#sqli — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #sqli, aggregated by home.social.
-
El lado del mal - Un "Hardening Tip" de BBDD - de mi Lost & Found - contra las "Heavy Queries Malignas" https://elladodelmal.com/2026/04/un-hardening-tip-de-bbdd-de-mi-lost.html #SQLi #hardening #BBDD #HeavyQueries #SQL
-
Published the writeup for the authenticated SQL injection vulnerability in Kanboard - CVE-2026-33058.
https://0dave.ch/posts/cve-2026-33058/
https://www.cve.org/CVERecord?id=CVE-2026-33058
https://github.com/kanboard/kanboard/security/advisories/GHSA-f62r-m4mr-2xhh -
Latest lab write-up. Came out a bit long but very informative.
https://medium.com/@marduk.i.am/blind-sql-injection-with-conditional-responses-46ee90b5f2c0
#BugBounty #bugbountytips #SQL #SQLI #injection #informationsecurity #Portswigger
-
It's been a while but here is another SQLi lab. Enjoy!
#BugBounty #bugbountytips #SQL #SQLI #injection #informationsecurity #PortswiggerLabs
-
I wrote a quick #blogpost on #ntlm authentication with #sqlmap using #burpsuite proxy.
https://bbence.me/blog/2025-03-09_ntlm_auth/
I did this as a workaround, since the `python-ntlm` package that SQLMap wants still uses Python 2's syntax for some reason and SQLMap does not like that.
-
Completed the SQLMap Essentials module on HTB Academy. The skills assessment was quite tough, but solid practice. Moving on.
https://academy.hackthebox.com/achievement/922218/58
#hackthebox #htbacademy #cybersecurity #sqli #sqlmap #sqlinjection #bugbounty #learningjourney
-
Last in a series of 3 labs. Enjoy
#BugBounty #bugbountytips #SQL #SQLI #injection #informationsecurity #PortswiggerLabs
-
And now the last talk before the afternoon break is Paul Gerste of Sonar who will show us that SQL-i #sqli isn’t dead in “SQL injection isn’t dead: Smuggling Queries at the Protocol level” at, of course, @hack_lu #hacklu2024
-
Happening 15:30: "SQL Injection Isn't Dead: Smuggling Queries at the Protocol Level"
-
I also found some fun things in the general Ivanti area 🥳
They're not as cool as other people's, but hey... I'll take it. CVE-2023-46807 and CVE-2023-46806 were published just a moment ago.
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46807
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-46806
-
Found a great #opensource tool to scan sites for a laundry list of vulnerabilities https://github.com/h4r5h1t/webcopilot.
Just used it to scan all my company domains, works great!
The tools integrated into this single app are the same tools "security researchers" use to scan sites for #xss #SQLi #ssrf #crlf #lfi #subdomaintakeover #openredirect, etc. vulnerabilities - into a single CLI tool.
Can also help avoid/confirm those "beg-bounty" situations where a simple misconfiguration is touted as a "critical vulnerability" because someone use a quick scanning tool to determine that sub-domain take-over is possible (very common, not critical, easy to fix), or missing DMARC records are present (which 98% of all Internet sites have issues with, and is very easy to fix) to demand a cash reward so they can "share additional critical vulnerabilities" that aren't a thing - they just want money.
Have fun!
-
👉 #SOC2, #ISO270001, #PCI, and other regional laws require you to have a clean, zero-vulnerability report.
That said, even critical vulnerabilities take 250+ days to patch, especially when these exist in third-party plug-ins, open-source libraries, or legacy code.
Compounding the problem are #zerodayvulnerabilities like the MOVEit SQLi, Zimbra XSS, and 300+ such vulnerabilities that get discovered each month.
Delays in fixing these #vulnerabilities lead to compliance issues and worse exploits, leading to loss of data/reputation and business.
To help app sec teams, we are launching a unique feature on #AppTrana that’ll help you get a “Zero vulnerability report” within 72 hours.
In the upcoming webinar, join Vivekanand Gopalan, VP of Product at Indusface, as he discusses the inner workings of this release, including:
- Onboarding: The onboarding process on AppTrana
- Application Audit: The audit process that uncovers vulnerabilities
- Tuning: Development of application specific patches to virtually patch all vulnerabilities
- Revalidation: The final revalidation report that gives you a clean, zero vulnerability report for all your compliance requirements
To register for this event: https://bit.ly/3vrl3Ef
#0day #moveit #sqli, #xss #applicationsecurity #applicationaudit #virtualpatching #compliance #appsec
