New answers tagged sql-injection
I really dont understand the point. What do you gain from hacking sites with no value whatsoever, as oppose to targeting a specific site, and then trying? Try acunetix, I believe that can scan multiple targets. If you can't find one, then why not write one yourself in a language you like?
did you try sqlmap? just do a simple google search for CLI linux sqli tools and write your own bash/python/ruby/whatever script to loop throw the list of domains and to output the result to a database.. hope this give you ideas.. there are many.
SQL map uses the flaws in the application to interact with the DB. It still has to adhere to the DB rules, e.g. if the vulnerable application only has access to 1 database, SQLmap will only be able to interact with that database and so on.
You can insert a subquery in place of the injection point. For starters in case of mysql Select concat(version(),user(),database()) Select grantee from information_schema.USER_PRIVILEGES Also check out for sql-map tool
oh you're so close, it's ./sqlmap.py -u http://example.com --tables
I answer my own question thanks to @SilverlightFox. MySQL has two modes it can operate: STRICT_TRANS_TABLES and STRICT_ALL_TABLES and quoting MySQL doc: Strict mode controls how MySQL handles invalid or missing values in data-change statements such as INSERT or UPDATE. A value can be invalid for several reasons. For example, it might have the wrong data ...
Top 50 recent answers are included