Questions tagged [sql-injection]

SQL injection is a technique used to take advantage of vulnerabilities arising from non-validated input on web applications to pass SQL commands through for execution on a backend database.

Filter by
Sorted by
Tagged with
27
votes
1answer
8k views

Why should we sometimes use --+ instead of — in SQL injection to comment the rest of the query?

I have encountered some websites that when I used -- to comment the rest of the query it didn't work, but when I tried --+ it worked. In the MySQL official documentation there is no such thing as --+ ...
0
votes
2answers
673 views

Blind SQL Injection on Amazon RDS

I found a vulnerability which allows me to run any query on an Amazon RDS server. I was able to extract the user hashes by using the --passwords parameter of sqlmap, and one of the hashes was cracked ...
0
votes
3answers
2k views

Is SQL-injection a client-side or a server-side attack?

What type of attack is SQL-injection? I am confused because this type of attack is done through the client-side. However, the attackers target is a database which is "behind" a server. Most attacks ...
1
vote
2answers
594 views

Is SQL Injection possible in String Concatenation When all Variables are created by the Program

Say I have a program that returns some date strings from a function in javascript. function getDates() { var yesterday = [some code that gets current time with yesterday's date]; var today = [...
1
vote
1answer
2k views

Running sqlmap against a parameter inside a parameter

I have a domain in the format: example.com?host=http://anotherexample.com?bar=1 I want to attack the "bar" param, but sqlmap (correctly) parses the second url as a value of the foo param. Therefore I ...
-2
votes
2answers
554 views

What file types might be vulnerable to SQL injection? [closed]

I am learning about SQL injection and Google dorks. I have seen that there are three file types that can be vulnerable to SQL injection, .php, .aspx and one more. I can't find the third one... The ...
0
votes
2answers
173 views

Php parameters (username, password) in link

Little Info: I am not a web developer, I am a beginner to php and sql. Trying to learn in my free time. I was examining a web site on a remote server and i saw something like; www.myurl.com/login....
1
vote
3answers
3k views

Is SQL injection still a thing? [duplicate]

I was wondering whether SQL injection is still a thing or if it is mainly extinct due to the fact that I don't hear about corporations being hit by this vulnerability, And the last time I heard an ...
0
votes
1answer
1k views

bWAPP- SQL injection Hack displays a white screen?

I've been following this video(https://www.youtube.com/watch?v=XDCZ8FC856s) to install bWAPP on Parrot OS and everything works fine except SQL Injection. I've checked the database and its active. As ...
1
vote
1answer
268 views

Is this parameter vulnerable to SQL Injection?

The backend server is running Tomcat 8.5 (Java backend). The URL in question is: https://website.com/application/servlet.do?currentOID=abc12300000000 I found that when I give an incomplete OID (i.e ...
1
vote
1answer
469 views

How this Unique SQL injection works?

I found a challenge which was vulnerable to SQL injection and it was very very pretty hard to find So, How this unique SQL works? I found this on login form where when I send user=\&pass=||1# as ...
1
vote
1answer
4k views

How to use custom injection in sqlmap?

This is post data, normally looks like this {"end_date":"2018-8-26","start_date":"2018-8-26","success":1} Below resulting "You have an error ..." {"end_date":"2018-8-26'","start_date":"2018-8-26","...
1
vote
1answer
214 views

The role of Machine Learning In Cybersecurity Defense [closed]

Hackers and malware are one step ahead of cybersecurity experts, and every time technology is released to the market, vulnerabilities will be quickly discovered and exploited. How effective can ...
0
votes
1answer
161 views

I'm not sure if this Website is SQL Injectable

I think I found an SQL vulnerability; the request and response can be found below. I'm not sure because it is showing a normal error (it's in French) instead of showing an SQL error. I also tried to ...
0
votes
1answer
237 views

Is it SQL Injection Vuln? [closed]

Today my friend asking help to test and prevent his website from sql injection.. After i tried basic sql injection like 1 OR 1=1, ' OR 1--',' '1'='1 There is no mysql error displayed.. But After i ...
1
vote
1answer
255 views

Single quotes ' not sanitized

I'm trying to find security issues on my friend's site. There is an input box for subscription. I can enter my email address: Henry<IMG SRC=# onmouseover="alert('xxs')">@gmail.com After ...
3
votes
2answers
1k views

