SQL Injections: The Full Course

[@Cybrcom]

Here's an update on how to install Docker on the new Kali version. It's actually much simpler now! cybr.com/app-data-security-archives/how-to-set-up-the-dvwa-on-kali-with-docker/ TL;DR: sudo apt update sudo apt install -y docker.io sudo systemctl enable docker --now sudo usermod -aG docker $USER newgrp docker

[@syedali-i5d]

Even I am watching this video after 4 years but it is really informative and very good explanation i have not seen so far. Thanks

[@AbhishekkumarSir]

I am really glad that there are people like you in this world. Thank you so much for your Video.

[@Cybrcom]

You are very welcome! Happy learning

[@MdMahirAsef]

It is a great free resource for learning SQL injection. Before starting this course I don't knew any thing about SQL injection but after completion this course I learnt a lot of thing about SQL injection.

[@islamkaram463]

The most powerful and professional course I've ever seen. Thanks a lot

[@Cybrcom]

That's really nice. Thanks so much!

[@mynamejeff2880]

what not even 1 k subscribers cmon man this guy deserves better

[@Cybrcom]

Haha thank you, that's very kind! The best way to help us grow is to help share our videos if you think someone could benefit from it! Thanks!!

[@che3tah205]

feeling lucky to find you even before you hit your first 100 subscribers. Wishing you for 1M subscribers.

[@Cybrcom]

Thank you for the kind words!

[@janekmachnicki2593]

I brought your course from Udemy so well spent money THANKS

[@Cybrcom]

Thank you for your support ♥

[@janekmachnicki2593]

@@Cybrcom iv just brought another one form udemy " The Practical Guide to sqlmap for SQL Injections"

[@nagizah8]

found your video while researching for materials for my undergrad paper about SQL Injections. You are a better teacher than my college one xD

[@Cybrcom]

That's so sweet, tyvm! Glad you found the video!

[@9jacafe118]

Woow, that was educative and informative. You have done a great job.

[@mahesh6307]

Most underrated

[@Cybrcom]

❤️

[@deadoralive8296]

Still watching your videos Thank you so much

[@7838007133]

your English is so clear to understand non-English native speakers like me. Thank you so much!

[@Cybrcom]

So happy to hear that! Glad you enjoyed it!

[@eyeinthesky1050]

Thanks dude, i learned a lot by watching your videos, it is still difficult with those codes and stuff but the way you explains makes it easier! Thanks again :)

[@Cybrcom]

How's your learning journey been so far?

[@eyeinthesky1050]

@@Cybrcom hello sir! I have been working a lot lately and i have not been studying so much past few weeks but i gotta tell you i have learned so much in such short time while i was watching/studying the SQL Injection on your website and i really appreciate it, i am almost done with that course, thanks for your concern Christoph

[@Cybrcom]

@@eyeinthesky1050 awesome! Keep it up and good luck!

[@songstageysmn]

güzel bir eğitim olmuş elinize sağlık

[@Coollinux-c2b]

is that working if i apply this union sqli query param=')) union select name,name,name,name,name,name,name,name,name from sqlite_master where type='table' -- in login field to get all tables?, im asking because i've been tried it out but nothing happend, is that because the login field doesn't vulnerable to this query?

[@justkiddieng6317]

1:39:24. LOL, well a lot of time this is true but we need it. LOL. thanks for this, course I hope you will upload more video to help us especially for beginners. THAANNKSKSSSS

[@Cybrcom]

You got it!

[@nimcoabdi8822]

Thanks I’m here to prepare my interview for cyber security consultant

[@Cybrcom]

Good luck! Hope it goes well

[@Cashvib-f4w]

In 53:12 what is % refering to? Is that encoded of single quote or empty?

[@johncracker6934]

Actually in the minute 32:44 it will fail because it still got a closing quote the workijng payload will be something like : 346'%20OR%20'1'='1

[@Cybrcom]

Thanks! Must have missed that one

[@bricer4894]

woow, am half way through but enjoying it. I feel like i can hack any database now haha. Thanks for this content

[@Cybrcom]

Glad you're enjoying it!

[@rockguru6656]

Your life saver .. bro surely u will grow .. plz make videos on kali tutorials

[@uuusa7]

Bro great job help me too much to learn, hopefully more video of you. Thanks

[@Cybrcom]

Glad it helped :-)

[@profesurtom]

Hey if we shut down our system or close the docker seession do we need to download them again . and btw i love your videos and content you provide . THANKS FOR THEM , you are just helping us more than you think.!!!

