My SQL injection complete tutorial :)

My SQL injection complete tutorial :) - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.ly/Forum-Tutorials)
+--- Thread: My SQL injection complete tutorial :) (/Thread-My-SQL-injection-complete-tutorial)

Pages: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39

RE: My SQL injection complete tutorial :) - The Alchemist - 03-04-2013

I know quite some amount of database management using mysql but I never came across something like this +/*! or this /./
How does it bypass that 403 error?

RE: My SQL injection complete tutorial :) - shtefcs - 03-09-2013

Very nice tutorial Viper, tnx for sharing it.

RE: My SQL injection complete tutorial :) - zomgwtfbbq - 03-09-2013

(03-04-2013, 04:37 PM)The Alchemist Wrote: I know quite some amount of database management using mysql but I never came across something like this +/*! or this /./
How does it bypass that 403 error?

It's just a matter of bypassing the rules of the WAF that looks for specific patterns in the variable values. There are loads of articles on WAF bypassing, here's a good one:

http://kaoticcreations.blogspot.nl/p/sql-injection-waf-bypassing.html

RE: My SQL injection complete tutorial :) - The Alchemist - 03-10-2013

(03-09-2013, 01:16 PM)zomgwtfbbq Wrote:
(03-04-2013, 04:37 PM)The Alchemist Wrote: I know quite some amount of database management using mysql but I never came across something like this +/*! or this /./
How does it bypass that 403 error?
It's just a matter of bypassing the rules of the WAF that looks for specific patterns in the variable values. There are loads of articles on WAF bypassing, here's a good one:

http://kaoticcreations.blogspot.nl/p/sql-injection-waf-bypassing.html

It still didn't work. But I'll be looking into the link that you provided and also other articles about it(thanks for mentioning the term WAF bypassing, I didn't know it). So, when an 403 error appears, it means that they've blocked a certain pattern of URL type that they suspect to be vulnerable? They do this comparing with the URL right?

RE: My SQL injection complete tutorial :) - zomgwtfbbq - 03-10-2013

(03-10-2013, 07:22 PM)The Alchemist Wrote:
(03-09-2013, 01:16 PM)zomgwtfbbq Wrote:
(03-04-2013, 04:37 PM)The Alchemist Wrote: I know quite some amount of database management using mysql but I never came across something like this +/*! or this /./
How does it bypass that 403 error?
It's just a matter of bypassing the rules of the WAF that looks for specific patterns in the variable values. There are loads of articles on WAF bypassing, here's a good one:

http://kaoticcreations.blogspot.nl/p/sql-injection-waf-bypassing.html

It still didn't work. But I'll be looking into the link that you provided and also other articles about it(thanks for mentioning the term WAF bypassing, I didn't know it). So, when an 403 error appears, it means that they've blocked a certain pattern of URL type that they suspect to be vulnerable? They do this comparing with the URL right?

WAFs search for (sql) keywords like 'union', the trick is to add sql comments to bypass them. There are many WAFs around, all searching for different patterns in variables.

RE: My SQL injection complete tutorial :) - virus.exe - 03-18-2013

Man I need the passworld of this link for download: http://www.mediafire.com/?y7v30lcj0kn8836
Please, I will waiting a replay.

RE: My SQL injection complete tutorial :) - V1P3R - 03-20-2013

you can read in the end of the thread how to get the password Smile

RE: My SQL injection complete tutorial :) - H4X0RZ - 03-22-2013

Great Tutorial For the One who are stepping in this field and also for the intermediates

Thanks

RE: My SQL injection complete tutorial :) - yeuquaido - 03-27-2013

Please help me with the password for Download SQLI dorks list. I liked facebook page and sent you an message but no response. Thank you very much