New answers tagged

0

There is an SQL attack called Stacked Queries, this type of attack is done by adding an semicolon -> ; to terminate an SQL statement. Example: /*Malicious user input by attacker*/ 1; DELETE FROM sub /*This example executes multiple statements*/ SELECT * FROM sub WHERE subid=1; DELETE FROM sub Not all SQL injections attack may allow that, ...


0

First of all always try to minimize usage of --threads when you are facing problems and consider testing with something like --delay=1 as the service might not work normally in high load. I started Juice with: docker run --rm -p 3000:3000 bkimminich/juice-shop Then when I try to login with invalid creds: POST /rest/user/login HTTP/1.1 Host: 192.168.2.82:...


0

Any luck with --delay? --delay=DELAY Delay in seconds between each HTTP request Note that something else might also cause 500 error code.


0

Some experimenting shows that double quotes signify 2 conditions comparing both against the value of the field named insertname and against the value insertname. So unlike the use of single quotes, manipulating the condition into WHERE name="name" will yield all rows, potentially allowing to bypass checks such as authentication.


1

tl/dr: The ability to properly escape user input once does not mean your company will do it every time. You can't. Don't even try. You have 2 good answers for the specific question you asked. However, I wanted to touch on some broader issues that are very important here: Prepared statements aren't a foolproof solution to SQLi Prepared statements are a ...


2

If escapeSimple behaves like mysqli_real_escape_string then there is one important caveat to be aware of: mysqli::real_escape_string -- mysqli_real_escape_string — Escapes special characters in a string for use in an SQL statement, taking into account the current charset of the connection (emphasis is mine) So you need an active connection for this charset-...


5

Not sure what escapeSimple does exactly, but if it behaves like mysqli_real_escape_string then it's ok, as long as you are not using some weird character encoding or forget to set it correctly (UTF8 should be ok by default, as far as I know). Remember that using MD5 or any other simple hashing function is considered bad practice today, and you should use ...


1

You show the result of SQL injection. I suppose the original query looked as follows: $statement = "SELECT * FROM users WHERE username = '$username' AND password = '$password'"; In a normal case user enters following values: username: Dean password: Secret$123 Then the application generates following SQL: $statement = "SELECT * FROM users ...


Top 50 recent answers are included