New answers tagged

1

Based on the query string, that is sqlmap, not scanning for a vulnerability, but extracting data, suggesting that there either is a vulnerability or it's a false positive. However it is using error based extraction, which is not very prone to false positives. I suggest you investigate this further. Although you may be using parameterized queries (which is ...


2

Best practice, server and client-side: always, always sanitise your inputs, outputs, and use prepared statements. You could look at using a WAF (web application firewall) which will detect attempted SQL attacks etc and offer a layer of protection and also customise responses if they are detected. Other than stopping an attacker via something like IP ...


-1

No, Your application will not be 100% secured if you use some pattern matching or regex to identify SQL Injection attack. You will face miss detection of SQLI if you use such kind of approach. The best way to achieve 100% protection is using Runtime Application Self-protection (RASP) in your application. In case of Web application Firewall(WAF), you will get ...


0

You can't invoke a command from a regex, so you can't do an SQL injection in this case. However, you could enter a very long processing regex that would certainly cause issues with the web site. For example forward lookahead with multiple wildcards (see Mastering Lookahead and Lookbehind). here is an example (in Java regex). (([$_a-zA-Z][$_a-zA-Z0-9](?:.[$...


2

The problem with SQL injection is not how the data are stored in the database but that statements in the query language are code and data combined into a string these statements are often constructed by manually combining strings of code with strings of untrusted data improper validation of the untrusted data leads to interpretation of these data as code, ...


0

With the SQL Shell in SQLMap You do almost all the things that you could do in a local SQL Database. Like Querying the database for data, modifying data, until the user you got access as has the necessary permissions to it.


Top 50 recent answers are included