Overview
Syllabus
Intro
Recap
Redeploy live audit scan
Known vulnerabilities endpoint
Review scan results
Recreate the vulnerability SQLi
Useful SQLi resources
Union vs Blind injection
Finding the correct syntax comments
Identify number of columns order by
Determine column datatypes
Enumerate databases union attack
Enumerate tables
Enumerate columns
Extract username and password
Blind SQLi attack
Determine database name length
Extract database name substring
Automate extraction with burp intruder
Issue #2: SQL in base64-encoded JSON cookie
Fail to automate with burp macros / session handling
SQLMap burp extension bApp
Test SQLMap CLI fails to get DB type/version
Conclusion
Taught by
CryptoCat