Collaborate Disseminate
I have encountered some websites that when I used — to comment the rest of the query it didn’t work, but when I tried –+ it worked.
In the MySQL official documentation there is no such thing as –+ and we only have — and two other ways… Continue reading Why should we sometimes use –+ instead of — in SQL injection to comment the rest of the query?
I found a vulnerability which allows me to run any query on an Amazon RDS server. I was able to extract the user hashes by using the –passwords parameter of sqlmap, and one of the hashes was cracked before. The thing is, I’m… Continue reading Blind SQL Injection on Amazon RDS
I have a php application where the function “makeSessionVar” creates a session variable from application defined data, then concatenates it into the SQL string.
function makeSessionVar($A,$B){ // (<id>, <sql colum… Continue reading Is it safe to concatenate non-input session variables into a SQL string?
I have a php application where the function “makeSessionVar” creates a session variable from application defined data, then concatenates it into the SQL string.
function makeSessionVar($A,$B){ // (<id>, <sql colum… Continue reading Is it safe to concatenate non-input session variables into a SQL string?
The question
I will try to articulate this as clearly and best I can:
Suppose that I have a python program which connects to a database on a server. Next I ask you to consider that this python program grabs Mysql queries fr… Continue reading Is using JSON a secure way of handling sql queries in python?
Sensor network projects often focus primarily on electronic design elements, such as architecture and wireless transmission methods for sensors and gateways. Equally important, however, are physical and practical design elements such as installation, usability, and maintainability. The SENSEation project by [Mario Frei] is a sensor network intended for use indoors in a variety of buildings, and it showcases the deep importance of physical design elements in order to create hardware that is easy to install, easy to maintain, and effective. The project logs have an excellent overview of past versions and an analysis of what worked well, and where they …read more
Continue reading SENSEation Shows The Importance of Good Physical Design
MariaDB, the company behind the eponymous MySQL drop-in replacement database, today announced that it has acquired Clustrix, which itself is a MySQL drop-in replacement database, but with a focus on scalability. MariaDB will integrate Clustrix’s technology into its own database, which will allow it to offer its users a more scalable database service in the long […] Continue reading MariaDB acquires Clustrix
I want to know if this query can be SQL injected to update all rows
$pass = md5(mysqli_real_escape_string($_POST[‘password’]));
$sql = “UPDATE user_table SET password = ‘$pass’ WHERE reset = ‘something’ “;
$result = mysqli… Continue reading Sql injection to update all rows
I read this interesting note in the MySQL 8.0 documentation that seemed a bit confusing to me:
Statements that use AES_ENCRYPT() or AES_DECRYPT() are unsafe for statement-based replication.
As I understand it, that mean… Continue reading Why is MySQL 8.0 AES_ENCODE unsafe for statement-based replication?
Aidan summarizes what’s been going on in Azure IaaS in August, and I’ll also discuss a few features and services that you might have missed or forgotten about.
The post Everything You Need to Know About Azure Infrastructure – August 2018 appeared first on Petri.
Continue reading Everything You Need to Know About Azure Infrastructure – August 2018