7MS #376: Tales of SQL Injection Pwnage

Today's episode is brought to you by ITProTV. It’s never too late to start a new career in IT or move up the ladder, and ITProTV has you covered - from CompTIA and Cisco to EC-Council and VMWare. Get over 65 hours of IT training for free by visiting https://itpro.tv/7minute. We cover a lot of ground today on a variety of topics: I have an Oculus Quest now and I love it. My handle is turdsquirt if you ever wanna shoot some zombies together. I share a story that yes, does involve poop - but only the mention of it. It's nothing like the epic tale (tail?) of my parents' dog pooping in my son's dresser drawers. I had a really fun pentest recently where I found some good old school SQL injection. I took to Slack to share and since then, several of you have reached out to ask how I found the vulnerability. Here are some steps/tips I talk about on today's episode that will help: Watch Sunny's Burp courses on Pluralsight to enhance your Burp abilities Install CO2 from the BApp store When doing a Web app pentest, feed various fields SQL injection payloads, such as the ones in PayloadsAlltheThings Grab a copy of sqlmap Use sites like this one to help tune your sqlmap commands to find vulnerabilities. In the end, my command I used to dump contents of important tables was this: (See today's show notes on the 7MS Web site for more information!)