How a Hacker Could Attack Web Apps with Burp Suite & SQL Injection
HTML-код
- Опубликовано: 4 окт 2024
- Earn $$. Learn What You Need to Get Certified (90% Off): nulb.app/cwlshop
How to Attack Web Applications with Burp & SQL Injection
Full Tutorial: nulb.app/x4a9p
Subscribe to Null Byte: goo.gl/J6wEnH
Tim's Twitter: / tim51092
Cyber Weapons Lab, Episode 191
Web applications are virtually everywhere, and there's more and more every day. But not all of these apps are as secure as they could be. One of the simplest, yet most prevalent types of security flaws found in modern web apps is SQL injection. On this episode of Cyber Weapons Lab, we'll show off just how easily this type of vulnerability can be taken advantage of using Burp Suite.
To learn more, check out the article: nulb.app/x4a9p
Follow Null Byte on:
Twitter: / nullbyte
Flipboard: flip.it/3.Gf_0
Website: null-byte.com
Weekly newsletter: eepurl.com/dE3Ovb
Vimeo: vimeo.com/chan...
![KAYTRANADA - Witchy (feat. Childish Gambino) [Official Video]](http://i.ytimg.com/vi/jGK3YVmGZ3Y/mqdefault.jpg)
Everytime i'm about to learn something, you publish video about it. Thank you so much 👍
2:31 - sql challenge
2:57 - proxy settings
3:50 - burp suite
they updated their robots to blink😏
Fr
Robots xD
They are extraterrestrials living among humans to teach and educate and develop us.
This is alpha version with update patch:
- added blink every 1 minute
This lab will work but it does require a work around at the very end when using Kali. The request will not render using the built in Burb Suite browser. The solution is to click on the Actions button inside the Render window and select, "show response in browser." Paste the copied URL in your browser address bar to see your results. Still a great lab! Thanks!
I really needed this! Thanks for the info!
This is super hard to find out there in the wild these days, but thanks for sharing
Man back when I was into computers in 2010 every 3 or 4 sites this would work on with more advanced SQLI techniques
Thanks guys, I am a huge fan of you.
How can we find passwords without rendering page?
This is an excellent demonstration. Question: You said that you knew that request #39 worked. When you scrolled through the attempts, #39 (6:19 in the video) looked just like the others (same 200 status, slightly larger size). So how did you find out that that was the one? Is it the length (25599)? It's larger than the others on the screen, but we haven't seen all of the lengths. Or did you just start clicking them one at a time until you found the right one? That would seem rather tedious. Thanks!
In burp option you can add grep match for specific word , you add custom word from error failed login example bad password etc... And then you could filter even if all responds 200 ok
@@razexrazex Thank you! I'll try that.
Oh nisssse ❤💋. Perfect. Keep the tools tuts coming!
💋
i think null byte has some sort of mind reading power so that what i want ro learn becames a vedio here
thanks alot bro ... this so useful and really great explanation
I always get sceptical when people say "Es Queue El"
same lol
This was helpful. Thank you
Timely post, was just looking into doing this with burp, and someone sent me the link.
Thanks for this useful tutorial
Kodi come backkk we missing ur no blink challenge videos
Let's appreciate that they never click bait us
Nice help all learner
Does not work
why is mine still error at attempts #39??
I have a question. How would you know if you were successful with an sql injection without going through each and every payload
simple, you have the length of request html in intruder attack... filter by that
your help is very helpful
Great video!! I'm new to pen testing (2 weeks ha ha) and found this to be very useful! One question, say I had a list of one million variations - arbitrary number, of course. Do you have to click through each one? What is the quickest way to achieve find this from a 1,000,000 request test? Thanks again!
it kinda sucks because the connection using the proxy will have problem or error, getting to youtube as an example will be an error
Big plus for splunk sticker. 👍
easy and helpful
It says that this video is unavailable on this device. I can watch any other video if yours but this do you know why?
Thanks I'll look into it, I don't know why it would do that.
thanks it was helpful
Why would someone use 3 adblocking extensions?
