Hot answers tagged

7 votes
Accepted

How does MariaDB's ed25519 auth scheme work?

What is stored on the server? When setting password, the password is turned into bytes (don't know which encoding is used), then the password bytes are hashed with SHA-512 once, to produce the "left ...
user avatar
  • 7,648
6 votes
Accepted

Simple SQL injection to bypass login in MariaDB

In MariaDB the comments must be followed by a space: From a '-- ' to the end of a line. The space after the two dashes is required (as in MySQL). Please try ' OR 1=1 --[space].
user avatar
  • 350
4 votes
Accepted

Is it true that blind SQL injection does not work on MariaDB?

I find that hard to believe, and apparently so does MariaDB themselves (h/t @schroeder). MariaDB is a fork of MySQL, and "intends to maintain high compatibility with MySQL, ensuring a drop-in ...
user avatar
  • 64.2k
3 votes
Accepted

Are MariaDB's encryption and compression functions secure?

While MySQL currently provides other encryption modes, MariaDB appears to still only support the insecure ECB mode. In MySQL, you can set the mode to the slightly better CBC mode with: SET @@session....
user avatar
  • 63.8k
3 votes

Simple SQL injection to bypass login in MariaDB

First thing to note here is that you can only inject in the username, and not in the password. Any payload you put into the passwrod will be destroyed in the hashing. So what happends if set the ...
user avatar
  • 64.2k
3 votes
Accepted

Is it secure to store my mysql password in a const std::string?

Hardcoding of secrets is never a good idea. Use a configuration file, to read from. This way you will be able to swiftly change the password if required and prevent the password from leaking through ...
user avatar
2 votes

SQL Injection on MariaDB

You are missing a space after your comment marker. From a '-- ' to the end of a line. The space after the two dashes is required (as in MySQL). Comment syntax
user avatar
  • 28.6k
1 vote

Nmap returns both, mysql and mariadb versions, how do I khow which one is actually running?

MariaDB is a fork of MySQL. The port used and protocol spoken are MySQL. The version string indicates MariaDB.
user avatar
1 vote

How to connect to a MariaDB database after collecting data about users and passwords with a SQLI?

Most likely, you can only connect from localhost/127.0.0.1
user avatar
  • 6,517
1 vote

How to know whether mysql connection is using SSL or TLS connection?

If you have sufficient privileges to run the following query on the server, it will tell you how it considers the connection is established: select t.THREAD_ID, t.PROCESSLIST_USER, t....
user avatar
  • 111
1 vote

SQL-injection, unable to get it to work!

When exploiting SQLi, I personally start with as simple query as possible and go one step further with every request. So I would start with SELECT 1 SELECT 4-2 SELECT 'a' SELECT concat('a','b') And ...
user avatar
1 vote

SQl Injection MariaDB

If I am reading the syntax correctly, I believe you need to remove your quotations and left parenthesis as it's prematurely ending the query function: car_info = query("select models, color, running ...
user avatar
1 vote

SQL inject MariaDB with SQLMAP

SQLMap is a great tool if used in correct manner. we need to specify the correct injection point in the complete query of SQLMap like for example in case of get method used in html form sqlmap.py -u "...
user avatar
1 vote

Linking mail server with application database

There's also a 3rd option to consider: an authentication framework. Instead of having separate user credentials for the database and mail server that need to be kept in sync, have a central ...
user avatar
  • 654
1 vote

Simple SQL injection to bypass login in MariaDB

Seems your username is vulnerable password is safe. Try 'or 1=1--, so it comments the query after the username.
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible