Skip to content

Latest commit

 

History

History
53 lines (40 loc) · 2.32 KB

06_SQLi.md

File metadata and controls

53 lines (40 loc) · 2.32 KB
Raw

#Tactical Fuzzing - SQLi

SQL Injection

Core Idea: Does the page look like it might need to call on stored data?

There exist some SQLi polyglots, i.e (Mathias Karlsson);

SLEEP(1) /*‘ or SLEEP(1) or ‘“ or SLEEP(1) or “*/

Works in single quote context, works in double quote context, works in “straight into query” context!

You can also leverage the large database of fuzzlists from Seclists (https://github.com/danielmiessler/SecLists)

##SQL Injection Observations Blind is predominant, Error based is highly unlikely.

‘%2Bbenchmark(3200,SHA1(1))%2B’

‘+BENCHMARK(40000000,SHA1(1337))+’

SQLMap is king!

  • Use -l to parse a Burp log file.
  • Use Tamper Scripts for blacklists.
  • SQLiPy Burp plugin works well to instrument SQLmap quickly. Lots of injection in web services!

##Best SQL injection resources