How a Hacker Could Attack Web Apps with Burp Suite & SQL Injection

[@kristiannn]

2:31 - sql challenge 2:57 - proxy settings 3:50 - burp suite

[@krah8052]

This lab will work but it does require a work around at the very end when using Kali. The request will not render using the built in Burb Suite browser. The solution is to click on the Actions button inside the Render window and select, "show response in browser." Paste the copied URL in your browser address bar to see your results. Still a great lab! Thanks!

[@ellie8309]

they updated their robots to blink😏

[@realhomy]

Fr

[@vijaySingle143]

They are extraterrestrials living among humans to teach and educate and develop us.

[@Rhidayah]

This is alpha version with update patch: - added blink every 1 minute

[@tomashublik5586]

Everytime i'm about to learn something, you publish video about it. Thank you so much 👍

[@labu1905]

How can we find passwords without rendering page?

[@deepeddyrecords5933]

This is an excellent demonstration. Question: You said that you knew that request #39 worked. When you scrolled through the attempts, #39 (6:19 in the video) looked just like the others (same 200 status, slightly larger size). So how did you find out that that was the one? Is it the length (25599)? It's larger than the others on the screen, but we haven't seen all of the lengths. Or did you just start clicking them one at a time until you found the right one? That would seem rather tedious. Thanks!

[@razexrazex]

In burp option you can add grep match for specific word , you add custom word from error failed login example bad password etc... And then you could filter even if all responds 200 ok

[@deepeddyrecords5933]

@@razexrazex Thank you! I'll try that.

[@Rocmax417]

It says that this video is unavailable on this device. I can watch any other video if yours but this do you know why?

[@NullByteWHT]

Thanks I'll look into it, I don't know why it would do that.

[@ArifAsyraf_]

why is mine still error at attempts #39??

[@isuk]

I have a question. How would you know if you were successful with an sql injection without going through each and every payload

[@mehdilotfi4080]

simple, you have the length of request html in intruder attack... filter by that

[@jyotirmaysengupta2360]

I really needed this! Thanks for the info!

[@mrobvious6112]

it kinda sucks because the connection using the proxy will have problem or error, getting to youtube as an example will be an error

[@nirmaltech2043]

If used PDO or Prepared statement in web app is it still possible too do.

[@sportspitch546]

Everytime when the attack is over it is showing unable to render response. Do you know how to fix it?

[@fernandoblanco3590]

Thanks guys, I am a huge fan of you.

[@seijuru]

The response render is not working not showing? did i miss something?

[@mrfaxine6462]

hi , i have MOZILLA_PKIX_ERROR_MITM_DETECTED error with mozila when i put connection setting same as you , traffic do not intercept and webpage was blocked , do you have a clue for that?

[@scriptkiddie6151]

Why would someone use 3 adblocking extensions?

[@santy00_]

do u use a linux system or vm for linux

[@TalesGrimm]

I always get sceptical when people say "Es Queue El"

[@rodricbr]

same lol

[@bencebiro6421]

What can I do, when metasploit's ip address doesn't load if it is directly enterd into the search box?

[@tevainuiweza2420]

where did he get that sql injections .txt file from? I cannot find it anywhere in githib

[@CircuitFrame]

This is super hard to find out there in the wild these days, but thanks for sharing

[@georgeorwell2147]

Man back when I was into computers in 2010 every 3 or 4 sites this would work on with more advanced SQLI techniques

[@exclusivegamer9124]

Hey bro can you give me link to payload that you used

[@bekiabdi5230]

Let's appreciate that they never click bait us

[@TheJonesin666]

Great video!! I'm new to pen testing (2 weeks ha ha) and found this to be very useful! One question, say I had a list of one million variations - arbitrary number, of course. Do you have to click through each one? What is the quickest way to achieve find this from a 1,000,000 request test? Thanks again!

[@sammedbanu8962]

i think null byte has some sort of mind reading power so that what i want ro learn becames a vedio here

[@kingsahil-brawlstars3118]

Can we boot Kali Linux on raspberry pi and do these stuff ?

[@spencerreppe7558]

Yes, www.kali.org/docs/arm/kali-linux-raspberry-pi/

[@Farhan_B]

Kodi come backkk we missing ur no blink challenge videos

[@someone552005]

Timely post, was just looking into doing this with burp, and someone sent me the link.

[@emilioortega9487]

why do I get status code 419 after a while ? Im testing a localhost application made in laravel

[@Ms.Robot.]

Oh nisssse ❤💋. Perfect. Keep the tools tuts coming!

[@maninderjudge298]

💋

[@ahongahong1496]

Does not work

[@rathnakumar4587]

what if the security level of the mutillidae is increased.

[@statudem8360]

Good question

[@Sundaydike]

I have Burpsuite but when I turn on intercept my browser will run very slow,pls what’s problem?

[@efou-bouloub2447]

u only have to turn on intercept when ur trying to intercept

[@mobilegaming1844]

Please I can't understand how can I attack websites I don't know, you put your ip address and you attacked can I put website ip address instead of your ip address

[@abbasleaders5214]

that sql.txt list didn't work for me.

