{"id":137,"date":"2021-10-06T21:43:49","date_gmt":"2021-10-06T20:43:49","guid":{"rendered":"http:\/\/localhost\/wordpress\/?p=137"},"modified":"2021-10-06T22:26:50","modified_gmt":"2021-10-06T21:26:50","slug":"sql-injections-showcase","status":"publish","type":"post","link":"http:\/\/localhost\/wordpress\/2021\/10\/06\/sql-injections-showcase\/","title":{"rendered":"SQL Injections showcase"},"content":{"rendered":"\n<p>This is my winning solution for a faculty <span style=\"color:#149414\" class=\"has-inline-color\"><em>SQL Injection<\/em> contest<\/span> I participated in 2021.<\/p>\n\n\n\n<p>The main challenge was to find <em>inventive and playful<\/em> ways to <span style=\"color:#149414\" class=\"has-inline-color\">exploit<\/span> database connected applications that are <span style=\"color:#149414\" class=\"has-inline-color\">vulnerable<\/span> to this kind of attack. <\/p>\n\n\n\n<p>Therefore, I used two applications: <a rel=\"noreferrer noopener\" href=\"https:\/\/github.com\/StefanCsPurge\/Web-Programming\/tree\/main\/9%20SHCarsWebsite_-_Angular_ASP_NET_API\" data-type=\"URL\" data-id=\"https:\/\/github.com\/StefanCsPurge\/Web-Programming\/tree\/main\/9%20SHCarsWebsite_-_Angular_ASP_NET_API\" target=\"_blank\">one that was entirely coded by me<\/a>, and the other being a vulnerable webservice hosted on a Linux server. It was fun <span style=\"color:#149414\" class=\"has-inline-color\">( \u0361\u00b0 \u035c\u0296 \u0361\u00b0)<\/span> .<\/p>\n\n\n\n<p>Below is the complete description of the exploitation process \/ write-up.<\/p>\n\n\n\n<figure class=\"wp-block-image alignwide size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"791\" height=\"1024\" src=\"http:\/\/localhost\/wordpress\/wp-content\/uploads\/2021\/10\/completeDescriptionSQLInj_page-0001-791x1024.jpg\" alt=\"\" class=\"wp-image-151\" srcset=\"http:\/\/localhost\/wordpress\/wp-content\/uploads\/2021\/10\/completeDescriptionSQLInj_page-0001-791x1024.jpg 791w, http:\/\/localhost\/wordpress\/wp-content\/uploads\/2021\/10\/completeDescriptionSQLInj_page-0001-232x300.jpg 232w, http:\/\/localhost\/wordpress\/wp-content\/uploads\/2021\/10\/completeDescriptionSQLInj_page-0001-768x994.jpg 768w, http:\/\/localhost\/wordpress\/wp-content\/uploads\/2021\/10\/completeDescriptionSQLInj_page-0001-1187x1536.jpg 1187w, http:\/\/localhost\/wordpress\/wp-content\/uploads\/2021\/10\/completeDescriptionSQLInj_page-0001.jpg 1275w\" sizes=\"(max-width: 791px) 100vw, 791px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image alignwide size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"791\" height=\"1024\" src=\"http:\/\/localhost\/wordpress\/wp-content\/uploads\/2021\/10\/completeDescriptionSQLInj_page-0002-791x1024.jpg\" alt=\"\" class=\"wp-image-152\" srcset=\"http:\/\/localhost\/wordpress\/wp-content\/uploads\/2021\/10\/completeDescriptionSQLInj_page-0002-791x1024.jpg 791w, http:\/\/localhost\/wordpress\/wp-content\/uploads\/2021\/10\/completeDescriptionSQLInj_page-0002-232x300.jpg 232w, http:\/\/localhost\/wordpress\/wp-content\/uploads\/2021\/10\/completeDescriptionSQLInj_page-0002-768x994.jpg 768w, http:\/\/localhost\/wordpress\/wp-content\/uploads\/2021\/10\/completeDescriptionSQLInj_page-0002-1187x1536.jpg 1187w, http:\/\/localhost\/wordpress\/wp-content\/uploads\/2021\/10\/completeDescriptionSQLInj_page-0002.jpg 1275w\" sizes=\"(max-width: 791px) 100vw, 791px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image alignwide size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"791\" height=\"1024\" src=\"http:\/\/localhost\/wordpress\/wp-content\/uploads\/2021\/10\/completeDescriptionSQLInj_page-0003-791x1024.jpg\" alt=\"\" class=\"wp-image-153\" srcset=\"http:\/\/localhost\/wordpress\/wp-content\/uploads\/2021\/10\/completeDescriptionSQLInj_page-0003-791x1024.jpg 