Freaks City

SQL injection represents the most critical risk in web application security, often resulting in full compromise of backend data stores. Modern web applications rely on databases to store user accounts, preferences, content, and nearly all persistant information. Instead of generating static pages for each user, server-side scripts construct dyn ...

Database Enumeration Before attempting any escalation, it is critical to understand the current context and permissions available within the database envirnoment. Identifying Current Privileges To view the roles granted to the current user, query the session roles: SELECT * FROM session_roles; Determining Database Version Identify the specific ...

SQL Injection Detection and Performance Optimization in Legacy Systems When maintaining legacy web appplications, SQL injection vulnerabilities often arise from poorly structured code. These issues become particularly challenging when you inherit a poorly maintained system and must implement changes without a complete overhaul. This article dem ...

SQL Injection with Advanced Bypass Techniques This section details a classic SQL injection vulnerability, requiring a series of discovery steps and an advanced bypass method to retrieve sensitive information. Vulnerability Identification Initial reconnaissance revealed the presence of a SQL injection vulnerability. Inputting a single quote (1') ...

Hello-javasec Code Audit Environment: https://github.com/j3ers3/Hello-Java-Sec Configure the database and start the project directly. This project is built with Spring Boot. Swagger and Actuator Unauthenticated Access When examining dependencies, both Swagger and Actuator were present, so I reviewed their configurations. Swagger had no securit ...

Web Security Fundamentals 1. SQL Injection Types and Prevention SQL injection occurs when untrusted data is concatenated into SQL queries without proper validation, allowing attackers to manipulate data base operations. Common types include: character-based, numeric, boolean, error-based, time-based, union-based, stacked queries, wide-byte, and ...

The challenge presents a web application with login and registration functionality. The objective is to retrieve the hidden flag from the database. Initial Exploration Upon accessing the application, we notice registration and login options. Attempting to register with the username "admin" reveals that the account already exists, sugg ...

Penetration Testing Methodology Standard Penetration Testing Process Initial project preparation and scope definition Information gathering: WHOIS lookup, source IP identification, virtual host detection, C segment scanning, server system version, container version, application version, database type, subdomain enumeration, firewall identifica ...

Understanding SQL Injection SQL injection is a prevalent form of cyber attack that exploits vulnerabilities in database query construction. It typical occurs when user input is directly concatenated into SQL queries without proper validation or sanitization, allowing attackers to manipulate SQL logic or execute arbitrary commands. Example of SQ ...

File Inclusion and Upload Vulnerabilities File inclusion vulnerabilities occur when a web application dynamically includes files based on user input without proper validation, allowing attackers to include malicious files. Modern server-side languages like PHP (since version 5.2.0) often disable remote file inclusion by default, making Local Fi ...