Tag Info

New answers tagged

2

It's possible to perform a SQL injection attack anywhere that the system places user defined data (in this case the username) directly into a SQL query without first sanitising it. So, the answer to your question is yes, it is possible, depending on the behaviour of the system in question.


1

The answer is "no" it can't be done, at least not with a directory traversal attack by itself. There are several issues here. 1) Directory traversal attacks should be blocked by the Web server to begin with. Of course, since you set up a lab environment, you have control and may have defeated the protection against it. 2) Directory traversal attacks like ...



Top 50 recent answers are included