Collaborate Disseminate
Is writing select, update and insert query inline in PHP is more safe
or writing routines with MySQL is much better?
Which one is more secure and scalable?
What are the security threats which both can face?
What are the p… Continue reading MySQL Routine or PHP inline sql queries?
I’m a web developer / sys admin and I’m reading about the security of (for example) MySQL user authentication for the web apps and any other use case that involves local authentication in this context, like a framework for an… Continue reading Are db passwords useless for local authentication in (web) apps?
My server was hit by the following SQL injection payload:-
((/*!12345sELecT*/(@)from(/*!12345sELecT*/(@:=0x00),(/*!12345sELecT*/(@)from(`InFoRMAtiON_sCHeMa`.`ColUMNs`)where(`TAblE_sCHemA`=DatAbAsE/*data*/())and(@)in(@:=CoNCa… Continue reading Understanding SQL injection payload
Despite regularly achieving one of the top spots on the OWASP Top 10 list of the most critical web application security risks, injection vulnerabilities continue to plague database-driven web sites and get regularly exploited by attackers. And when we talk about injection attacks, SQL injections are the most prominent, mostly because SQL databases are ubiquitous, and the attackers often succeeding in dumping the contents of the entire database. “The severity of SQL Injection attacks is … More → Continue reading Telegram-based Katyusha SQL injection scanner sold on hacker forums
As stated in the title, how do I secure mysql against data tempering? I have been searching the internet for a solution but did not find one that fills my needs.
Let me describe my problem, assume I have sensitive informatio… Continue reading secure mysql against data tempering?
I’m new to working with PHP, and recently inherited a website project where the original developer had been sanitizing user input with mysqli_real_escape_string() before querying the MySQL database. As I recently learned from… Continue reading Current list of safe PHP Practices?
I was wondering how can i as a system developer ensure that systems virtual wallet are not tampered with? for example lets a assume that my application allows a user to deposit and widthdraw money, where the account balance i… Continue reading how to ensure the integrity of the data in store/database? [on hold]
I am conducting a pentest where I got stuck on the following problem:
I found a LFI in a php file. I am trying to exploit it and to get a shell or any further usage out of it but until now without any success. I tried
to read log files (a… Continue reading How to further exploit LFI / ssh / mysql
A website of my client was compromised by a person claiming he/she has now access to the database. From the fact that this person sent an email saying “contact me and I will tell you where the hole is” I can only hope the acc… Continue reading What SQL injection tool generates queries in my access_log?
I have seen discussions of mysql_real_escape_string being bypassed (for example: https://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string), however it’s important to note that the my… Continue reading Is there a method of bypassing mysqli_real_escape_string?