SQLMap tool is your friend
Hello all! For the most of you there is nothing new talking about SQL Injection and exploitation techniques. As I friend of mine says: "SQL Injection is the pop star of the vulnerabilities". What I will show here is how SQLMap can help you to exploit tricky SQL injection vulnerabilities. Just the other day performing a penetration testing on a web application I’ve found a SQL injection flaw. In order to find such vulnerability I was only browsing the application (doing some recognition) and by changing the ID parameter in the follow URL it was enough to give me some clue about the flaw: https://target.com.br/index.php?a=info&ID=32 ' Result: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'' at line 1 Well, I was happy to have found it and I started the process to find a way to exploit it. First of all I decided for the UNION techni...