How a Hacker Could Attack Web Apps with Burp Suite & SQL Injection

[@tomashublik5586]

Everytime i'm about to learn something, you publish video about it. Thank you so much 👍

[@kristiannn]

2:31 - sql challenge 2:57 - proxy settings 3:50 - burp suite

[@krah8052]

This lab will work but it does require a work around at the very end when using Kali. The request will not render using the built in Burb Suite browser. The solution is to click on the Actions button inside the Render window and select, "show response in browser." Paste the copied URL in your browser address bar to see your results. Still a great lab! Thanks!

[@ellie8309]

they updated their robots to blink😏

[@realhomy]

Fr

[@vijaySingle143]

They are extraterrestrials living among humans to teach and educate and develop us.

[@Rhidayah]

This is alpha version with update patch: - added blink every 1 minute

[@deepeddyrecords5933]

This is an excellent demonstration. Question: You said that you knew that request #39 worked. When you scrolled through the attempts, #39 (6:19 in the video) looked just like the others (same 200 status, slightly larger size). So how did you find out that that was the one? Is it the length (25599)? It's larger than the others on the screen, but we haven't seen all of the lengths. Or did you just start clicking them one at a time until you found the right one? That would seem rather tedious. Thanks!

[@razexrazex]

In burp option you can add grep match for specific word , you add custom word from error failed login example bad password etc... And then you could filter even if all responds 200 ok

[@deepeddyrecords5933]

@@razexrazex Thank you! I'll try that.

[@jyotirmaysengupta2360]

I really needed this! Thanks for the info!

[@labu1905]

How can we find passwords without rendering page?

[@fernandoblanco3590]

Thanks guys, I am a huge fan of you.

[@Rocmax417]

It says that this video is unavailable on this device. I can watch any other video if yours but this do you know why?

[@NullByteWHT]

Thanks I'll look into it, I don't know why it would do that.

[@ArifAsyraf_]

why is mine still error at attempts #39??

[@isuk]

I have a question. How would you know if you were successful with an sql injection without going through each and every payload

[@mehdilotfi4080]

simple, you have the length of request html in intruder attack... filter by that

[@TalesGrimm]

I always get sceptical when people say "Es Queue El"

[@rodricbr]

same lol

[@Ms.Robot.]

Oh nisssse ❤💋. Perfect. Keep the tools tuts coming!

[@maninderjudge298]

💋

[@CircuitFrame]

This is super hard to find out there in the wild these days, but thanks for sharing

[@georgeorwell2147]

Man back when I was into computers in 2010 every 3 or 4 sites this would work on with more advanced SQLI techniques

[@alexvillarreal3947]

thanks alot bro ... this so useful and really great explanation

[@tevainuiweza2420]

where did he get that sql injections .txt file from? I cannot find it anywhere in githib

[@sayooj5873]

This was helpful. Thank you

[@TheJonesin666]

Great video!! I'm new to pen testing (2 weeks ha ha) and found this to be very useful! One question, say I had a list of one million variations - arbitrary number, of course. Do you have to click through each one? What is the quickest way to achieve find this from a 1,000,000 request test? Thanks again!

[@nirmaltech2043]

If used PDO or Prepared statement in web app is it still possible too do.

[@bekiabdi5230]

Let's appreciate that they never click bait us

[@seijuru]

The response render is not working not showing? did i miss something?

[@mrfaxine6462]

hi , i have MOZILLA_PKIX_ERROR_MITM_DETECTED error with mozila when i put connection setting same as you , traffic do not intercept and webpage was blocked , do you have a clue for that?

[@acronproject]

Thanks for this useful tutorial

[@mrobvious6112]

it kinda sucks because the connection using the proxy will have problem or error, getting to youtube as an example will be an error

[@exclusivegamer9124]

Hey bro can you give me link to payload that you used

[@sportspitch546]

Everytime when the attack is over it is showing unable to render response. Do you know how to fix it?

[@sammedbanu8962]

i think null byte has some sort of mind reading power so that what i want ro learn becames a vedio here

[@someone552005]

Timely post, was just looking into doing this with burp, and someone sent me the link.

[@emilioortega9487]

why do I get status code 419 after a while ? Im testing a localhost application made in laravel

[@bencebiro6421]

What can I do, when metasploit's ip address doesn't load if it is directly enterd into the search box?

[@santy00_]

do u use a linux system or vm for linux

[@scriptkiddie6151]

Why would someone use 3 adblocking extensions?

[@kingsahil-brawlstars3118]

Can we boot Kali Linux on raspberry pi and do these stuff ?

[@spencerreppe7558]

Yes, www.kali.org/docs/arm/kali-linux-raspberry-pi/

[@hamzakarakaya5442]

We done, informative video sir

[@rathnakumar4587]

what if the security level of the mutillidae is increased.

[@statudem8360]

Good question

[@Sundaydike]

I have Burpsuite but when I turn on intercept my browser will run very slow,pls what’s problem?

[@efou-bouloub2447]

u only have to turn on intercept when ur trying to intercept

[@Farhan_B]

Kodi come backkk we missing ur no blink challenge videos

[@ahongahong1496]

Does not work

[@Carisma2012]

your help is very helpful

[@abbasleaders5214]

that sql.txt list didn't work for me.

