1. Perform SQL Injection attacks
SQL injection attacks are performed on SQL databases with weak codes that do not adequately filter, use strong typing, or correctly execute user input.
Last updated
Was this helpful?
SQL injection attacks are performed on SQL databases with weak codes that do not adequately filter, use strong typing, or correctly execute user input.
Last updated
Was this helpful?
Payloads to check the injection
Operations on database
Navigate to http://www.moviescope.com/. A Login page loads; enter the Username and Password as sam and test, respectively. Click the Login button.
If a Would you like Firefox to save this login for moviescope.com? notification appears at the top of the browser window, click Don’t Save.
Once you are logged into the website, click the View Profile tab on the menu bar and, when the page has loaded, make a note of the URL in the address bar of the browser.
Right-click anywhere on the webpage and click Inspect (Q) from the context menu, as shown in the screenshot.
The Developer Tools frame appears in the lower section of the browser window. Click the Console tab, type document.cookie in the lower-left corner of the browser, and press Enter.
Select the cookie value, then right-click and copy it, as shown in the screenshot. Minimize the web browser. Note down the URL of the web page.
Open a Terminal window and execute sudo su to run the programs as a root user (When prompted, enter the password toor).
To retrieve cookie from console
Now use the following commands to extract the database.
To get a shell
You can also use other SQL injection tools such as Mole (https://sourceforge.net), jSQL Injection (https://github.com), NoSQLMap (https://github.com), Havij (https://github.com) and blind_sql_bitshifting (https://github.com).
