ArticleBlind SQL injection with conditional responses
Blind SQL injection with conditional responses: Exploit a blind SQL injection in the TrackingId cookie to extract the administrator password from the…
Knowledge base
Blog
Practical security research, write-ups, guides, and lessons learned.
- 199
- Entries
Explore
Blog Posts
Article
ArticleSQL injection vulnerability allowing login bypass
SQL injection vulnerability allowing login bypass: Exploit a SQL injection in the product category filter using a boolean condition to return uninten…
ArticleSQL injection attack, querying the database type and version on MySQL and Microsoft
SQL injection attack, querying the database type and version on MySQL and Microsoft: Determine the DBMS and extract the version string by injecting t…
ArticleBlind SQL injection with conditional errors
Blind SQL injection with conditional errors: Exploit a blind SQL injection in the tracking cookie to extract the administrator password and log in. •…
ArticleSQL injection attack, listing the database contents on Oracle
SQL injection attack, listing the database contents on Oracle: Exploit an SQL injection in the product category filter to enumerate the database, ide…
ArticleSQL injection UNION attack, retrieving data from other tables
SQL injection UNION attack, retrieving data from other tables: Exploit a SQL injection in the product category filter using a UNION based attack to d…
ArticleSQL injection UNION attack, determining the number of columns returned by the query
SQL injection UNION attack, determining the number of columns returned by the query: Identify how many columns are returned by the vulnerable categor…
ArticleBlind SQL injection with time delays
Blind SQL injection with time delays: Obtain carlos’s API key by exploiting an access control flaw where sensitive data is embedded in the body of an…
ArticleBlind SQL injection with conditional responses Part#2
Blind SQL injection with conditional responses Part 2: The lab exposes a user account page that pre fills the current user's password in a masked inp…
ArticleCSRF - where token is tied to non-session cookie
CSRF where token is tied to non session cookie: So I did the lab again one day afterwards because I really want to understand what is going. • Securi…
ArticleCSRF- Where Referer validation depends on header being present
CSRF Where Referer validation depends on header being present: This lab’s email change functionality is vulnerable to CSRF. The app attempts to block…
ArticleCSRF - where token is not tied to user session
CSRF where token is not tied to user session: This lab's email change functionality is vulnerable to CSRF. It uses tokens to try to prevent CSRF atta…