Wellcome to zakir|cyberroom

In most cases when a developer attempts to protect the website from classic SQL Injection poorly, the result is leaving space for Blind SQL Injections. Meaning if you turn off error reporting, a classic SQL Injection can become a Blind SQL Injection vulnerability. How can you protect yourself from Blind SQL Injections: Use secure coding practices Be sure to use secure coding practices, independent of the programming language. All standard web development platforms (including PHP, ASP.NET, Java, and but also Python or Ruby ) have mechanisms for avoiding SQL Injections, including Blind SQL Injections. Try to avoid dynamic SQL at all costs. The best option is to use prepared queries, also known as parameterized statements. Also, you can use stored procedures that most SQL databases support (PostgreSQL, Oracle, MySQL, MS SQL Server). Additionally, escaping or filtering special characters (such as the single quote which is used for classic SQL Injections) for all user data inputs. ...

In the case of the Content-based Blind SQL Injection, an attacker performs various SQL queries that claim the database TRUE or FALSE responses. Then the attacker observes differences between TRUE and FALSE statements . Here is an example of an online webshop, which displays items for sale. The following link displays details about the item with ID 14,  that is retrieved from a database. http://www.webshop.local/item.php?id=14 The SQL query used to get this request is: SELECT columnName, columnName2 FROM table_name WHERE id = 14 The attacker manipulates the request into: http://www.webshop.local/item.php?id=14 and 1=2 Now, the SQL query looks like: SELECT columnName2 FROM tableName WHERE ID = 14 and 1=2SELECT name, description, price FROM StoreTable WHERE ID = 14 and 1=2 This results in the query returning FALSE with no items displayed in the list. The attacker then proceeds to modify the request to: http://www.webshop.local/item.php?id=14 and 1=1 ...

A lots of people asking me that what is SQL injection, so today topic is about This Vulnerability. In this topic you will learn what SQL injection is and how hackers exploit these types of Vulnerabilities. SQL injection  is a  c ode injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker). SQL injection must exploit a  s ecurity vulnerability in an application's software, for example, when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed. SQL injection is mostly known as an attack vector for websites but can be used to attack any type of SQL database. SQL injection attacks allow attackers to spoof identity, tamper with existing data, cause repudi...