Freaks City

Bypassing Input Filters During manual SQL injection testing, web applications often implement strict input validation that filters critical characters such as spaces and the equals sign (=). To successfully exploit such vulnerabilities, an attacker must obfuscate the payload to bypass these rules. Inline comments (/**/) serve as an effectiev su ...

Vulnerability OverviewCVE-2024-32709 identifies a critical SQL Injection vulnerability in the WordPress WP-Recall plugin (versions <= 16.26.5). Unauthenticated attackers can exploit the group-name parameter within the account management endpoint to extract sensitive database records. The FOFA search query for identifying vulnerable deploymen ...

Low Security Level The authentication endpoint lacks both input validation and rate-limiting mechanisms. Credentials transmit via insecure GET requests and concatenate directly into SQL queries without sanitization. <?php if (isset($_GET['Login'])) { $input_user = $_GET['username']; $input_pass = $_GET['password']; $hash_pass = m ...

Web Reconnaissance and EnumerationProfiling a target web application involves identifying the underlying server technologies, hosted services, and hidden directories. Internet data mining services, such as Netcraft, can reveal critical details including the hosting provider, server operating system, and domain registrar. Alternatively, banner g ...

SQL injection represents the most critical risk in web application security, often resulting in full compromise of backend data stores. Modern web applications rely on databases to store user accounts, preferences, content, and nearly all persistant information. Instead of generating static pages for each user, server-side scripts construct dyn ...

Database Enumeration Before attempting any escalation, it is critical to understand the current context and permissions available within the database envirnoment. Identifying Current Privileges To view the roles granted to the current user, query the session roles: SELECT * FROM session_roles; Determining Database Version Identify the specific ...

SQL Injection Detection and Performance Optimization in Legacy Systems When maintaining legacy web appplications, SQL injection vulnerabilities often arise from poorly structured code. These issues become particularly challenging when you inherit a poorly maintained system and must implement changes without a complete overhaul. This article dem ...

SQL Injection with Advanced Bypass Techniques This section details a classic SQL injection vulnerability, requiring a series of discovery steps and an advanced bypass method to retrieve sensitive information. Vulnerability Identification Initial reconnaissance revealed the presence of a SQL injection vulnerability. Inputting a single quote (1') ...

Hello-javasec Code Audit Environment: https://github.com/j3ers3/Hello-Java-Sec Configure the database and start the project directly. This project is built with Spring Boot. Swagger and Actuator Unauthenticated Access When examining dependencies, both Swagger and Actuator were present, so I reviewed their configurations. Swagger had no securit ...

Web Security Fundamentals 1. SQL Injection Types and Prevention SQL injection occurs when untrusted data is concatenated into SQL queries without proper validation, allowing attackers to manipulate data base operations. Common types include: character-based, numeric, boolean, error-based, time-based, union-based, stacked queries, wide-byte, and ...