Collaborate Disseminate
In MySQL there are builtin AES_ENCRYPT() and AES_DECRYPT() functions which take the form of:
AES_ENCRYPT(str, key_str)
What length is required for the key_str argument? Can it be variable? What is the minimum and maximum s… Continue reading MySQL AES_ENCRYPT string key length
July was a busy month for Azure announcements, in this post, we wrap it all up so that you can stay up to date on the latest announcements.
The post Everything You Need to Know About Azure Infrastructure – July 2018 appeared first on Petri.
Continue reading Everything You Need to Know About Azure Infrastructure – July 2018
Is it possible to find sql injection injectable points by viewing Website Source code? I heard eval() function is Vulenerble. So how to check the vulnerablitys by viewing Website Source code?
We are 1-3 guys maintaining a fairly large but clumsy developed-in-house website. With around 900+ mysql tables, and a lot of data access code in PHP. Let’s say it is huge amount of code for just 1 or 2 guys to patch them all… Continue reading Is the hosting OS safe to sql injection hackers by hiding admin ID?
Having MySQL using auth_socket as default authentication mechanism for the root user scares me, so I change it to password authentication with rigid controls on password quality and documentation.
If a user manage to have ro… Continue reading Can root user have access to MySQL data?
We’re entering the laid-back days of Summer. There isn’t much Azure IaaS news, but we’re after quality, not quantity. June was a good news month for those of us using Microsoft Azure.
The post Everything You Need to Know About Azure Infrastructure — June 2018 appeared first on Petri.
Continue reading Everything You Need to Know About Azure Infrastructure — June 2018
Our website is 100% API based (with an SPA client). Recently, a hacker managed to get our admin’s password (hashed with SHA-256) through SQL injection (and cracking pwd) like this:
https://example.com/api/products?userId=364… Continue reading How to limit the impact of and reduce the risk of SQL injection for existing website?
I’m writing a little program that stores passwords in Python. I access to the DB with Mysqldb module.
I want to encrypt the password with AES 256 with CBC. I’m trying to do this with SQL AES_ENCRYPT function.
I set the cbc m… Continue reading AES CBC with mysql and Python [migrated]
The web app is a sample vulnerable one, and it’s quite simple, yet I can’t craft a suitable payload.
Here is the code:
<?php
$UA = $_SERVER[‘HTTP_USER_AGENT’]
$DB_USER = “user”;
$DB_PASS = “p@ss”;
$DB_NAME = “vuln_db”;
$D… Continue reading Problem with Time based SQL injection payload for specific web app
I happen to inject a ‘ in the email field and used the same username which I have registered before and it gave me an 500 Internal error as IntegrityError: (_mysql_exceptions.IntegrityError) (1062,…so on). It has given a v… Continue reading How to do SQL injection after getting a mysql exception 1062 integrity error