57
votes
Accepted
No -*|%/ and no whitespace, is this SQL injectable?
Does this mean my SQL query is safe? Is there any way someone can break my query and view all the records?
No, it is not safe. More than being able to view all the records of one table, you can pass ...
- 646
15
votes
No -*|%/ and no whitespace, is this SQL injectable?
A query itself is not either injectable or not; there's a programming language involved around it, and you should really share how the user input is sanitized before putting it into the query. ...
- 15.9k
5
votes
Accepted
What is this attacker trying to do by making edits to Stack Exchange posts?
It looks like someone is fuzzing StackExchange - passing potentially malicious data as input in an attempt to uncover any vulnerabilities in the handling of this input data.
In these particular ...
- 10.8k
5
votes
Accepted
Why does this SQL injection have an equals symbol?
In SQL operator "AND" has higher precedence than "OR". Let add parentheses, to make the logic more clear:
SELECT * FROM Users WHERE (Name ="") or (""="&...
- 8,410
3
votes
Does "row-level security" actually serve a security purpose?
It works by introducing additional WHERE clauses in SQL statements attributing the query to a particular user / tenant / domain. ... the application is of course free to misattribute the user.
This ...
- 181k
2
votes
Accepted
SQL Injection detected
A direct injection is unlikely, since the error is caused by what ought to have been a bigint being cast to a bigint, and raising an exception. So, it's pretty clear that only bigints are going to ...
- 22.5k
2
votes
What are the security vulnerability of letting users insert anything to a nvarchar sql column?
It is not an issue what kind of data are stored in the column, but what expectations the code using the data has, i.e. what is done with the data.
If all the code treats the data as being arbitrary ...
- 181k
2
votes
No -*|%/ and no whitespace, is this SQL injectable?
Like other answers and comments, I agree that you should parameterized queries and prepared statements. A modification to your question (I'll get to why later) is:
No -*|%/ and no spaces, is this SQL ...
- 21
2
votes
What account do you enter when using ' or '1'='1?
Well-crafted sites do not use usernames as primary keys (see this SO question), however they do use keys to search. Perhaps read up on how basic SQL injection works, and you'll find that 'OR '1'='1 ...
- 1,187
2
votes
Why are MySQL injections more limited than MS-SQL attacks?
why it appears MySQL is ...
Appears to whom? Appears to you? Only you know that.
In security there is no "appears". Either particular attack is possible or not.
Nothing in this whole video ...
- 8,410
2
votes
Accepted
Trying to understand this SQL injection from VulnHub
why they included the '1'='2 part which evaluates to false
$sql .= $_GET["name"]."'";
In the code snippet above, notice that a ' is appended to the end of the $_GET["Name&...
- 430
2
votes
Is this SQLi or XSS? (or both/neither)
Assuming it works, this is both, in two separate places.
It's SQL injection, quite straightforwardly. The attacker is breaking out of a SQL string, terminating the current query, and injecting their ...
- 39.1k
1
vote
Altering requests after authenticating
Some common ideas are following:
Don't send user ID to the client. Instead, generate some token (session ID), e.g. UUID like aecf4b7b-5589-4fb0-bce3-b17194d5d432. In the database save this token and ...
- 8,410
1
vote
Accepted
Altering requests after authenticating
Yes, good web app design never trusts the input from the client; always assume that it could be malicious.
After authentication and that means that he has access to the API,is it possible to alter ...
- 57.4k
1
vote
Accepted
What account do you enter when using ' or '1'='1?
When its vulnerable to this exploit, then in most cases you are logged in as the first user that stands in the database.
- 122
1
vote
What account do you enter when using ' or '1'='1?
TL;DR
SQL injection is really more about allowing arbitrary user data to be interpolated into strings, where it can then affect the SQL query that's executed. It's not really about primary keys or the ...
- 401
1
vote
What is the wisdom of using the ASCII function in exploit SQLi?
To be clear, I don't know. This is a guess.
One possible answer: it might fool a Web Application Firewall. WAFs are fragile, stupid things, and usually are looking for regular expressions or even ...
- 39.1k
1
vote
Accepted
How secure and anonymous is the --tor parameter in Sqlmap?
It appears to use Tor correctly, from what I can see in the source code. You have to be running a Tor daemon and correctly configure it. If you don't use SOCKS5 (or SOCKS4a), you're opening yourself ...
- 63.8k
1
vote
Bypassing "OR" SQLi filter
Partial answer: if the MySQL version is recent enough (>5.5) and the user has enough privileges, it is possible to use the mysql.innodb_table_stats or mysql.innodb_table_stats tables (source) to ...
- 178
1
vote
Cloudflare SQLinjection protection
Every time someone publishes common bypasses those bypasses will be blocked, you would need to find your own bypasses to make it viable long term, which usually means writing your own code to mangle ...
- 5,700
1
vote
Is SQL Injection possible in ORDER BY before LIMIT?
Prepared statements only deal with true data and not with static names like column of table names, because it is assumed that those static names can easily be controled. Furthermore, they are most ...
- 25.6k
1
vote
Is SQL Injection possible in ORDER BY before LIMIT?
The LIMIT clause is still exploitable even when using ORDER BY.
You can find a detailed exploit based on the demonstration done by Maurycy Prodeus in this article.
- 309
1
vote
How to configure SQLMap to attack JSON parameter?
There is a little mismatch between the heading and the description of the question. From what I can get, there are two questions which I'll try to answer.
How to configure SQLMap to attack JSON ...
- 11
1
vote
What are the consequences of increasing the "--risk" option of sqlmap?
--risk is explained correctly in the answer by OscarAkaElvis.
However, --level not only adds more injection points such as cookies and other headers but also performs more tests for each injection ...
- 31.8k
Only top scored, non community-wiki answers of a minimum length are eligible