+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.ly/Forum-Tutorials)
+--- Thread: [Series] SQLi-Labs - Advanced SQL injection training (/Thread-Series-SQLi-Labs-Advanced-SQL-injection-training)
[Series] SQLi-Labs - Advanced SQL injection training - RogueCoder - 10-09-2013
SQLi-Labs - Advanced SQL injection training
SQLi-Labs is a platform for learning SQL injection. This includes over 40 challenges ranging from basic to advanced.
Download: https://github.com/Audi-1/sqli-labs
I've decided to give this platform a go now, and also I've decided to note down everything I does and then share the notes. Each level will be a separate post and this post will serve as an index for the entire series.
Spoiler alert
If you want to take on these challenges yourself, then you should NOT visit my challenge threads before you have solved it yourself because I will openly, without using the spoiler tag disclose everything
Challenge Index
- #1 - GET - Error based - Single quotes - String - 2013-10-09
#2 - GET - Error based - Integer based - 2013-10-09
#3 - GET - Error based - Single quotes - String (With a twist)
#4 - GET - Error based - Double quotes - String
#5 - GET - Double injection - Single quotes - String
#6 - GET - Double injection - Double quotes - String
#7 - GET - Dump into outfile - String
#8 - GET - Blind - Boolean based - Single quotes
#9 - GET - Blind - Time based - Single quotes
#10 - GET - Blind - Time based - Double quotes
#11 - POST - Error based - Single quotes - String
#12 - POST - Error based - Double quotes - String (With a twist)
#13 - POST - Double injection - Single quotes - String (With a twist)
#14 - POST - Double injection - Single quotes - String (With a twist)
#15 - POST - Blind- boolean / time based - Single quotes - String
#16 - POST - Blind- boolean / time based - Double quotes - String
#17 - POST - Update query - Error based - String
#18 - POST - Header injection - User agent field - Error based
#19 - POST - Header injection - Referer field - Error based
#20 - POST - Cookie injection - User agent field - Error based
#21 - Cookie injection - Base64 encoded - Single quotes and parenthesis
#22 - Cookie injection - Base64 encoded - Double quotes
#23 - GET - Error based - Strip comments
#24 - POST - Second order injection - Stored injections
#25 - GET - Error based - All your OR & AND belong to us - Single quotes
#25a - GET - Blind based - All your OR & AND belong to us - Integer based
#26 - GET - Error based - All your spaces and comments belong to us
#26a - GET - Blind based - All your spaces and comments belong to us - Single quote parenthesis
#27 - GET - Error based - All your union & select belong to us - Single quote
#27a - GET - Blind based - All your union & select belong to us - Double quote
#28 - GET - Error based - All your union & select belong to us - Single quote with parenthesis
#28a - GET - Blind based - All your union & select belong to us - Single quote with parenthesis
#29 - GET - Error based - Impidence Mismatch - Having WAF in front of web application
#30 - GET - Blind - Impidence Mismatch - Having WAF in front of web application
#31 - GET - Blind - Impidence Mismatch - Having WAF in front of web application
#32 - GET - Bypass custom filter adding slashes to dangerous chars
#33 - GET - Bypass addslashes()
#34 - POST - Bypass addslashes()
#35 - GET - Bypass addslashes() (We don't need them) - Integer based
#36 - GET - Bypass mysql_real_escape_string()
#37 - POST - Bypass mysql_real_escape_string()
#38 - GET - Stacked query injection - String
#39 - GET - Stacked query injection - Integer
#40 - GET - Blind based - Stacked - String
#41 - GET - Blind based - Stacked - Integer
#42 - POST - Error based - Stacked - String
#43 - POST - Error based - Stacked - String (With a twist)
#44 - POST - Error based blind - Stacked - String
#45 - POST - Error based blind - Stacked - String
So I guess this is it then
Time to put my skills to the ultimate test. Wish me luck, 'cuz I will without a doubt need it
[Series] SQLi-Labs - Advanced SQL injection training - RogueCoder - 10-09-2013
SQLi-Labs - Advanced SQL injection training
SQLi-Labs is a platform for learning SQL injection. This includes over 40 challenges ranging from basic to advanced.
Download: https://github.com/Audi-1/sqli-labs
I've decided to give this platform a go now, and also I've decided to note down everything I does and then share the notes. Each level will be a separate post and this post will serve as an index for the entire series.
Spoiler alert
If you want to take on these challenges yourself, then you should NOT visit my challenge threads before you have solved it yourself because I will openly, without using the spoiler tag disclose everything
Challenge Index
- #1 - GET - Error based - Single quotes - String - 2013-10-09
#2 - GET - Error based - Integer based - 2013-10-09
#3 - GET - Error based - Single quotes - String (With a twist)
#4 - GET - Error based - Double quotes - String
#5 - GET - Double injection - Single quotes - String
#6 - GET - Double injection - Double quotes - String
#7 - GET - Dump into outfile - String
#8 - GET - Blind - Boolean based - Single quotes
#9 - GET - Blind - Time based - Single quotes
#10 - GET - Blind - Time based - Double quotes
#11 - POST - Error based - Single quotes - String
#12 - POST - Error based - Double quotes - String (With a twist)
#13 - POST - Double injection - Single quotes - String (With a twist)
#14 - POST - Double injection - Single quotes - String (With a twist)
#15 - POST - Blind- boolean / time based - Single quotes - String
#16 - POST - Blind- boolean / time based - Double quotes - String
#17 - POST - Update query - Error based - String
#18 - POST - Header injection - User agent field - Error based
#19 - POST - Header injection - Referer field - Error based
#20 - POST - Cookie injection - User agent field - Error based
#21 - Cookie injection - Base64 encoded - Single quotes and parenthesis
#22 - Cookie injection - Base64 encoded - Double quotes
#23 - GET - Error based - Strip comments
#24 - POST - Second order injection - Stored injections
#25 - GET - Error based - All your OR & AND belong to us - Single quotes
#25a - GET - Blind based - All your OR & AND belong to us - Integer based
#26 - GET - Error based - All your spaces and comments belong to us
#26a - GET - Blind based - All your spaces and comments belong to us - Single quote parenthesis
#27 - GET - Error based - All your union & select belong to us - Single quote
#27a - GET - Blind based - All your union & select belong to us - Double quote
#28 - GET - Error based - All your union & select belong to us - Single quote with parenthesis
#28a - GET - Blind based - All your union & select belong to us - Single quote with parenthesis
#29 - GET - Error based - Impidence Mismatch - Having WAF in front of web application
#30 - GET - Blind - Impidence Mismatch - Having WAF in front of web application
#31 - GET - Blind - Impidence Mismatch - Having WAF in front of web application
#32 - GET - Bypass custom filter adding slashes to dangerous chars
#33 - GET - Bypass addslashes()
#34 - POST - Bypass addslashes()
#35 - GET - Bypass addslashes() (We don't need them) - Integer based
#36 - GET - Bypass mysql_real_escape_string()
#37 - POST - Bypass mysql_real_escape_string()
#38 - GET - Stacked query injection - String
#39 - GET - Stacked query injection - Integer
#40 - GET - Blind based - Stacked - String
#41 - GET - Blind based - Stacked - Integer
#42 - POST - Error based - Stacked - String
#43 - POST - Error based - Stacked - String (With a twist)
#44 - POST - Error based blind - Stacked - String
#45 - POST - Error based blind - Stacked - String
So I guess this is it then
Time to put my skills to the ultimate test. Wish me luck, 'cuz I will without a doubt need it
RE: [Series] SQLi-Labs - Advanced SQL injection training - RogueCoder - 07-05-2014
You're welcome.. Glad you find it useful