filtered how do you begin the input. If i did ' or 1=1# without filtering it ...
1
vote
0answers
475 views

Bypass prepared statements?

I know that prepared statements are used to handle input at the front end. However I was wondering how do you bypass a prepared statement? I have seen some people talk about string concentration but I’...
1
vote
1answer
177 views

Use a WHERE clause that's stored in a table?

Background: I have a workorder management system (WMS). The WMS has functionality that allows users to save queries. The queries are saved in a database table called QUERY (in a CLAUSE column). An ...
4
votes
2answers
4k views

How does this SQLi statement work?

Hey i'm trying the hacker101 CTF's im still pretty new at this stuff The CTF answer to the flag i'm trying to understand is https://github.com/testerting/hacker101-ctf/tree/master/micro-cms_v2/flag0 ...
0
votes
1answer
118 views

is sending SQL query operators in HTTP GET requests is some kind of security issue? [duplicate]

Our webserver is forwarding HTTP GET request to application server as below including a statement or condition like "AND 1=1", our Palo Alto Firewall detecting this traffic as SQL Injection alert. ...
0
votes
1answer
167 views

Sql Injection ByPass problem [closed]

I don't know what if part of this command does. FROM table WHERE id = 1 AND IF(( Ascii(Lower(Substring((SELECT User()), $i, 1))) ) != $s, 1, Benchmark(200000, Md5(Now()))) ...
6
votes
1answer
220 views

The login page I'm testing lets me in as long as the username starts with the right name. How could the SQL query be made?

Let's say my username is theusername and my password is thepassword. If use those credentials I login as expected. However if I add whatever at the END of the username, say theusername.random.stuff.at....
0
votes
1answer
93 views

what can you do in sql login details and encryption key is available

I am practicing pen testing in a protected box and I have a vulnerable Magento website and I managed to get its MySQL config file which is app/etc/local.xml. In this file there is information such as:...
2
votes
2answers
546 views

SQL injection with UNION and two queries with same input

Say there are two queries, which are called after each other: one to get the amount datasets in the table, one to get the result of the actual query: select count(*) as total from table_a where ...
2
votes
0answers
616 views

how to get shell from blind sql injection? [closed]

I'm trying to gain access to a web server after I found blind SQLi on the website. I used sqlmap to automate things. I can read the databases and tables. tried to find a way to get a shell from SQL ...
1
vote
1answer
229 views

Can Blind SQL/Boolean Based SQL Injections not contain break characters or comparisons?

I'm using a scanner which passes subtraction attack traffic such as (1-1), (3-2), (5-2), etc. There are no break or continuation characters such as semicolons or &&, nor is there a comparison ...
-1
votes
3answers
456 views

Is a web application firewall enough to defend against sql injection? or should I use prepared statements?

Is it enough to rely on a web application firewall for protection against SQL injection? or should I use other techniques? During a conversation with a friend he said it is enough to use web ...
4
votes
3answers
275 views

What is the risk of an attacker inserting new password hashes?

The normal threat model that I see with password hashing is as a kind of defense against if the hash somehow leaks to the wider world. In practice, this appears to usually be via some manner of ...
1
vote
1answer
1k views

Is sql injection possible on this websocket?

I was testing a websocket when i found an add to cart request like the following ["{\"ITEMS\":{\"ITEM\":[{\"package_id\":\"123\",\"customer_type\":\"3\",\"qty\":1,\"}"] I tried to edit the value of ...
0
votes
1answer
369 views

How does this NoSQL injection work? [closed]

Could someone explain what this is doing and how it works? I already know about SQL injection but the NoSQL is confusing. This is a lecture slide from my professor but he provides very little context....
0
votes
1answer
75 views

Character filtration in globalisation supported application

I am working on building an application which will be used in various language , to secure from attacks like xss, SQL injection I thought implementing character filteration (whitelisting/blacking) but ...
0
votes
0answers
2k views

SQL Injection bypass UNION filter/restriciton

I've recently had an interesting interview exercise I haven't completed and it does puzzle me what kind of filter/protection they've used. The vuln app is a PHP with simple MariaDB (5.5.56) back-end, ...

1 2
3
4 5
18