[blackcobra]

Hello

How can i find a SQLi on the site have extension *.hml or other extension.
ex: example.com/products.html

how can I find vul on that?

Thx

[blackcobra]

Hello

How can i find a SQLi on the site have extension *.hml or other extension.
ex: example.com/products.html

how can I find vul on that?

Thx

[blackcobra]

Anyone can help me?

Thx

[blackcobra]

Anyone can help me?

Thx

[Cosmic_mybb_import11040]

Don't double post if no one replies.

[1llusion]

There are several techniques, please read some SQL injection tutorial to actually understand what you are looking for.

[blackcobra]

There are several techniques, please read some SQL injection tutorial to actually understand what you are looking for.

I read, but the tutorial only show where u have ID not html or other extension file such chn...

[1llusion]

There are several techniques, please read some SQL injection tutorial to actually understand what you are looking for.

I read, but the tutorial only show where u have ID not html or other extension file such chn...

Oh... euhmmm... read a bit about parameters and how they are sent to server. POST and GET methods and general stuff around.
A little introduction: http://www.w3schools.com/tags/ref_httpmethods.asp

if you have a URL of:

Code:

index.php?test=something

the ".php" is extension and "test=something" is parameter.

[blackcobra]

There are several techniques, please read some SQL injection tutorial to actually understand what you are looking for.

I read, but the tutorial only show where u have ID not html or other extension file such chn...

Oh... euhmmm... read a bit about parameters and how they are sent to server. POST and GET methods and general stuff around.
A little introduction: http://www.w3schools.com/tags/ref_httpmethods.asp

if you have a URL of:

Code:

index.php?test=something

the ".php" is extension and "test=something" is parameter.

Which tool I can find the parameter? Burp....?

[Faner]

Some websites uses that mod_rewrite or something like that, to change url.
For example I have seen the webpage

Code:

http://www.website.com/articles/science/spaceship_fuel.html

and after few tests turned out, that "spaceship_fuel" is GET parameter for sql. So to find sql injection vulnerability you need luck, experience and some brains. Basic web programming knowledge also helps.