Hey HF community,
I’m relatively new to offensive security and currently working on a personal project: testing a small web app I built (PHP + MySQL). I’ve gone through OWASP Top 10 basics and set up Burp Suite, but I’m stuck on a few things:
1. SQLi – I can trigger errors with ' or ", but can’t seem to extract data. Any go-to payloads or techniques for blind/extraction?
2. XSS – Reflected works, but stored gets sanitized. Ideas on bypassing HTML entity encoding or WAF?
3. File Upload – .php uploads are blocked, but .phtml/.php5 are allowed. Should I try double extensions or null byte?
I’m not looking for full exploits (yet), just pointers, tools, or write-ups that helped you when starting out.
Tools I have: Burp, sqlmap, Nikto, dirb.
Running on Kali in VM.
I’m relatively new to offensive security and currently working on a personal project: testing a small web app I built (PHP + MySQL). I’ve gone through OWASP Top 10 basics and set up Burp Suite, but I’m stuck on a few things:
1. SQLi – I can trigger errors with ' or ", but can’t seem to extract data. Any go-to payloads or techniques for blind/extraction?
2. XSS – Reflected works, but stored gets sanitized. Ideas on bypassing HTML entity encoding or WAF?
3. File Upload – .php uploads are blocked, but .phtml/.php5 are allowed. Should I try double extensions or null byte?
I’m not looking for full exploits (yet), just pointers, tools, or write-ups that helped you when starting out.
Tools I have: Burp, sqlmap, Nikto, dirb.
Running on Kali in VM.