SQL Injection - TryHackMe Junior Penetration Tester 3.10

Introduction to Web Hacking, Lesson 10 - SQL Injection !
"Learn how to detect and exploit SQL Injection vulnerabilities"
Module: Introduction to Web Hacking
"Get hands-on, learn about and exploit some of the most popular web application vulnerabilities seen in the industry today."

================================================

What is TryHackMe's Jr Penetration Tester learning path?
By the end of the FREE course you will learn the necessary skills to start a career as a penetration tester which include:

Pentesting methodologies and tactics
Enumeration, exploitation and reporting
Realistic hands-on hacking exercises
Learn security tools used in the industry

#tryhackme #jrpentester #ethicalhacking =============================================================

Contents

00:00 - Intro
00:32 - Brief
01:30 - What is a Database?
06:00 - What is SQL?
13:06 - What is SQL Injection?
15:37 - In-Band SQLi
23:11 - SQLi - Authentication Bypass
25:34 - Blind SQLi - Boolean Based
34:34 - Blind SQLi - Time Based
39:43 - Out-of-Band SQLi
41:14 - Remediation

=============================================================

Music:

"1968" by TrackTribe - YouTube Audio Library License -------------------------------------------------------
"Spots Action" - by Audionautix - YouTube Audio Library License -------------------------------------------------------

Images:

[DietMomo]

Great walk-through! Like the clear voice you use and easy to digest speaking.

[xionarxfl]

I verymuch enjoi this video keep up content like this i have seen lots of other people who do how to rooms for thm but you dont only focus on flags but also about going threw the hole content in this room. as you might guessed of my writing i am not speaking english as a motherlangue so it is harder to read in english for me then to listen to it. great video!!!

[nazimsakhri]

Keep going man even though it doesn’t seem to pay off now but it will someday

[grippingstranger]

In the blind SQL the 's% just gives me a 0.1 response. When I add q to it it does give a 5 sec. Strange.

[bryanquezada]

Question, at the very end. How were you able to find the 4 then the 9, then the 6 and then the 1 where do those numbers come out of? Is it the bottom box?

[Lilbty.]

is using sqlmap for these type of sql injection is better?

[dimonbaly]

Thank you, your video helped!) I didn’t understand some moments)

[sebastianwar]

password like ='...' - what a terrible method, imagine if admin used 10 alphanumeric. You will be there all year trying to crack it.

[elduderino]

What I don't get is that you say at 35.39 that there are only two columns. But if we have id username password, isn't that 3 columns?
The task also says that there are two columns. There must be an answer to this but can't work out what. In previous task they say that there is id username and password and they say table has 3 columns. totally confused.

[greyhat]

what actually " SELECT 1, 2, 3" is ?

[JeremCrsl]

you're speaking way too fast man i couldn't get anything :/

[uduakoscar]

No offense but you spoke too fast. didn't get anything and I have been struggling with this