[Kulls]

Hello,

I have some questions as :
How SQL injections into a website or there are no variables in the URL (http://www.exemple.com/id=5), here is the variable "id =" ?
And, to a secure website (https) ?
Greating ! 😅

[Frosteh]

You can inject anywhere that takes user input or any kind of external data and puts into the database, the different injection points depend on how the website is built, you need to investigate and experiment or use tools to scan.

A lot of the time page parameters are no longer written as ?variable1=value1&variable2=value2 but can be part of the a (virtual) directory structure such as /news/group/date/headline-news, here the "date" part may be re-written into a parameter used to query a database.

You can inject into the body of posts which post back user data, normally you'd proxy your browser traffic through something like burp suite or ZAP to intercept and modify the post request to include your injection, or use browser add ons to modify it.

Another injection point that is more rare is through cookie values, if for whatever reason the website takes users cookies and stuffs them into a database that's a possible injection point. Websites may be built to collect any kind of user information and put it into a database such as browser name and version, your location, etc. Many of those things can be spoofed and so have the potential for injection.

There's many others, too many for me to list. Some can be very hard to find if it's not obvious the page is collecting that information.

HTTPS can be injected in the same way that HTTP is, if you want to proxy the traffic through a proxy then you'll need to generate a valid SSL certificate for the proxy and install that cert into your browser.

[Kulls]

Hey !
Thank you for the response !
You've cleared me of my thoughts about them (https) 😁, you say that SQL injections are the same as for the http protocol .... I already tried on sites with havij, and each time the log there was written "Moved Permanently" or "404 forbidden" or something! I do not understand ! Especially havij trouverles BDD is renowned for a site with more than 95% success rate! :$
I had already tried by hand, and it did nothing.

Do you have any examples to offer me of advanced SQL injections at sites that do not have variables?
Also, I have another question to ask you, (for I see that you are immersed in the field of computer security 😁 ), why servers and web sites use "?", Not ""or another symbol in the URL?

Great ! 🤝

[๖ۣۜAnubis]

You need to have a variable for sqli.
And HTTPS has nothing to do with sqli, it only encrypts the request to block MITM attacks.

[s3cr3t]

hello there,

when you trying to inject https website using havij , you have to change " h t t p s : / /" to "h t t p : / /"
deleting "s" from "https"
and it will work.

[Saint]

hello there,

when you trying to inject https website using havij , you have to change " h t t p s : / /" to "h t t p : / /"
deleting "s" from "https"
and it will work.

Don't use Havij.

[๖ۣۜAnubis]

hello there,

when you trying to inject https website using havij , you have to change " h t t p s : / /" to "h t t p : / /"
deleting "s" from "https"
and it will work.

WTF? OMFG! You're saing we can't inject https websites? 😖

[Disparity]

You need to have a variable for sqli.

No you don't.

[๖ۣۜAnubis]

No you don't.

You need something.

[Kulls]

hello there,

when you trying to inject https website using havij , you have to change " h t t p s : / /" to "h t t p : / /"
deleting "s" from "https"
and it will work.

I know I had already tried without success

Thanks for all responses !

you can not use automated software as havij poutmr https sites ?
They are therefore , not hackable except leaks in cryptography https ( ssl , tls , etc ...)
another question how Russian hackers were able to hack over 4 billion addresses mail and password ?
I think they should be https sites ...
Great ! 🤝

[Kulls]

Nobody knows?
Nobody to answer me ?
😶 😵 😟

[JaNuS18]

..
you can not use automated software as havij poutmr https sites ?
They are therefore , not hackable except leaks in cryptography https ( ssl , tls , etc ...)

Where is you statement (such sites are not hackable if havij can't inject https sites) coming from? 😧

You don't need automated software like Havij to inject a site. Manual injection is more powerful.

Tools are good only for time consuming tasks (blind injection)

[Kulls]

Hey !
Thanks for answer ! 😁
He's an automated software like Havij to make SQL injections on https websites ?
Is it possible to avoid redirects with Havij ?

Can you give me an example of SQL injection in the URL (http), but variable (exemple: "http://www.exemple.com/index.php?id=5").
When we enter a URL in havij, which symbol can we put at the end of the URL? (- Or / / or / * or something else), which could help Havij ?

Great !

[JaNuS18]

My message was: Don't use Havij.

Otherwise you will never understand what is going on when you inject some site. Beside in most cases Havij can't bypass WAF...

You can manually inject on many sites where tools fail.

[Kulls]

Thank you, but can you give me an example of SQL injection in the URL (http), but variable (exemple: "http://www.exemple.com/index.php?id=5").
When we enter a URL in havij, which symbol can we put at the end of the URL? (- Or / / or / * or something else), which could help Havij or another soft ?
I can't found example on the net, so...