791w, http:\/\/localhost\/wordpress\/wp-content\/uploads\/2021\/10\/completeDescriptionSQLInj_page-0003-232x300.jpg 232w, http:\/\/localhost\/wordpress\/wp-content\/uploads\/2021\/10\/completeDescriptionSQLInj_page-0003-768x994.jpg 768w, http:\/\/localhost\/wordpress\/wp-content\/uploads\/2021\/10\/completeDescriptionSQLInj_page-0003-1187x1536.jpg 1187w, http:\/\/localhost\/wordpress\/wp-content\/uploads\/2021\/10\/completeDescriptionSQLInj_page-0003.jpg 1275w\" sizes=\"(max-width: 791px) 100vw, 791px\" \/><\/figure>\n\n\n\n<figure class=\"wp-block-image alignwide size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"678\" src=\"http:\/\/localhost\/wordpress\/wp-content\/uploads\/2021\/10\/ALL_DB_schema-1024x678.png\" alt=\"\" class=\"wp-image-147\" srcset=\"http:\/\/localhost\/wordpress\/wp-content\/uploads\/2021\/10\/ALL_DB_schema-1024x678.png 1024w, http:\/\/localhost\/wordpress\/wp-content\/uploads\/2021\/10\/ALL_DB_schema-300x199.png 300w, http:\/\/localhost\/wordpress\/wp-content\/uploads\/2021\/10\/ALL_DB_schema-768x508.png 768w, http:\/\/localhost\/wordpress\/wp-content\/uploads\/2021\/10\/ALL_DB_schema.png 1511w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption>DB schema<\/figcaption><\/figure>\n\n\n\n<p>The Github repo for this solution can be found <a href=\"https:\/\/github.com\/StefanCsPurge\/Databases\/tree\/main\/SQL%20Injections%20showcase\" data-type=\"URL\" data-id=\"https:\/\/github.com\/StefanCsPurge\/Databases\/tree\/main\/SQL%20Injections%20showcase\" target=\"_blank\" rel=\"noreferrer noopener\">here<\/a>.<\/p>\n\n\n\n<p>The above PDF and video demo can be found <a href=\"https:\/\/drive.google.com\/drive\/folders\/1svT-g4Nj4H5FY8-KSorNLEh5p0738txr\" data-type=\"URL\" data-id=\"https:\/\/drive.google.com\/drive\/folders\/1svT-g4Nj4H5FY8-KSorNLEh5p0738txr\" target=\"_blank\" rel=\"noreferrer noopener\">here<\/a>. <\/p>\n","protected":false},"excerpt":{"rendered":"<p>This is my winning solution for a faculty SQL Injection contest I participated in 2021. The main challenge was to<\/p>\n<p><a href=\"http:\/\/localhost\/wordpress\/2021\/10\/06\/sql-injections-showcase\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\">SQL Injections showcase<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[9,7,6,12,5,8,11],"class_list":["post-137","post","type-post","status-publish","format-standard","hentry","category-information-security","tag-badstore","tag-cybersecurity","tag-hack","tag-loginbypass","tag-sqlinjection","tag-webvulnerability","tag-vulnerability"],"_links":{"self":[{"href":"http:\/\/localhost\/wordpress\/wp-json\/wp\/v2\/posts\/137"}],"collection":[{"href":"http:\/\/localhost\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/localhost\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/localhost\/wordpress\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/localhost\/wordpress\/wp-json\/wp\/v2\/comments?post=137"}],"version-history":[{"count":9,"href":"http:\/\/localhost\/wordpress\/wp-json\/wp\/v2\/posts\/137\/revisions"}],"predecessor-version":[{"id":155,"href":"http:\/\/localhost\/wordpress\/wp-json\/wp\/v2\/posts\/137\/revisions\/155"}],"wp:attachment":[{"href":"http:\/\/localhost\/wordpress\/wp-json\/wp\/v2\/media?parent=137"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/localhost\/wordpress\/wp-json\/wp\/v2\/categories?post=137"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/localhost\/wordpress\/wp-json\/wp\/v2\/tags?post=137"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}