SQL Injection Explained

Watch this video tutorial to find out in simple terms what the SQL Injection vulnerability is, and how real threats result from this typical exploitation.

It features a sample exploitation scenario illustrating clear steps of what an attacker may do with a website which is vulnerable to error based SQL Injection.

Parts 2 and 3 will feature Reverse Shells and Blind SQL injection coming soon...

Category:

Science & Technology

Tags:

• 7safe
• CSTP
• SQL injection
• error based SQL injection
• penetration testing
• burp suite

[TheBdemba16]

prolly the best and most informative video on SQL injections I've found. GREAT INTRO!!!

[Shdow1]

nice video btw in a website I get

Microsoft JET Database Engine error '80040e14'

instead, is there some other type of injection?

[TryReach]

@IcaJaBre Mozilla

[machinesTHEbest]

@LelleQ Lol I think he's, or she

[NorthWeezy2010]

can you do this to take a specific user id

[LelleQ]

@IcaJaBre Very funny... are you blind?

[IcaJaBre]

What browser are you using?

[bejoedson]

what your software did you use 4 editig your video

[slashBR1751]

@TaylorWalkerKean he is not a lamer that depends on youtube videos to learn "Hacking"

[sander945]

@nerosonic He could just know SQL Alot.. And how it all works...

[nerosonic]

@TaylorWalkerKean I was thinking the same thing...

[TaylorWalkerKean]

Wow, how did you learn all of this?



[listenbaer1]

@marino3d because in this case the statement would also be ...WHERE username = 'test123' .

That would work only if there was a real user with that nickname. With the or 1=1 the whole statement is always true regardless of the entered username and gives you access to the first found user in the list

[marino3d]

How come the 1=1 part is needed? Why wouldn't it work if you just did test123'--. The or 1=1 part seems redundant to me?

[augus1990]

a very clear tutorial, thanks