#SQLInjection

How can hackers guarantee access during a login attempt, even without knowing the password? 🤔 The answer lies in the simple SQL Injection "OR" payload. #SQLInjection #EthicalHacking #Cybersecurity #ORPayload

Did you know a simple comment can turn a login field into a successful SQL Injection hack?👀 #SQLInjection #Hacking

SQL Injections are scary!! (hacking tutorial for beginners) ------> #sqlinjection #owasptop10 #sqli

SQL Injection payloads can get messy to remember during testing. This SQL Injection Cheat Sheet is a handy reference with payloads, DB-specific syntax, and common exploitation techniques.💉 🔗 #BugBounty #WebSecurity #SQLInjection #Pentesting #Infosec

I've made my Advanced SQL Injection Techniques repo on GitHub public. Head over to my repo and take a look. I hope you like it. #BugBounty #SQLInjection.

sql injection #CyberSecurity #SQLInjection #EthicalHacking #AppSec

Another day, another #SQLInjection. This time, it's in the User-Agent header, leading a full database takeover. Keep testing SQLi on everything and everywhere... #SQL #SQLinjection #BugBounty.

Finishing up some unfinished tests from last night, today we found SQLi 🔥 #SQLinjection #BugBounty #Bugcrowd

Blind #SQLInjection on #GraphQL The API accepts queries for user "gender" data and accepts 3 keywords "M,F,NA", I found the parader "xxxkeyword_xx_xx" is vulnerable to blind-SQL injection attacks using my fav payload: "0\"XOR(if(now()=sysdate(),sleep(9),0))XOR\"Z", #BugBounty

Never forget to fuzz to see if /wp-content/debug.log is accessible publicly. Sometime the logs can contain SQL error which can be chained to #SQLinjection. See what I found here: #WPDebugLog #SQLi #BugBounty

ℹ️Sending payload within the URL/URI itself can also trigger SQL injection. So don't just focus on the parameters. #SQLInjection #BugBounty

🧠 Blind Time-Based SQLi 1️⃣ No error/data output 2️⃣ Uses time delays like IF(SUBSTRING((SELECT pwd FROM users WHERE id=1),1,1)='a', SLEEP(5),0) 3️⃣ Measures response time to infer data char-by-char 🎯 Extracts secrets without visible leaks #bugbounty #sqlinjection #blindsql

Found a first #SQLInjection of 2023 with full DB dump of 20k+ subscribers, unfortunately got duplicated 😌😌. Time based and UNION Query. Payloads used:👇 #BugBounty #SQLi

Sleep is optional, SQLi 💉 is mandatory 2 SQLi’s locked in, plus some sweet XSS’s on the side Climbing to Top 4 soon @intigriti 🤝 #BugBounty #SQLInjection #XSS #WebSecurity #EthicalHacking #Intigriti #BugHunter

SQL Injection on JSON body POST request. It took me some time, but finally found the right technique and injection point. ``sqlmap -r request.txt --level=5 --risk=3 --force-ssl --ignore-code=500 --dbs`` #SQLInjection #BugBounty

Advanced SQL Injection Techniques now available in GitBook. Make a copy/ Archive / Convert to PDF before they report this too :). #bugbountytip #BugBounty #SQLInjection #SQLi

Tricky ASP blind SQL Injection in a login page. Confirmed using Blind-boolean method,but it took me hours before I found the right payload - that need to be encoded. Sadly, not triaged yet Payload: `';%20waitfor%20delay%20'0:0:6'%20--%20` #BugBounty #bugbountytips #SQLinjection

Always check the copyright messages in the footer; this could reveal something. I found an outdated login page from 2019 that turned out to be vulnerable to SQL injection. More specifically, it had no WAF!... WTF... #SQLInjection #bugbounty

If you have a JSON login page, test blind-SQL injection directly in the username and/or password fields like below. #BugBounty #SQLInjection #bugbountytips Payload injected in username input field: