+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+---- Thread: Brute force (/showthread.php?tid=6239386)
Brute force - pythonthing - Apr 18, 2023
Brute force login pages with SQL Injection queries with URL it's possible?
RE: Brute force - PurpleMoss - Apr 18, 2023
Depends how the form details are sent. Most are sent (and if they aren't then they should be) as POST requests which means the login data will be in the body, therefore sending an SQLi query in the URL won't do anything, you'd need to send it in the body.
If the application sends it as a GET (which is a big no no) then SQLi could be possible by injecting the payloads into the correct parameters within the URL.
All this is based on if the application is susceptible to SQLi, if they use parameterized queries then you're out of luck.
RE: Brute force - DebianBash - Apr 21, 2023
(Apr 18, 2023 11:16 AM)pythonthing Wrote: Brute force login pages with SQL Injection queries with URL it's possible?
If you mean the login page, then yes.
RE: Brute force - Zgh600 - Apr 28, 2023
(Apr 18, 2023 12:14 PM)PurpleMoss Wrote: Depends how the form details are sent. Most are sent (and if they aren't then they should be) as POST requests which means the login data will be in the body, therefore sending an SQLi query in the URL won't do anything, you'd need to send it in the body.
If the application sends it as a GET (which is a big no no) then SQLi could be possible by injecting the payloads into the correct parameters within the URL.
All this is based on if the application is susceptible to SQLi, if they use parameterized queries then you're out of luck.
Can't wait until i start doing things like this firsthand myself.