False positive SQL Injection by ZAP with adding new parameter query

I have a spring MVC web application and am running ZAP Active scan on it. I noticed that ZAP will modify URL , and add additional parameter named query and value query+AND+1%3D1+--+ to test SQL ...
0
votes
3answers
10k views

SQL Injection on POST JSON request

I have a web application vulnerable to SQL injections. I'm using BurpSuite to intercept the requests. More specifically, the data variable below is vulnerable. I added my own data to aggregates and ...
0
votes
1answer
69 views

Possibility of SQL injection by static or predefined values

Using direct variables is vulnerable to sql injection. So to prevent attacks we use parameters. $result->bindParam(":id",$_POST['id'],PDO::PARAM_INT) but I am confused regarding the following ...
0
votes
2answers
446 views

Using single or double quotes to prevent XSS and SQLi?

Why it is recommended to put single or double quotes around HTML attribute values? It is recommended to prevent XSS, but why? Same goes for SQL injection: It is recommended to use single or double ...
0
votes
1answer
1k views

From SQL Injection in SQLite to shell

I need to obtain a shell from an SQL injection over an application with sqlite database. Currently my exploit looks like the following: lucian@0x90:~/$ proxychains nc 10.185.10.55 1101 ProxyChains-3....
0
votes
2answers
737 views

Can an ampersand (&) be used in SQL injection?

With SQL Server, does the ampersand pose as a threat related to SQL injection? I'm working on a project that includes this as a blacklisted character. I'm aware that there's a threat related to Oracle ...
1
vote
0answers
498 views

SQLmap error (what happen if i have no parameters)

I have an error when I use sqlmap. The problem is: I use this dork https://www.exploit-db.com/ghdb/4301/ but I do not know how to use sqlmap with this type of sql injection. I use the classic: ...
0
votes
4answers
323 views

Is it possible to verify if a website is vulnerable to SQLi by viewing its source code?

I've heard the eval() function is vulnerable to SQLi. Can I check for vulnerabilities by simply viewing the website source code?
1
vote
0answers
90 views

SQL Injection in a simple form [closed]

There is a form that I'm trying to crack it. It has two fields: username & password. When I enter 1'; WAITFOR DELAY '00:00:15' -- in username, it tries to load for about 40 seconds, then it shows ...
1
vote
3answers
1k views

DVWA: “Hacking attempt detected…”

Hello and good evening, i've recently tried to improve my pentesting skills and learn more about it with metasploitable 2. I am trying some things on the DVWA. For the moment, i am learning the ...
0
votes
2answers
1k views

SQL Injection : How to begin when the id parameter value is not numeric

I am learning SQL injection currently and I feel I am quite comfortable doing Basic SQL injection. I am learning it by solving online challenges and so far I have only come across situations where the ...
-1
votes
1answer
242 views

Attempting SQLi against website with WAF filter [closed]

I was pentesting a website when I discovered that the URL included the id parameter. Because of this, I knew that the id parameter might be vulnerable to SQLi. I received a 200 response and found no ...
0
votes
1answer
830 views

can a token be used for sql injection

I have a token that is restricted to read only access. If someone obtains that token, can they use it to do a sql injection attack? Given that the token is permissioned for read only, can someone ...
1
vote
1answer
79 views

Is the hosting OS safe to sql injection hackers by hiding admin ID?

We are 1-3 guys maintaining a fairly large but clumsy developed-in-house website. With around 900+ mysql tables, and a lot of data access code in PHP. Let's say it is huge amount of code for just 1 or ...
12
votes
5answers
9k views

What pages are vulnerable to SQL injection?

I believe I understand the basics of SQL injection. I also know using prepared statements with PHP files is the best way to prevent SQL injection. I was always told that SQL injection happens most ...
1
vote
1answer
1k views

Can website get hacked by iframe injection?

My website has been hacked. I am observing how hacker accesses my site. Though I have been using bindparam to prevent from sql injection and direct access restriction for backdoor attack, hacker's ...
3
votes
2answers
174 views

Is it plausible to enforce authorisation on SQL generated from “Client-side”?

