🖊️ Author: Nairuz Abulhul
🌐 Blog: R3dbuck3t
Table of Contents
Manual Injection Checklist
- [ ] When injecting a page with SQL characters, check for
- 500 responses
- Change in byte size
- Change in length (applies to Burp Suite Intruder)
- [ ] Use Payload of All Things on GitHub to enumerate the SQL page
Login Pages:
- View the source page, there might be debugging information
- Curl the page; maybe it contains some information
- Try default credentials
- Try SQL common injections
- Try SQLmap, login page means there is a database on the server
Default Creds
Default Creds:
admin:admin
admin:password
admin: Password123
admin: Password1
admin:password1
Testing The application against SQL injection
Types of SQL injections: