How a Hacker Could Attack Web Apps with Burp Suite & SQL Injection

Рет қаралды 153,209

3 жыл бұрын

Earn $$. Learn What You Need to Get Certified (90% Off): nulb.app/cwlshop
How to Attack Web Applications with Burp & SQL Injection
Full Tutorial: nulb.app/x4a9p
Subscribe to Null Byte: goo.gl/J6wEnH
Tim's Twitter: / tim51092
Cyber Weapons Lab, Episode 191
Web applications are virtually everywhere, and there's more and more every day. But not all of these apps are as secure as they could be. One of the simplest, yet most prevalent types of security flaws found in modern web apps is SQL injection. On this episode of Cyber Weapons Lab, we'll show off just how easily this type of vulnerability can be taken advantage of using Burp Suite.
To learn more, check out the article: nulb.app/x4a9p
Follow Null Byte on:
Twitter: / nullbyte
Flipboard: flip.it/3.Gf_0
Website: null-byte.com
Weekly newsletter: eepurl.com/dE3Ovb
Vimeo: vimeo.com/channels/nullbyte

Пікірлер: 130

@tomashublik5586 3 жыл бұрын

Everytime i'm about to learn something, you publish video about it. Thank you so much 👍

@jyotirmaysengupta2360 3 жыл бұрын

I really needed this! Thanks for the info!

@kristiannn 3 жыл бұрын

2:31 - sql challenge 2:57 - proxy settings 3:50 - burp suite

@krah8052 3 жыл бұрын

This lab will work but it does require a work around at the very end when using Kali. The request will not render using the built in Burb Suite browser. The solution is to click on the Actions button inside the Render window and select, "show response in browser." Paste the copied URL in your browser address bar to see your results. Still a great lab! Thanks!

@sayooj5873 2 жыл бұрын

This was helpful. Thank you

@fernandoblanco3590 3 жыл бұрын

Thanks guys, I am a huge fan of you.

@alexvillarreal3947 2 жыл бұрын

thanks alot bro ... this so useful and really great explanation

@TheJonesin666 3 жыл бұрын

Great video!! I'm new to pen testing (2 weeks ha ha) and found this to be very useful! One question, say I had a list of one million variations - arbitrary number, of course. Do you have to click through each one? What is the quickest way to achieve find this from a 1,000,000 request test? Thanks again!

@acronproject Жыл бұрын

Thanks for this useful tutorial

@ellie8309 3 жыл бұрын

they updated their robots to blink😏

@realhomy 3 жыл бұрын

@droid5321 3 жыл бұрын

Robots xD

@vijaySingle143 3 жыл бұрын

They are extraterrestrials living among humans to teach and educate and develop us.

@Rhidayah 3 жыл бұрын

This is alpha version with update patch: - added blink every 1 minute

@Carisma2012 3 жыл бұрын

your help is very helpful

@just-cat8217 3 жыл бұрын

Hey Tim actually on the baro suite when I go to proxy section it shows me option like start browser and documentation etc even if I started my manual proxy of fire fox

@Ms.Robot. 3 жыл бұрын

Oh nisssse ❤💋. Perfect. Keep the tools tuts coming!

@maninderjudge298 3 жыл бұрын

💋

@erfanbaghchedan9104 2 жыл бұрын

thanks it was helpful

@curtistackie7459 Жыл бұрын

easy and helpful

@Blas1290 3 жыл бұрын

How can we find passwords without rendering page?

@realhomy 3 жыл бұрын

Yessir another new video

@hackingismylife2167 3 жыл бұрын

Nice help all learner

@deepeddyrecords5933 3 жыл бұрын

This is an excellent demonstration. Question: You said that you knew that request #39 worked. When you scrolled through the attempts, #39 (6:19 in the video) looked just like the others (same 200 status, slightly larger size). So how did you find out that that was the one? Is it the length (25599)? It's larger than the others on the screen, but we haven't seen all of the lengths. Or did you just start clicking them one at a time until you found the right one? That would seem rather tedious. Thanks!

@razexrazex 3 жыл бұрын

In burp option you can add grep match for specific word , you add custom word from error failed login example bad password etc... And then you could filter even if all responds 200 ok

@deepeddyrecords5933 3 жыл бұрын

@@razexrazex Thank you! I'll try that.

@someone552005 3 жыл бұрын

Timely post, was just looking into doing this with burp, and someone sent me the link.

@nirmaltech2043 3 жыл бұрын

If used PDO or Prepared statement in web app is it still possible too do.

@mrfaxine6462 3 жыл бұрын

hi , i have MOZILLA_PKIX_ERROR_MITM_DETECTED error with mozila when i put connection setting same as you , traffic do not intercept and webpage was blocked , do you have a clue for that?

@hamzakarakaya5442 2 жыл бұрын

We done, informative video sir

@tevainuiweza2420 Жыл бұрын

where did he get that sql injections .txt file from? I cannot find it anywhere in githib

@Sundaydike 3 жыл бұрын

I have Burpsuite but when I turn on intercept my browser will run very slow,pls what’s problem?

@1matroska 3 жыл бұрын

thanks for this course!

@exclusivegamer9124 3 жыл бұрын

Hey bro can you give me link to payload that you used

@sportspitch546 3 жыл бұрын

Everytime when the attack is over it is showing unable to render response. Do you know how to fix it?

@hariprasadhbrr 3 жыл бұрын

Clearly explained, easy to understand :)

@WebWonders1 3 жыл бұрын

Nice video

@emilioortega9487 3 жыл бұрын

why do I get status code 419 after a while ? Im testing a localhost application made in laravel

@ArifAsyraf_ 2 жыл бұрын

why is mine still error at attempts #39??

@thegipset5327 3 жыл бұрын

Hey Tim!:)

@bencebiro6421 2 жыл бұрын

What can I do, when metasploit's ip address doesn't load if it is directly enterd into the search box?

@santy00_ 3 жыл бұрын

do u use a linux system or vm for linux

@bekiabdi5230 3 жыл бұрын

Let's appreciate that they never click bait us

@travisvossler 3 жыл бұрын

Wow y'all are good

@CircuitFrame 3 жыл бұрын

This is super hard to find out there in the wild these days, but thanks for sharing

@georgeorwell2147 2 жыл бұрын

Man back when I was into computers in 2010 every 3 or 4 sites this would work on with more advanced SQLI techniques

@scriptkiddie6151 3 жыл бұрын

Why would someone use 3 adblocking extensions?

@mrobvious6112 3 жыл бұрын

it kinda sucks because the connection using the proxy will have problem or error, getting to youtube as an example will be an error

@sammedbanu8962 3 жыл бұрын

i think null byte has some sort of mind reading power so that what i want ro learn becames a vedio here

@Rocmax417 3 жыл бұрын

It says that this video is unavailable on this device. I can watch any other video if yours but this do you know why?

@NullByteWHT 3 жыл бұрын

Thanks I'll look into it, I don't know why it would do that.

@rastislavkrahenbil2850 3 жыл бұрын

Big plus for splunk sticker. 👍

@isuk 2 жыл бұрын

I have a question. How would you know if you were successful with an sql injection without going through each and every payload

@mehdilotfi4080 Жыл бұрын

simple, you have the length of request html in intruder attack... filter by that

@TalesGrimm 3 жыл бұрын

I always get sceptical when people say "Es Queue El"

@rodricbr 3 жыл бұрын

same lol

@arxidi446 3 жыл бұрын

I love you man

@Farhan_B 3 жыл бұрын

Kodi come backkk we missing ur no blink challenge videos

@ehercitosiastres7691 3 жыл бұрын

Nice

@mobilegaming1844 3 жыл бұрын

Please I can't understand how can I attack websites I don't know, you put your ip address and you attacked can I put website ip address instead of your ip address

@akshayarjun8325 2 жыл бұрын

So we need to RENDER each and every username ?? That's like finding a needle in haystack.

@002jhon1st 3 жыл бұрын

How about a full Tutortials in begginers like me :) what app do you use in PC? Is it Termux or Kali?

@NoName-mt6xu 3 жыл бұрын

geez i m juat learning how to use print on python and to come till this position it will take me whole eternity 😂😂

@njpromethium 3 жыл бұрын

it's pretty easy stuff. Keep it up for a few years and you'll be more than enough to do understand these vids.

@abbasleaders5214 Жыл бұрын

that sql.txt list didn't work for me.

@ahongahong1496 2 жыл бұрын

Does not work

@kingsahil-brawlstars3118 3 жыл бұрын

Can we boot Kali Linux on raspberry pi and do these stuff ?

@spencerreppe7558 3 жыл бұрын

Yes, www.kali.org/docs/arm/kali-linux-raspberry-pi/

@ayoubchabbi5965 3 жыл бұрын

how make mastercard for free please I need

@iiknow1133 3 жыл бұрын

Greate👏👏

@realhomy 3 жыл бұрын

Great*

@a2zandroid44 3 жыл бұрын

❤️ good

@rathnakumar4587 3 жыл бұрын

what if the security level of the mutillidae is increased.

@statudem8360 3 жыл бұрын

Good question

@potatoboi4872 3 жыл бұрын

Well, the video is down, that was fast.