We done, informative video sir
Hey Tim actually on the baro suite when I go to proxy section it shows me option like start browser and documentation etc even if I started my manual proxy of fire fox
Yessir another new video
Clearly explained, easy to understand :)
The response render is not working not showing? did i miss something?
thanks for this course!
So we need to RENDER each and every username ?? That's like finding a needle in haystack.
what if the security level of the mutillidae is increased.
Good question
Hey bro can you give me link to payload that you used
Wow y'all are good
Nice video
geez i m juat learning how to use print on python and to come till this position it will take me whole eternity 😂😂
it's pretty easy stuff. Keep it up for a few years and you'll be more than enough to do understand these vids.
Hey Tim!:)
This guys Is better than that creepy guy who doesn't blink 😬😬😬
Everytime when the attack is over it is showing unable to render response. Do you know how to fix it?
I have Burpsuite but when I turn on intercept my browser will run very slow,pls what’s problem?
What can I do, when metasploit's ip address doesn't load if it is directly enterd into the search box?
where did he get that sql injections .txt file from? I cannot find it anywhere in githib
how make mastercard for free please I need
How to use owpsa tool
Good idea vichu A, I've added it to the list of video ideas.
that sql.txt list didn't work for me.
If used PDO or Prepared statement in web app is it still possible too do.
How about a full Tutortials in begginers like me :) what app do you use in PC? Is it Termux or Kali?
Lime wire for hackers
Can we boot Kali Linux on raspberry pi and do these stuff ?
Yes, www.kali.org/docs/arm/kali-linux-raspberry-pi/
hi , i have MOZILLA_PKIX_ERROR_MITM_DETECTED error with mozila when i put connection setting same as you , traffic do not intercept and webpage was blocked ,
do you have a clue for that?
I love you man
why do I get status code 419 after a while ? Im testing a localhost application made in laravel
Sir please make a detailed video on "remote code execution vulnerability"
Your demonstration looks very complicated and makes me confused because you are using multiple tools at the same time for one target. Can you please make it easier please??
Well, the video is down, that was fast.
Please I can't understand how can I attack websites I don't know, you put your ip address and you attacked can I put website ip address instead of your ip address
his face look like MrBeast
Nice
I prefer the other guy that doesn't blink. Sorry dude, the video was good! Just at the beginning you were reading lol. Maybe your lines. Anyways good Video.
do u use a linux system or vm for linux
is there a link to the list of sql injections
google and others
ext:txt intext:" or 1=1"
At 5:14 in the video, you can see the URL.
@@deepeddyrecords5933 im lazy
@@emmaanderson8710 Good luck with that!
hi
Greate👏👏
Great*
masking your link-local IPv6 is just absurd.
❤️ good
SELECT username, password FROM users WHERE username='' or 1=1--' AND password='';
and never store passwords as plain text
🔥
Always the same, Php and MySQL database with no security 😒… Why not to test this against an Angular front end - .Net - SQL server ?
Which laptop is best for hacking
I got an issue its saying embedded "browser initialization failed" in the brup
Can anyone help me with this?
me too. Do you have a solution yet
@@anngustang1158 the same here.... :(
🙏
kody retired or what
Check the securityfwd YT channel
ارجوك نريد ترجمه بلعربية
hihh
It's mr beast... the evil mr beast
Are you guys white hat hacker?
Hey everyone,
This is Adam. I am an MSc student doing some research on the threats and opportunities of promoting hacking-related knowledge online. I would very much appreciate your participation guys by answering the following questions.
Q1: Should hacking be taught?
Q2: What motivate you to follow and watch this content?
Q3: Are you benefiting (careerwise) from watching these videos?
Q4: What are the risks and opportunities of making cybersecurity knowledge accessible with a worldwide audience?
more of the comment about eye blink.. What the f**k are doing??
Man, please drop the music in the future. It's distracting.
Please we want to translate it into Arabic
Please we want to translate it into Arabic 👍👍👍👍
First!
second
Third
use StackOverflow smh
Show us how we can hack social media accounts. Instagrams etc..
Password reuse via leaked databases. It's not a clear cut question, since there are other means to do that. That might look like phishing, key logging, RATing.
I have Burpsuite but when I turn on intercept my browser will run very slow,pls what’s problem?
u only have to turn on intercept when ur trying to intercept