Collaborate Disseminate
Grafana needs data to be useful. Jack Wallen walks you through the process of using a MySQL database as a source for data visualization in Grafana. Continue reading How to Connect Grafana to a Remote MySQL Database
I am working on building a login page to demonstrate SQL injections. I’ve tried my best to build the most "simple" login. I’ve been using credentials such as 1′ or ‘1’ = ‘1 for username & password, and getting the "nay&q… Continue reading What SQL injections can bypass this authentication page? [migrated]
I have an EC2 Webserver on AWS which has a MYSQL database. The login data is stored on AWS using the Secret Manager. I have added an IAM role for the Server to get access to the password and an encryption key which is stored in the Secret … Continue reading Securely storing password and encryption key on AWS
I’m currently performing a pentest on an Apache website running php with Linux underneath, and I’ve managed to successfully compromise the database through sql injection. The next stage is obviously host system access, i.e. a shell, but I’… Continue reading Help with MYSQL exploitation
I’m trying sqlmap (newest stable version {1.6#stable}).
Here’s my situation & current result:
The target is behind a firewall. Sometimes the firewall blocks my ip & shows a recaptcha.
So it seems that I can’t get reliable result. … Continue reading SQLmap: identified time-based blind, able to retrieve banner, but cannot retrieve database names, target behind firewall [closed]
For my website that is currently in development, I am trying to figure out a way to handle authentication. I am using mysql as my database and nodejs for my server. Currently, my website does the following: Whenever a user signs up, the us… Continue reading Should I update the way I handle authentication for my website?
Given a query such as:
SELECT * FROM users limit 1,$limit
Is there a way to exploit this when using MySQL 8 and the standard PHP MySQL functions (ie no multi_query)?
What I have tried (unsuccessfully):
1 procedure analyse(extractvalue […. Continue reading SQL injection into LIMIT in MySQL 8
I’m using MySQL with Mybatis library. And I found the code below:
SELECT *
FROM tableA
WHERE xxx
ORDER BY ${inputA} ${inputB}
LIMIT #{inputC}
I know there are many ways to inject the ORDER BY, but haven’t found any example of injection i… Continue reading Is SQL Injection possible in ORDER BY before LIMIT?
From an article for the new Log4j vulnerability, it reads here:
A researcher working for Chinese tech firm Alibaba discovered the bug and privately informed the Apache Software Foundation, an all-volunteer corporation that develops and ma… Continue reading Is my MySQL Server (run by php/apache) affected by the Log4j vulnerability?
What if I was using the MySQL module in Node.js, and my syntax looked like this:
app.post("/", function(req, res) {
const data = req.body.data; // Say the user modified it to be "’; DELETE FROM users;
connection.query(`
… Continue reading NPM package for SQL injections?