SQL Injection on Base64 Encoded String Parameters

This article is a guide to perform SQL Injection on the Base64 encoded Url parameters. These parameters are encoded so as to make the site injection proof but that is a big myth. Recently I came across “www.somesite.com/index.php?pid=VkRGRk9WQlJQVDA9″ this kind of URLs. The pid here, “VkRGRk9WQlJQVDA9“. It is nothing but […]

Advertisements

OVERTHEWIRE NATAS SERIES: 14 – 15 LEVELS

You can find the level before this on this http://www.anonhack.in/2018/09/overthewire-natas-series-level-12-14/ The 14th level of overthewire natas is a typical SQL injection based level. In this level, we have to use SQL injection tactics in order to get the password for the 15th level. Let’s dive in: This screen will appear:  2. […]

Advertisements

Time based Blind SQL Injection on MySQL: How to do manually

This article will guide you on how to perform time based SQL Injection on MySQL database. The last article was about Boolean based Blind SQL inection.  Application that has been used here for performing attack is Bwapp vulnerable web application. How to know when you need to test for Time […]

Advertisements

Boolean Based Blind SQL Injection on MySQL: How to do manually

This article will guide you on how to do Blind Boolean SQL Injection. As I have already told you in the last article that Blind SQL Injection is more like a guessing game and it is time consuming. An automated way is going to save your time but that way you won’t be able to learn it manually. SQLMAP is the best tool for that.

Advertisements

Blind SQL Injection: Introduction

SQL injection is one of the most deadliest attack in the world of Internet. It tops the OWASP top 10. I have already written about the Basic SQL Injection attack. If you haven’t seen those articles, here is the link: SQL Injection Part 1 SQL Injection Part 2 SQL Injection […]

Advertisements

SQL INJECTION PART 4:Getting admin password

SQL injection is one of the most dangerous attack on websites. Many manually created dynamic website do not have input filtration and thus leveraging themselves to this attack. This article will guide you on how to perform SQL Injection to get the admin password in a modsecurity environment in which […]

Advertisements

SQL Injection part 3: Identifying String Data or Numeric Data

This is my third post on SQL Injection, The first post SQL Injection part 1 was just a basic one to check if the SQL vulnerability exist on a certain website and SQL Injection part 2 shows how to exploit the SQL vulnerability. We inject SQL in three parameters, namely: String Data […]

Advertisements

Kioptrix Level 2 Challenge Solution

Kioptrix Level 2 challenge was quite hard compared to the Kioptrix Level 1. we have to have the understanding the web application and should try different ways to finding vulnerability. Requirements: Vmware Kioptrix level 2 challenge Kali [strictly depends on your choice] So lets dive in: -> Nmap 192.168.0.1/24 So […]

Advertisements

SQL Injection Part 2

In this article we will be looking at SQL Injection and how we can exploit different types of SQL vulnerabilities present on a website.SQL Injection is one most dangerous ways to get into some site and ruin it totally! Database contains every precious information. It consist of records of credit […]

Advertisements