SQL Injection - Lab #17 SQL injection with filter bypass via XML encoding | Short Version

In this video, we cover Lab #17 in the SQL injection module of the Web Security Academy. This lab contains a SQL injection vulnerability in its stock check feature. The results from the query are returned in the application's response, so you can use a UNION attack to retrieve data from other tables.
The database contains a users table, which contains the usernames and passwords of registered users. To solve the lab, perform a SQL injection attack to retrieve the admin user's credentials, then log in to their account.
▬ ✨ Support Me ✨ ▬▬▬▬▬▬▬▬▬▬
Buy my course: academy.ranakh...
▬ 🔗 Links 🔗 ▬▬▬▬▬▬▬▬▬▬
Notes.txt document: github.com/rkh...
Web Security Academy Lab Exercise: portswigger.ne...
Rana's Twitter account: / rana__khalil

[@RanaKhalil101]

📚📚 Don't want to wait for the weekly release schedule to gain access to all the videos and want to be added to a discord server where you can ask questions? Make sure to sign up to my course: bit.ly/30LWAtE

[@mohmino4532]

an amazing explain SQLi i've found till now and i noticed that women have amazing way to explain so thx so much my teacher اجمل تحية اليك استاذتي العزيزة

[@paco6266]

Felicidades Rana 👏👏👏👏. No sé porque lo he visto, pero me ha encantado (Voy 2 video lab1, pero no sé lo digas a nadie, de verdad, que me da vergüenza 😂😂). Ahora en serio, me voy a poner como meta, visualizar, asimilar y practicar desde CERO. De verdad, ver este video me ha devuelto de nuevo la ilustración. MUCHAS GRACIAS.

[@narsimharao8565]

Thank you soo much for making valuable videos 🎉

[@acronproject]

Thanks Ms.Khalil. It's very useful for me.💐

[@huyha3684]

Can you explain the purpose of using encode "hex_entities"? I have tried using a different encoding method, but the results are not what I expected.

[@786min]

Thank you for this video you helped me so much! How did you get so good at pentesting and learn all this? I'm trying to get to your level iA

[@vilma-lima5295]

muitoo bommm

[@muhannedbelaid8849]

Thank you Rana.! Really appreciate what you are doing for the community ❤.

[@irfanhameed5613]

great resource but audio is not comfortable

[@FaizanPirjada-h1n]

how we can find the sql vulnerability

[@suguop123]

👌👌

[@mukoshmanob9240]

Can you please upload xss video and sql in post based and header based

[@FaizanPirjada-h1n]

Hello mam

[@mistacoolie8481]

liquid gold. thank you

[@aerrrdd885]

helIo sorry to bother you, i have an exam in web security and I'm having some difficulties. I'd like to know if it's possible to get some help on this code. I think I know that there is an xss flaw on the password field because the "htmlspecialchars" function is only used on the user variable but when I put alert("hack")in the password field it doesn't return anything I don't understand why at all can you help me please i really in trouble with this require_once 'include.php'; $msg = ""; if( isset( $_POST[ 'username' ] ) && isset( $_POST[ 'password' ] ) && isset( $_POST[ 'password2' ] ) ) { checkToken( 'register.php' ); $user = $_POST[ 'username' ]; $pass = $_POST[ 'password' ]; $pass2 = $_POST[ 'password2' ]; if ( $pass !== $pass2) $msg = "Passwords don't match."; else { $stmt = $db->prepare("SELECT * FROM users WHERE username = ?;"); $stmt->bind_param("s", $user); $stmt->execute(); $result = $stmt->get_result(); if( $result && $result->num_rows >= 1 ) { $msg = "Username is not available."; } else { $user = stripslashes( $user ); $user = htmlspecialchars( $user ); $user = $db->real_escape_string( $user ); $pass = stripslashes( $pass ); $pass = $db->real_escape_string( $pass ); $stmt = $db->prepare("INSERT INTO users (username, password) VALUES (?,?);"); $stmt->bind_param("ss", $user, $pass); $stmt->execute(); redirect( 'login.php' ); } } Thanks in advance.