Collaborate Disseminate
Two critical zero-day vulnerabilities have been discovered in the world’s 2nd most popular database management software MySQL that could allow an attacker to take full control over the database.
Polish security researcher Dawid Golunski has discovered… Continue reading New MySQL Zero Days — Hacking Website Databases
A researcher has disclosed some details and a limited proof-of-concept for a critical MySQL vulnerability. The flaw has been patched in MariaDB and PerconaDB. Continue reading Critical MySQL Vulnerability Disclosed
I’m currently pentesting my friends website. I found an SQL injection with acunetix’ help:
– URL encoded GET input for was set to 1#####
Error message found:
supplied argument is not a valid MySQL result
So I tried runnin… Continue reading Special sqlmap injection
I’m currently pentesting my friends website. I found an SQL injection with acunetix’ help:
– URL encoded GET input for was set to 1#####
Error message found:
supplied argument is not a valid MySQL result
So I tried runnin… Continue reading Special sqlmap injection
I’m currently pentesting my friends website. I found an SQL injection with acunetix’ help:
– URL encoded GET input for was set to 1#####
Error message found:
supplied argument is not a valid MySQL result
So I tried running a normal sql… Continue reading Special sqlmap injection
Today, Facebook is releasing its Zstandard compression algorithm into the wild as open source. The lossless compression technology is aimed at replacing existing libraries like Zlib that are powered by the outdated Deflate compression algorithm. In addition to Zstandard, Facebook is also dropping its MyRocks storage engine as open source. MyRocks is currently being used by Facebook to… Read More Continue reading Facebook open sources Zstandard compression algorithm and MyRocks storage engine
I tried to find some SQL injection exploits that could bypass functions that should prevent sql injection vulnerabilities, for example mysql_real_escape_string. I found an exploit and the author described the vulnerability an… Continue reading How to bypass mysql_real_escape_string to exploit a SQLi vulnerability?
How do I securely save PHP objects in a MySQL Database? If you use the serialize and unserialize functions, you may end up with Object Injections. Is there a predefined standard on how to handle this?
Note that SQL injection… Continue reading Secure method to store PHP object in MySQL database?
We currently have two EC2 instances and a RDS instance. Both a EC2 instance and the RDS instance a hosted on AWS in the same region. However, the second EC2 instance is on a different region.
Currently we have limited access… Continue reading AWS RDS MySQL database publically avalible
Assuming I want to implemante a search engine, is it dangerous to let the user into a LIKE. For example :
SELECT user FROM table WHERE user LIKE “[user input]”
In this case, I assume user will be allowed to type characters … Continue reading Is it dangerous to let the user input into a LIKE sql statement