More SQLi tips.
1. Append a ' or " to a valid param value.
2. If the response changes, replace the ' or " with each of these in turn (sub ' with " as needed):
' '
'||'
'+'
3. If you get the original response back, you likely have SQLi.
#bugbountytips #Cybersecurity #InfoSec
1. Append a ' or " to a valid param value.
2. If the response changes, replace the ' or " with each of these in turn (sub ' with " as needed):
' '
'||'
'+'
3. If you get the original response back, you likely have SQLi.
#bugbountytips #Cybersecurity #InfoSec
I call this the "break and repair" method. Your initial ' or " breaks the statement syntax.
The 3 values in step 2 are "repairs". They change your initial break into a valid concatenation with an empty string, which results in the original value (and response).
The 3 values in step 2 are "repairs". They change your initial break into a valid concatenation with an empty string, which results in the original value (and response).
Once you have a potential SQLi, you can use boolean logic to confirm it.
Replace your repair with:
' AND '1'='1
' AND '1'='2
The first should get the same response as the initial (non-SQLi) value. The second should not.
Replace your repair with:
' AND '1'='1
' AND '1'='2
The first should get the same response as the initial (non-SQLi) value. The second should not.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
