7
votes
Accepted
How does MariaDB's ed25519 auth scheme work?
What is stored on the server?
When setting password, the password is turned into bytes (don't know which encoding is used), then the password bytes are hashed with SHA-512 once, to produce the "left ...
- 7,698
6
votes
Accepted
Simple SQL injection to bypass login in MariaDB
In MariaDB the comments must be followed by a space:
From a '-- ' to the end of a line. The space after the two dashes is required (as in MySQL).
Please try ' OR 1=1 --[space].
- 350
4
votes
Accepted
Is it true that blind SQL injection does not work on MariaDB?
I find that hard to believe, and apparently so does MariaDB themselves (h/t @schroeder).
MariaDB is a fork of MySQL, and "intends to maintain high compatibility with MySQL, ensuring a drop-in ...
- 64.2k
3
votes
Accepted
Are MariaDB's encryption and compression functions secure?
While MySQL currently provides other encryption modes, MariaDB appears to still only support the insecure ECB mode. In MySQL, you can set the mode to the slightly better CBC mode with:
SET @@session....
- 64.2k
3
votes
Simple SQL injection to bypass login in MariaDB
First thing to note here is that you can only inject in the username, and not in the password. Any payload you put into the passwrod will be destroyed in the hashing.
So what happends if set the ...
- 64.2k
3
votes
Accepted
Is it secure to store my mysql password in a const std::string?
Hardcoding of secrets is never a good idea.
Use a configuration file, to read from. This way you will be able to swiftly change the password if required and prevent the password from leaking through ...
2
votes
SQL Injection on MariaDB
You are missing a space after your comment marker.
From a '-- ' to the end of a line. The space after the two dashes is required (as in MySQL).
Comment syntax
- 28.6k
1
vote
Nmap returns both, mysql and mariadb versions, how do I khow which one is actually running?
MariaDB is a fork of MySQL. The port used and protocol spoken are MySQL. The version string indicates MariaDB.
- 183k
1
vote
How to connect to a MariaDB database after collecting data about users and passwords with a SQLI?
Most likely, you can only connect from localhost/127.0.0.1
- 6,517
1
vote
How to know whether mysql connection is using SSL or TLS connection?
If you have sufficient privileges to run the following query on the server, it will tell you how it considers the connection is established:
select t.THREAD_ID,
t.PROCESSLIST_USER,
t....
- 111
1
vote
SQL-injection, unable to get it to work!
When exploiting SQLi, I personally start with as simple query as possible and go one step further with every request.
So I would start with
SELECT 1
SELECT 4-2
SELECT 'a'
SELECT concat('a','b')
And ...
- 11
1
vote
SQl Injection MariaDB
If I am reading the syntax correctly, I believe you need to remove your quotations and left parenthesis as it's prematurely ending the query function:
car_info = query("select models, color, running ...
1
vote
SQL inject MariaDB with SQLMAP
SQLMap is a great tool if used in correct manner. we need to specify the correct injection point in the complete query of SQLMap
like for example in case of get method used in html form
sqlmap.py -u "...
1
vote
Linking mail server with application database
There's also a 3rd option to consider: an authentication framework.
Instead of having separate user credentials for the database and mail server that need to be kept in sync, have a central ...
- 654
1
vote
Simple SQL injection to bypass login in MariaDB
Seems your username is vulnerable password is safe.
Try 'or 1=1--, so it comments the query after the username.
- 111
Only top scored, non community-wiki answers of a minimum length are eligible