@InfinitySiam 3 жыл бұрын

🔥

@SeedsAndStuff 3 жыл бұрын

Lime wire for hackers

@trinity2725 3 жыл бұрын

This guys Is better than that creepy guy who doesn't blink 😬😬😬

@vichua7052 3 жыл бұрын

How to use owpsa tool

@NullByteWHT 3 жыл бұрын

Good idea vichu A, I've added it to the list of video ideas.

@shivaurmaliya70 3 жыл бұрын

Sir please make a detailed video on "remote code execution vulnerability"

@7DuRd3n 3 жыл бұрын

I am at the point where I think Kody has been kidnapped

@amudharamachandran2540 3 жыл бұрын

🙏

@mohammedahzam2 2 жыл бұрын

@emmaanderson8710 3 жыл бұрын

is there a link to the list of sql injections

@pepemunic3661 3 жыл бұрын

google and others

@BabangidaVEVO 3 жыл бұрын

ext:txt intext:" or 1=1"

@deepeddyrecords5933 3 жыл бұрын

At 5:14 in the video, you can see the URL.

@emmaanderson8710 3 жыл бұрын

@@deepeddyrecords5933 im lazy

@deepeddyrecords5933 3 жыл бұрын

@@emmaanderson8710 Good luck with that!

@jacksama6536 3 жыл бұрын

Which laptop is best for hacking

@cryptofantasy4570 3 жыл бұрын

I got an issue its saying embedded "browser initialization failed" in the brup Can anyone help me with this?

@anngustang1158 3 жыл бұрын

me too. Do you have a solution yet

@javiporras3396 3 жыл бұрын

@@anngustang1158 the same here.... :(

@jasonmikinskiwallet4308 3 жыл бұрын

I prefer the other guy that doesn't blink. Sorry dude, the video was good! Just at the beginning you were reading lol. Maybe your lines. Anyways good Video.

@ohaedhala7535 3 жыл бұрын

ارجوك نريد ترجمه بلعربية

@PouriyaJamshidi 3 жыл бұрын

masking your link-local IPv6 is just absurd.

@Rafa-xi2gr 3 жыл бұрын

his face look like MrBeast

@kashifbari8223 2 жыл бұрын

Your demonstration looks very complicated and makes me confused because you are using multiple tools at the same time for one target. Can you please make it easier please??

@martonlee 3 жыл бұрын

SELECT username, password FROM users WHERE username='' or 1=1--' AND password='';

@martonlee 3 жыл бұрын

and never store passwords as plain text

@anonymous-vd2oj 3 жыл бұрын

kody retired or what

@snowdoxsecurity8486 3 жыл бұрын

Check the securityfwd YT channel

@agrodpodnk7054 3 жыл бұрын

Are you guys white hat hacker?

@Motivationforyoungs 3 жыл бұрын

hihh

@bodegauno1325 11 ай бұрын

Always the same, Php and MySQL database with no security 😒… Why not to test this against an Angular front end - .Net - SQL server ?

@Mrxuxukarap 3 жыл бұрын

more of the comment about eye blink.. What the f**k are doing??

@ohaedhala7535 3 жыл бұрын

Please we want to translate it into Arabic

@TheBankofNewYorkCompanyInc. 3 жыл бұрын

It's mr beast... the evil mr beast

@dyonisisthehighlander8460 3 жыл бұрын

First!

@adamissa7699 2 жыл бұрын

Hey everyone, This is Adam. I am an MSc student doing some research on the threats and opportunities of promoting hacking-related knowledge online. I would very much appreciate your participation guys by answering the following questions. Q1: Should hacking be taught? Q2: What motivate you to follow and watch this content? Q3: Are you benefiting (careerwise) from watching these videos? Q4: What are the risks and opportunities of making cybersecurity knowledge accessible with a worldwide audience?

@elvisjude190 3 жыл бұрын

second

@realhomy 3 жыл бұрын

Third

@muhammadadnan1430 3 жыл бұрын

Man, please drop the music in the future. It's distracting.

@ohaedhala7535 3 жыл бұрын

Please we want to translate it into Arabic 👍👍👍👍

@mackerrop7398 3 жыл бұрын

use StackOverflow smh

@musti8353 3 жыл бұрын

Show us how we can hack social media accounts. Instagrams etc..

@user-lt2rw5nr9s 3 жыл бұрын

Password reuse via leaked databases. It's not a clear cut question, since there are other means to do that. That might look like phishing, key logging, RATing.

@Sundaydike 3 жыл бұрын

I have Burpsuite but when I turn on intercept my browser will run very slow,pls what’s problem?

@efou-bouloub2447 Жыл бұрын

u only have to turn on intercept when ur trying to intercept