Collaborate Disseminate
I’d like to develop a password manager. I am unsure about the safest way to store the data in the cloud.
Credentials (usernames, passwords, login links) will be stored in a MySQL server. I’m planning to store credentials for… Continue reading Securely storing passwords in cloud
I would like to learn / know how other companies deal with the problem of storing the encryption keys. I want to encrypt the user’s email address (and other sensitive information) but (because I want to be able to send the us… Continue reading Php two-way encryption to mysql database
I encountered a particularly weird situation where I have an SQL Injection vulnerability in the ORDER BY clause. The query is forged on backend and the injection payload is converted to upper case with the strtoupper() PHP function as can … Continue reading Bypass PHP strtoupper() to perform SQL-injection on MySQL database?
I’m working on a search engine for my website. For some odd reason, content will not out put from the database onto a web page when I use prepared statement. This is my Code:
$search = test_input(preg_replace(“/[^a-zA-Z0-9]+… Continue reading prepared statements stopping database from out putting
The following line of vulnerable code makes the user input always upper case:
mysql_query(“select * from ” . strtoupper($_GET[‘table’]));
In a scenario where MySQL’s “lower_case_table_names” is set to 0 (case sensitive sche… Continue reading MySQL Injection
First time posting on Security Stack but I have benefited a lot from
previous posts. I am currently a security cyber security grad student
and I am building up my thesis project right now: it is effectively
another v… Continue reading How Have SQL Injections Evolved? (Specific Question + Open Discussion)
I am working on Ubuntu Server with mysql installed, I have a forum application vbulletin 5 installed and there are hundreds of mail.ru and projectgold.ru created on my application, it looks like this:
each user also creatin… Continue reading hundreds of users creating mail.ru and projectgold.ru accounts on my application db
If an SQL Injection on the address bar (like ?ID=1) affects two tables (SELECT *FROM catalogue WHERE… and SELECT *FROM reviews WHERE…) with a different amount of columns, is there a possibility a hacker could inject their… Continue reading SQL Injection on double table
In Mysql DBMS is it possible to assign USAGE privileges to a user which can do an update query? In order to prevent SQL-injection.
I can try some SQL-injection against a ad-hoc damn web application in my virtual enviroment for educational purpose.
In one of these I obtain the table column_privileges (of Mysql Information schema) empty, I retrive the table but the fiel… Continue reading Mysql Information schema column_privileges empty