[@Cybrcom]

You don't need to re-download the docker images, you can just re-launch a new container with the same image(s). But if you take actions in the container, those actions will get wiped every time you shut down the system or destroy the container. You can get around this if you need to by setting up persistent storage though: docs.docker.com/guides/docker-concepts/running-containers/persisting-container-data/

[@profesurtom]

isn't the scaning a target is a 2nd phase for pentesting?? while not Info Gathering?

[@itsksujan]

Great video on SQL injection, appreciate your effort 👏

[@FLUFFYCAT_PNW]

Really great and informative video.

[@Cybrcom]

Thank you! Glad you liked it

[@WickedTwitches]

Holy crap this is exactly what I wanted.

[@Cybrcom]

Haha awesome! Glad you found it :D

[@mohsenbaarzegar]

Very awesome

[@sigge.g2193]

If you having troubles with virtualbox and it is "aborted" make sure to enable "amd v" in bios setting

[@Carcks_io]

is there a course to get more advanced on this attack? like for example bypass some stuff that very common in sql injection attack?

[@fluidman777]

Hello, Thanks a lot. at 53:30 after executing the union payload am getting "Invalid HTML header" any solution.? I have cross-checked everything.

[@Cybrcom]

Try copy/pasting directly from here. It's possible that a weird character snuck in: ')) UNION SELECT name,name,name,name,name,name,name,name,name FROM sqlite_master WHERE type='table' -- Alternatively, make sure you didn't accidentally modify or delete any of the other headers, and make sure the GET request is on a separate line from the User-Agent line

[@fluidman777]

@@Cybrcom thank you!

[@fluidman777]

@@Cybrcom it worked!thanks.

[@Cybrcom]

@@fluidman777 awesome!

[@fluidman777]

@@Cybrcom could you be the one who was teaching Redhat sysadmin prep on udemy? had bought the course but i can no longer find it.

[@geuxmer2355]

Idk why but it feels like every second im not learning cybersecurity, things are getting more secure and one day soon hscking will be phased out completely

[@Cybrcom]

I wouldn’t worry about it anymore because that’s definitely not the case :)

[@Louisianish]

Cybersecurity professionals are more in demand than ever, and that demand is only growing.

[@kuil]

It is getting harder to hack, but as new technologies are created, new exploits will be too.

[@shinobi0x1]

Always be creative on your payloads and think out the box

[@Lynxhck-y6s]

I don't think so bro it's impossible 😂 we hv other strategies brr 🥶

[@justkiddieng6317]

Please do more videos. That would be great.

[@Cybrcom]

You got it!

[@justkiddieng6317]

If you can upload more full course about web security thanksss....

[@SEYIDMOHAMEDELKORY]

waiting for your course about the new version of zap. it's completely different

[@ivanshyshkevich9301]

Question: why are you deploying Kali Linux through VirtualBox? Wouldn't it be easier to pull it through Docker as well? Great course, thank you!

[@Cybrcom]

Hey, normally I use VMs (something like VirtualBox for local or else cloud-based ones) for anything requiring a GUI, and Docker when I just need to run a server, an app, or scripts, either locally or as part of deployment pipelines... it entirely depends on what you want/need and your comfort level, but you have many options nowadays!

[@sgshanks]

Solid content with clear explanation

[@Cybrcom]

Thank you ♥

[@mdzyrd407]

Hello! I am having a problem when pressing the launch browser in the manual explore. The browser displays, however, the zap hud is not showing and the search bar is color red instead of yellow or orange like in the video. It only displays the OWASP Juice Shop web application. Any help will be appreciated! Edit: changed OWSAP to OWASP

[@Cybrcom]

I’ve had a few other reports of this issue and believe it’s caused by an update to Firefox. Honestly, the HUD is not that useful once you start getting more familiar with ZAP, so learning how to use the HUD instead of the main ZAP client is not very important and could definitely be skipped. If you want to try a prior Firefox version though, that should fix it. Up to you!

[@mdzyrd407]

@@Cybrcom thanks for the reply, I recently knew that I do not really need the hud, I can use the desktop client which is for me is better. Btw really great video and tutorial, I learned a lot and thanks again for replying to my message!!! Cheers!

[@AfricanMemes-oq9eu]

Good morning,please at the beginning while trying to set up docker .. When I run the command...docker run --rm -it -p 80:80 vulnerables/web-dvwa I get am error messages saying Error starting userland proxy Address already in use Docker: error response from daemon

[@Cybrcom]

Hi, did you get this resolved? Just in case for others who may have that problem: the error message tells you that port 80 is already in use. You either already ran that command the didn't kill the container before re-running it, or you have another service on your computer running on port 80. You can simply map it to a different port, like this: -p 8084:80

[@Coollinux-c2b]

how do you know that we should use a lot of column based on target table, or that what w should do in every union attack?

