New answers tagged

6

I assume that it is a MySQL database. 1749 (is greater that 0) and nQtm (valid alias - "variable name" for derived table) were chosen randomly by sqlmap. The problem with sleep(N) is that SQL database evaluates it to 0 and hence post=1 AND 0 will be evaluated to zero (FALSE : 1 AND 0 = 0) too. Value 1749 gets interpreted by SQL database as TRUE (similar ...


0

In general SQL injection depends on the database engine used, I think in your example you provide a sql for MariaDB/MySQL database. The function sleep on PostgreSQL is pg_sleep, so your injection will not work on PostgreSQL. MariaDB [CODINGGROUND]> (SELECT 1749 FROM (SELECT(SLEEP(1)))nQtm) ...


-1

On PHP you can quote strings with either single-quotes or double-quotes. They behave a bit different -variables are only interpolated inside double-quoted strings- but the only difference in this example is that when you quote the PHP string with single quotes then you can't embed single quotes, that's why they use double quotes. Similarly, when using a ...


2

First part of question is ... how would I exfiltrate information with this " condition I have found? Is there a special name for it other than SQL injection that I can read more about? No, this is exactly SQL injection. If the results of the query are being printed, it's possible to use UNION to mix in data from other tables that are not intended to be ...


3

There are quite a few tools out there that can help find vulnerabilities, such as SQL injection points - none of these will find all of them. Blackbox testing - This is described by Vipul in his answer and involves testing / fuzzing the interfaces exposed in the application (UIs, Services...). These are closer to how an attacker might look at the system, ...


2

I'm wondering, if it's possible to discover all the endpoints for any product which is prone to SQL injection. NO ! Well wouldn't that be a magical tool. Well there are a lot of scanners that might crawl your site and try inserting sql statements and then check the returned result.Google them and you will find scanners or crawlers.But again you will not ...


4

Quote Xenos Can you find such exploit for MySQL? The USE syntax seems very "poor" for such injection Lets track down how USE works in MySQL and which files MySQL in the source code needs to access. --- **Query #1** SET PROFILING = 1; There are no results to be displayed. --- **Query #2** USE test; There are no results to be displayed. -...


2

If any of the elements of the schema in your database have names in common with other databases on the SQL engine, it might be possible to cross queries to produce undesirable results. Let’s say the expected database has a name of ‘PROD _DB’, but your developers have another database on the same SQL server named ‘TEST_DB’. They use the test database for ...


2

SQL injection is the "injection" of an SQL query/command with the intention of execution. A good summary and reference is available from OWASP. In this case, the risk would be that the CSV file includes commands which would, upon being loaded into the SQL database, be executed rather than simply inserted into a table. You could approach resolving this ...


Top 50 recent answers are included