Background We know that SQL Injection (OWASP Top 10) is the most prevalent security vulnerability on websites today. The strategies for mitigating the risk are well known. But are these only ...
2
votes
1answer
526 views

Impact of SQL injection on SELECT statement

During a routine penetration test I encountered a possibility for SQL injection. The following criteria apply: Microsoft SQL Server (2016); Query has to start with SELECT; The semicolon ; is not ...
1
vote
1answer
139 views

Using a transaction as mitigation against SQL injection

Considering a generic stored procedure that is subject to SQL injection: CREATE PROC usp_badproc @sql NVARCHAR(8000) AS BEGIN EXEC(@sql) END and operating under the assumptions that the ...
1
vote
0answers
2k views

is it possible to insert data using sql injection in select statement?

First of all i am testing it on my server for learning purpose. The condition here is i want to insert a entry in test table in database and SELECT * FROM `student` WHERE `name` LIKE '% ".$name." %';...
0
votes
1answer
546 views

Applying regexp for user input validation using JavaScript

As a full-stack developer I am buliding an webapp for tennis club in codeignitor framework. During making html forms on client side and writing scripts for validation of user input. i thought would ...
0
votes
1answer
151 views

About SQL Injection Mysql

I'm trying to test SQL injection on a site (PHP, uses MySQL Database). When I put an apostrophe in the username field and leave the password box blank, after submitting, the form reloads and the ...
-2
votes
1answer
333 views

Can just adding an apostrophe to input lead to SQLi that makes changes in the database?

If I try to find a SQL injection vulnerability in an admin login form by putting an apostrophe after the username (username') and write a password, will this vulnerability checking effect or modify ...
0
votes
3answers
159 views

SQL injection with filtered column names

I have the following MySQL query susceptible to an injection and I need to extract the password of a given user: SELECT * FROM users WHERE login='$login' and password='$password' However from the ...
34
votes
11answers
10k views

How to limit the impact of and reduce the risk of SQL injection for existing website?

Our website is 100% API based (with an SPA client). Recently, a hacker managed to get our admin's password (hashed with SHA-256) through SQL injection (and cracking pwd) like this: https://example....
9
votes
3answers
618 views

How could our passwords be cracked so easily?

We are saving password in a database using PHP: return hash('sha256', PASSWORD_SALT . $password); Recently a (fortunately) good hacker SQL-injected us and cracked some passwords including the admin ...
4
votes
1answer
466 views

Possible SQL injection vulnerability?

I'm a developer and I'm creating a script to interface with game servers to update player stats. I was sending a POST request with multipart form data and on the last boundary accidentally had the ...
0
votes
1answer
61 views

SQL Query Sanatization

It seems to me SQL injection could be avoided by just converting everything to a simple encoding like base64 that doesn't have any harmful symbols. In the classic query "SELECT * FROM users WHERE ...
0
votes
2answers
2k views

SQL Injection with an uninjectable URL

I was recently given a subdomain to try and exploit with SQLi: gov.ns.agency. Unlike what I would see in most tutorials, I can't really inject parameters into the URL like I would see everywhere else. ...
80
votes
19answers
16k views

Good analogy needed: Sec issues due to different coders implementing the same features in different ways for the same app

I have to give a school presentation about vulnerabilities found in the Moodle platform. Of course, they only apply to a legacy version which has since been patched. The catch is that the ...
5
votes
1answer
338 views

Blind SQL Injection and HTTP Version Dependency?

I Recently came across a Virtual Machine that has Blind SQL Injection in the X-Forwarded-For header. I used sleep() to detect the vulnerability. The Payload worked in HTTP/1.0 and not in HTTP/1.1 . ...
3
votes
0answers
170 views

Is possible attack vector? [closed]

So I was bored and decided to get into some bug bounty hunting. I went on a website that has a bug bounty program and this website is for downloading apps. I went to the enter a gift card code field ...
1
vote
2answers
2k views

Is it possible to include a PHP Function while performing SQL Injection?

Consider this code: ?id=' UNION SELECT 1,2;"; phpinfo();//-- -&Submit=Submit Will this work out? SQL Query: if(isset( $_GET[ 'submit' ] ) ) { // Get input $id = $_GET[ 'id' ]; // Check ...
0
votes
2answers
750 views

How to extract data using SQL injection on a vulnerable ASP.NET application?

I managed to find a vulnerability in a so-called friend of mines website and I want to show him that his website is vulnerable to data extraction. When I use something like yes')-- as post I get the ...

1 2 3
4
5
17