[@vichua7052]

How to use owpsa tool

[@NullByteWHT]

Good idea vichu A, I've added it to the list of video ideas.

[@akshayarjun8325]

So we need to RENDER each and every username ?? That's like finding a needle in haystack.

[@mobilegaming1844]

Please I can't understand how can I attack websites I don't know, you put your ip address and you attacked can I put website ip address instead of your ip address

[@hackingismylife2167]

Nice help all learner

[@rastislavkrahenbil2850]

Big plus for splunk sticker. 👍

[@realhomy]

Yessir another new video

[@erfanbaghchedan9104]

thanks it was helpful

[@thegipset5327]

Hey Tim!:)

[@nemielolxd]

is there a link to the list of sql injections

[@pepemunic3661]

google and others

[@BabangidaVEVO]

ext:txt intext:" or 1=1"

[@deepeddyrecords5933]

At 5:14 in the video, you can see the URL.

[@nemielolxd]

@@deepeddyrecords5933 im lazy

[@deepeddyrecords5933]

@@nemielolxd Good luck with that!

[@NoName-mt6xu]

geez i m juat learning how to use print on python and to come till this position it will take me whole eternity 😂😂

[@njpromethium]

it's pretty easy stuff. Keep it up for a few years and you'll be more than enough to do understand these vids.

[@curtistackie7459]

easy and helpful

[@WebWonders1]

Nice video

[@hariprasadhbrr]

Clearly explained, easy to understand :)

[@002jhon1st]

How about a full Tutortials in begginers like me :) what app do you use in PC? Is it Termux or Kali?

[@travisvossler]

Wow y'all are good

[@kashifbari8223]

Your demonstration looks very complicated and makes me confused because you are using multiple tools at the same time for one target. Can you please make it easier please??

[@ayoubchabbi5965]

how make mastercard for free please I need

[@potatoboi4872]

Well, the video is down, that was fast.

[@1matroska]

thanks for this course!

[@trinity2725]

This guys Is better than that creepy guy who doesn't blink 😬😬😬

[@arxidi446]

I love you man

[@Rafa-xi2gr]

his face look like MrBeast

[@SeedsAndStuff]

Lime wire for hackers

[@cryptofantasy4570]

I got an issue its saying embedded "browser initialization failed" in the brup Can anyone help me with this?

[@anngustang1158]

me too. Do you have a solution yet

[@javiporras3396]

@@anngustang1158 the same here.... :(

[@shivaurmaliya70]

Sir please make a detailed video on "remote code execution vulnerability"

[@jasonmikinskiwallet4308]

I prefer the other guy that doesn't blink. Sorry dude, the video was good! Just at the beginning you were reading lol. Maybe your lines. Anyways good Video.

[@PouriyaJamshidi]

masking your link-local IPv6 is just absurd.

[@martonlee]

SELECT username, password FROM users WHERE username='' or 1=1--' AND password='';

[@martonlee]

and never store passwords as plain text

[@iiknow1133]

Greate👏👏

[@realhomy]

Great*

[@jacksama6536]

Which laptop is best for hacking

[@anonymous-vd2oj]

kody retired or what

[@snowdoxsecurity8486]

Check the securityfwd YT channel

[@bodegauno1325]

Always the same, Php and MySQL database with no security 😒… Why not to test this against an Angular front end - .Net - SQL server ?

[@agrodpodnk7054]

Are you guys white hat hacker?

[@TheBankofNewYorkCompanyInc.]

It's mr beast... the evil mr beast

[@a2zandroid44]

❤️ good

[@ohaedhala7535]

ارجوك نريد ترجمه بلعربية

[@Mrxuxukarap]

more of the comment about eye blink.. What the f**k are doing??

[@ehercitosiastres7691]

Nice

[@mohammedahzam2]

hi

[@InfinitySiam]

🔥

[@ohaedhala7535]

Please we want to translate it into Arabic 👍👍👍👍

[@muhammadadnan1430]

Man, please drop the music in the future. It's distracting.

[@amudharamachandran2540]

🙏

[@ohaedhala7535]

Please we want to translate it into Arabic

[@ibrahimgambo4904]

gud

[@Motivationforyoungs]

hihh

[@adamissa7699]

Hey everyone, This is Adam. I am an MSc student doing some research on the threats and opportunities of promoting hacking-related knowledge online. I would very much appreciate your participation guys by answering the following questions. Q1: Should hacking be taught? Q2: What motivate you to follow and watch this content? Q3: Are you benefiting (careerwise) from watching these videos? Q4: What are the risks and opportunities of making cybersecurity knowledge accessible with a worldwide audience?

[@musti8353]

Show us how we can hack social media accounts. Instagrams etc..

[@user-lt2rw5nr9s]

Password reuse via leaked databases. It's not a clear cut question, since there are other means to do that. That might look like phishing, key logging, RATing.

[@dyonisisthehighlander8460]

First!

[@elvisjude190]

second

[@realhomy]

Third

[@mackerrop7398]

use StackOverflow smh

[@Sundaydike]

I have Burpsuite but when I turn on intercept my browser will run very slow,pls what’s problem?