Collaborate Disseminate
I would like some advice on how to troubleshoot a problem on Wordpress/Apache/PHP/MySQL
I am looking at the following:
select *
from wp_options opt
where option_name like ‘%wp_user_roles%’
order by option_name
Yesterday, fo… Continue reading user_roles getting deleted from wp_options table in wordpress
Since MySQL 5.7, the root user is configured to use the auth_socket authentication plugin instead of a password.
Is it safe to leave the root user that way (without a password)?
Continue reading Is it safe to leave MySQL root user without a password if it uses auth_socket?
Hey i’m trying the hacker101 CTF’s im still pretty new at this stuff
The CTF answer to the flag i’m trying to understand is https://github.com/testerting/hacker101-ctf/tree/master/micro-cms_v2/flag0
The important part of th… Continue reading How does this SQLi statement work?
I don’t know what if part of this command does.
FROM table
WHERE id = 1
AND IF(( Ascii(Lower(Substring((SELECT User()), $i, 1))) ) != $s, 1,
Benchmark(200000, Md5(Now()))) “`
any one can help me… Continue reading Sql Injection ByPass problem [on hold]
I am practicing pen testing in a protected box and I have a vulnerable Magento website and I managed to get its MySQL config file which is app/etc/local.xml.
In this file there is information such as:
<crypt>
<… Continue reading what can you do in sql login details and encryption key is available
A researcher has just published a zero-day security bug in one of the web’s most popular database administration software packages. Continue reading Server-squashing zero-day published for phpMyAdmin tool
Newer versions of MariaDB (a MySQL database server fork) have a new password based auth scheme called “ed25519”. The docs are very sparse regarding how it works and what it does.
https://mariadb.com/kb/en/library/authenticat… Continue reading How does MariaDB’s ed25519 auth scheme work?
Google offers a way to connect it’s apps (like google sheets) to a sql server.
In order to do this, you need to whitelist their google apps scripts IPv4 subnets.
I don’t see how this could be secure at all. Couldn’t someone… Continue reading Is whitelisting Google Apps Scripts Actually safe?
Well, is it possible to enter MySQL terminal(track and send queries) without username, password and IP?
I have gaming server and some guys just shared some details about our users on pastebin(like password – unhashed!). They… Continue reading MySQL terminal hack?
I was testing a websocket when i found an add to cart request like the following
[“{\”ITEMS\”:{\”ITEM\”:[{\”package_id\”:\”123\”,\”customer_type\”:\”3\”,\”qty\”:1,\”}”]
I tried to edit the value of the parameter qty to -… Continue reading Is sql injection possible on this websocket?