Hi, I've noticed that in many of the SQL tutorials, dorks are used. What if I have a specific website that I want to hack, that isn't vulnerable to SQL injections? (I checked by adding the ' to the end of the URL. No error was returned).
Accessing sites not vulnerable to SQL |
 (Apr 16, 2020 10:48 AM)DaWheelol Wrote: Hi, I've noticed that in many of the SQL tutorials, dorks are used. What if I have a specific website that I want to hack, that isn't vulnerable to SQL injections? (I checked by adding the ' to the end of the URL. Noerror was returned). Maybe you can try to use a blind SQL injection. Search if there is an exploit, try using a XSS or RFI. Everything changes from site to site. In any case, you should know what you are doing or you'll risk getting into trouble.  (Apr 16, 2020 10:48 AM)DaWheelol Wrote: Hi, I've noticed that in many of the SQL tutorials, dorks are used. What if I have a specific website that I want to hack, that isn't vulnerable to SQL injections? (I checked by adding the ' to the end of the URL. Noerror was returned). This really isn't enough to rule out SQLi completely. In lots of cases I've found websites that check their GET parameters but fail to secure their POST parameters. There have also been cases of SQLi on some strange headers or cookie values which were obviously used on the site. Not to mention the difference between string and int based injection due to how SQL is formatted. Blind SQLi while definitely a possibility would generally be used where the behavior of the site doesn't match the input or friendly error pages are returned an not error messages, making it hard to identify what's happening.  |
|
|
