57 votes
Accepted

No -*|%/ and no whitespace, is this SQL injectable?

Does this mean my SQL query is safe? Is there any way someone can break my query and view all the records? No, it is not safe. More than being able to view all the records of one table, you can pass ...
user avatar
  • 646
15 votes

No -*|%/ and no whitespace, is this SQL injectable?

A query itself is not either injectable or not; there's a programming language involved around it, and you should really share how the user input is sanitized before putting it into the query. ...
user avatar
  • 15.9k
5 votes
Accepted

What is this attacker trying to do by making edits to Stack Exchange posts?

It looks like someone is fuzzing StackExchange - passing potentially malicious data as input in an attempt to uncover any vulnerabilities in the handling of this input data. In these particular ...
user avatar
  • 10.8k
5 votes
Accepted

Why does this SQL injection have an equals symbol?

In SQL operator "AND" has higher precedence than "OR". Let add parentheses, to make the logic more clear: SELECT * FROM Users WHERE (Name ="") or (""="&...
user avatar
  • 8,410
3 votes

Does "row-level security" actually serve a security purpose?

It works by introducing additional WHERE clauses in SQL statements attributing the query to a particular user / tenant / domain. ... the application is of course free to misattribute the user. This ...
user avatar
2 votes
Accepted

SQL Injection detected

A direct injection is unlikely, since the error is caused by what ought to have been a bigint being cast to a bigint, and raising an exception. So, it's pretty clear that only bigints are going to ...
user avatar
  • 22.5k
2 votes

What are the security vulnerability of letting users insert anything to a nvarchar sql column?

It is not an issue what kind of data are stored in the column, but what expectations the code using the data has, i.e. what is done with the data. If all the code treats the data as being arbitrary ...
user avatar
2 votes

No -*|%/ and no whitespace, is this SQL injectable?

Like other answers and comments, I agree that you should parameterized queries and prepared statements. A modification to your question (I'll get to why later) is: No -*|%/ and no spaces, is this SQL ...
user avatar
  • 21
2 votes

What account do you enter when using ' or '1'='1?

Well-crafted sites do not use usernames as primary keys (see this SO question), however they do use keys to search. Perhaps read up on how basic SQL injection works, and you'll find that 'OR '1'='1 ...
user avatar
  • 1,187
2 votes

Why are MySQL injections more limited than MS-SQL attacks?

why it appears MySQL is ... Appears to whom? Appears to you? Only you know that. In security there is no "appears". Either particular attack is possible or not. Nothing in this whole video ...
user avatar
  • 8,410
2 votes
Accepted

Trying to understand this SQL injection from VulnHub

why they included the '1'='2 part which evaluates to false $sql .= $_GET["name"]."'"; In the code snippet above, notice that a ' is appended to the end of the $_GET["Name&...
user avatar
  • 430
2 votes

Is this SQLi or XSS? (or both/neither)

Assuming it works, this is both, in two separate places. It's SQL injection, quite straightforwardly. The attacker is breaking out of a SQL string, terminating the current query, and injecting their ...
user avatar
  • 39.1k
1 vote

Altering requests after authenticating

Some common ideas are following: Don't send user ID to the client. Instead, generate some token (session ID), e.g. UUID like aecf4b7b-5589-4fb0-bce3-b17194d5d432. In the database save this token and ...
user avatar
  • 8,410
1 vote
Accepted

Altering requests after authenticating

Yes, good web app design never trusts the input from the client; always assume that it could be malicious. After authentication and that means that he has access to the API,is it possible to alter ...
user avatar
1 vote
Accepted

What account do you enter when using ' or '1'='1?

When its vulnerable to this exploit, then in most cases you are logged in as the first user that stands in the database.
user avatar
1 vote

What account do you enter when using ' or '1'='1?

TL;DR SQL injection is really more about allowing arbitrary user data to be interpolated into strings, where it can then affect the SQL query that's executed. It's not really about primary keys or the ...
user avatar
1 vote

What is the wisdom of using the ASCII function in exploit SQLi?

To be clear, I don't know. This is a guess. One possible answer: it might fool a Web Application Firewall. WAFs are fragile, stupid things, and usually are looking for regular expressions or even ...
user avatar
  • 39.1k
1 vote
Accepted

How secure and anonymous is the --tor parameter in Sqlmap?

It appears to use Tor correctly, from what I can see in the source code. You have to be running a Tor daemon and correctly configure it. If you don't use SOCKS5 (or SOCKS4a), you're opening yourself ...
user avatar
  • 63.8k
1 vote

Bypassing "OR" SQLi filter

Partial answer: if the MySQL version is recent enough (>5.5) and the user has enough privileges, it is possible to use the mysql.innodb_table_stats or mysql.innodb_table_stats tables (source) to ...
user avatar
1 vote

Cloudflare SQLinjection protection

Every time someone publishes common bypasses those bypasses will be blocked, you would need to find your own bypasses to make it viable long term, which usually means writing your own code to mangle ...
user avatar
  • 5,700
1 vote

Is SQL Injection possible in ORDER BY before LIMIT?

Prepared statements only deal with true data and not with static names like column of table names, because it is assumed that those static names can easily be controled. Furthermore, they are most ...
user avatar
1 vote

Is SQL Injection possible in ORDER BY before LIMIT?

The LIMIT clause is still exploitable even when using ORDER BY. You can find a detailed exploit based on the demonstration done by Maurycy Prodeus in this article.
user avatar
  • 309
1 vote

How to configure SQLMap to attack JSON parameter?

There is a little mismatch between the heading and the description of the question. From what I can get, there are two questions which I'll try to answer. How to configure SQLMap to attack JSON ...
user avatar
1 vote

What are the consequences of increasing the "--risk" option of sqlmap?

--risk is explained correctly in the answer by OscarAkaElvis. However, --level not only adds more injection points such as cookies and other headers but also performs more tests for each injection ...
user avatar
  • 31.8k

Only top scored, non community-wiki answers of a minimum length are eligible