🖊️ Author: Nairuz Abulhul

🌐 Blog: R3dbuck3t

Table of Contents

Manual Injection Checklist

• [ ] When injecting a page with SQL characters, check for
  • 500 responses
  • Change in byte size
  • Change in length (applies to Burp Suite Intruder)
• [ ] Use Payload of All Things on GitHub to enumerate the SQL page

Login Pages:

• View the source page, there might be debugging information
• Curl the page; maybe it contains some information
• Try default credentials
• Try SQL common injections
• Try SQLmap, login page means there is a database on the server

Default Creds

Default Creds:
admin:admin
admin:password
admin: Password123
admin: Password1
admin:password1

Testing The application against SQL injection

Types of SQL injections:

• Error-based