[@hackingismylife2167]

Nice help all learner

[@sayooj5873]

This was helpful. Thank you

[@acronproject]

Thanks for this useful tutorial

[@akshayarjun8325]

So we need to RENDER each and every username ?? That's like finding a needle in haystack.

[@alexvillarreal3947]

thanks alot bro ... this so useful and really great explanation

[@Carisma2012]

your help is very helpful

[@rastislavkrahenbil2850]

Big plus for splunk sticker. 👍

[@002jhon1st]

How about a full Tutortials in begginers like me :) what app do you use in PC? Is it Termux or Kali?

[@curtistackie7459]

easy and helpful

[@erfanbaghchedan9104]

thanks it was helpful

[@ayoubchabbi5965]

how make mastercard for free please I need

[@hamzakarakaya5442]

We done, informative video sir

[@vichua7052]

How to use owpsa tool

[@NullByteWHT]

Good idea vichu A, I've added it to the list of video ideas.

[@hariprasadhbrr]

Clearly explained, easy to understand :)

[@1matroska]

thanks for this course!

[@travisvossler]

Wow y'all are good

[@potatoboi4872]

Well, the video is down, that was fast.

[@SeedsAndStuff]

Lime wire for hackers

[@WebWonders1]

Nice video

[@kashifbari8223]

Your demonstration looks very complicated and makes me confused because you are using multiple tools at the same time for one target. Can you please make it easier please??

[@Rafa-xi2gr]

his face look like MrBeast

[@thegipset5327]

Hey Tim!:)

[@NoName-mt6xu]

geez i m juat learning how to use print on python and to come till this position it will take me whole eternity 😂😂

[@njpromethium]

it's pretty easy stuff. Keep it up for a few years and you'll be more than enough to do understand these vids.

[@trinity2725]

This guys Is better than that creepy guy who doesn't blink 😬😬😬

[@realhomy]

Yessir another new video

[@arxidi446]

I love you man

[@nemielolxd]

is there a link to the list of sql injections

[@pepemunic3661]

google and others

[@BabangidaVEVO]

ext:txt intext:" or 1=1"

[@deepeddyrecords5933]

At 5:14 in the video, you can see the URL.

[@nemielolxd]

@@deepeddyrecords5933 im lazy

[@deepeddyrecords5933]

@@nemielolxd Good luck with that!

[@PouriyaJamshidi]

masking your link-local IPv6 is just absurd.

[@jacksama6536]

Which laptop is best for hacking

[@jasonmikinskiwallet4308]

I prefer the other guy that doesn't blink. Sorry dude, the video was good! Just at the beginning you were reading lol. Maybe your lines. Anyways good Video.

[@ehercitosiastres7691]

Nice

[@cryptofantasy4570]

I got an issue its saying embedded "browser initialization failed" in the brup Can anyone help me with this?

[@anngustang1158]

me too. Do you have a solution yet

[@javiporras3396]

@@anngustang1158 the same here.... :(

[@martonlee]

SELECT username, password FROM users WHERE username='' or 1=1--' AND password='';

[@martonlee]

and never store passwords as plain text

[@anonymous-vd2oj]

kody retired or what

[@snowdoxsecurity8486]

Check the securityfwd YT channel

[@agrodpodnk7054]

Are you guys white hat hacker?

[@mohammedahzam2]

hi

[@iiknow1133]

Greate👏👏

[@realhomy]

Great*

[@shivaurmaliya70]

Sir please make a detailed video on "remote code execution vulnerability"

[@ohaedhala7535]

ارجوك نريد ترجمه بلعربية

[@a2zandroid44]

❤️ good

[@bodegauno1325]

Always the same, Php and MySQL database with no security 😒… Why not to test this against an Angular front end - .Net - SQL server ?

[@adamissa7699]

Hey everyone, This is Adam. I am an MSc student doing some research on the threats and opportunities of promoting hacking-related knowledge online. I would very much appreciate your participation guys by answering the following questions. Q1: Should hacking be taught? Q2: What motivate you to follow and watch this content? Q3: Are you benefiting (careerwise) from watching these videos? Q4: What are the risks and opportunities of making cybersecurity knowledge accessible with a worldwide audience?

[@InfinitySiam]

🔥

[@Mrxuxukarap]

more of the comment about eye blink.. What the f**k are doing??

[@ibrahimgambo4904]

gud

[@TheBankofNewYorkCompanyInc.]

It's mr beast... the evil mr beast

[@amudharamachandran2540]

🙏

[@ohaedhala7535]

Please we want to translate it into Arabic

[@Motivationforyoungs]

hihh

[@ohaedhala7535]

Please we want to translate it into Arabic 👍👍👍👍

[@muhammadadnan1430]

Man, please drop the music in the future. It's distracting.

[@musti8353]

Show us how we can hack social media accounts. Instagrams etc..

[@user-lt2rw5nr9s]

Password reuse via leaked databases. It's not a clear cut question, since there are other means to do that. That might look like phishing, key logging, RATing.

[@elvisjude190]

second

[@realhomy]

Third

[@mackerrop7398]

use StackOverflow smh

[@dyonisisthehighlander8460]

First!

[@Sundaydike]

I have Burpsuite but when I turn on intercept my browser will run very slow,pls what’s problem?