[@Cybrcom]

This would require a lot of trial and error to get the number of columns matching right if you were doing a blackbox test. Otherwise, this is information you could get from the engineering (app/database) team

[@smert6379]

When i do the automated scan on ZAP, it just crashed after a while every time. And i need to restart my VM to get it to open again. Any help?

[@Cybrcom]

Take a look at the error log and see what’s causing the issue. More details here: www.zaproxy.org/faq/somethings-not-working-what-should-i-do/

[@Cashvib-f4w]

In 53:12 , what the % stand for?

[@Cybrcom]

in SQL, it acts as a wildcard. So since it's paired with LIKE '%' it means match everything. If it were instead LIKE 's%' it would match every column that starts with the character s, and so on

[@zbgh7693]

Might be late but question, can mastering this tool get me a start up job? Great video 🔥🙏🏼

[@Cybrcom]

It certainly wouldn't hurt, but you will need more than just mastering this specific tool (assuming you are referring to sqlmap). Most job postings will require knowledge of multiple tools and other concepts

[@zbgh7693]

@@Cybrcom I see yeah makes sense, would it be possible if you make a video on what are the things you should know in order to land a start up job or an internship in cyber security, I’m currently a 3rd year software engineering students and I’m all over the place. Would really appreciate it

[@Cashvib-f4w]

Is that possible to sql injection the impossible level on dvwa blind sqli?

[@Cybrcom]

It’s not supposed to be but you never know ;)

[@Carcks_io]

Is DROP query can delete database and column?

[@Cybrcom]

www.w3schools.com/sql/sql_drop_table.asp

[@xanvong1501]

Thanks! So awesome of you! Learning so much!

[@cyberone14]

your studying cyber security ?

[@xanvong1501]

@@cyberone14 yes, I recently graduated in Cybersecurity certification ( 30 credits). It is a competitive field to enter as an entry-level. I am thinking of pursuing Cloud certification with Azure or AWS. Application security job is in high demand and less competitive with others job applicants.

[@cyberone14]

@@xanvong1501 well done :)

[@Cybrcom]

@@xanvong1501 congratuations, and that's a great idea. The cloud is in high demand and will remain so for the long-term, especially security!

[@xanvong1501]

@@Cybrcom Thanks so much 🙏

[@chizzlemo3094]

hi mate, like your presenting style, does [arch=amd64] apply if the PC using intel, I'm confused? Thanks ya'll

[@Cybrcom]

Yes it does. Super confusing, I know. Here's a brief explanation of why it is what it is: wiki.debian.org/DebianAMD64Faq TL;DR: ""AMD64" is the name chosen by AMD for their 64-bit extension to the Intel x86 instruction set."

[@Cybrcom]

Our free eBook covers the topics reviewed in our course. It explores one of the biggest risks facing web applications today: SQL injections. Think of this as your reference guide that includes concepts to understand, attacks you can perform in safe & legal environments, and defense controls you can implement for your network, applications, and databases. Download your free eBook here: cybr.com/ebooks/sql-injection-attacks/

[@aadilroshan7822]

I love you man

[@Cybrcom]

Love you too :)

[@bricer4894]

Does the order matter when writting commands for sqlmap eg (-u, --batch, --threads) or the command can run regardless of the arrangement ? Thanks

[@Cybrcom]

The order of options doesn't matter much in terms of running the command, nope!

[@ItohowoMonday-c7s]

do you have video to prevent sql injection using ML

[@Cybrcom]

I do not and haven’t seen one I can recommend

[@syamakella1297]

bro can u make a video on how to run dvwa on aws kali instance

[@Cybrcom]

Sure!

[@Carcks_io]

Can I create a new table in SQL Fiddle?

[@Cybrcom]

Yes

[@Cybrcom]

@@Cashvib-f4wI'm not sure what you mean or what you're referring to

[@zaksam3745]

thanks

[@lichking5834]

thank you sooo much man

[@Cybrcom]

glad it helped!

[@francisdonald4298]

Why here seems easier but in live targets doesn't work!!!!?????????

[@Cybrcom]

It’s part of the grind & hunt!

[@mohammadpatel2315]

When I try sqlmap I get parameter 'id' is not injectable

[@Cybrcom]

At which step in the course are you getting this message? And are you running the same command as shown in the video?

[@pratibhasharma5935]

@@Cybrcom I am getting the same error. This error is shown when I use the same command as shown at 1:21:10

[@ingriedsiegbert9799]

What is „Chi Chi“?

[@Cybrcom]

Huh?

[@Coollinux-c2b]

name is a column or function?

[@Cybrcom]

Timestamp please

[@footballforall3113]

make of xxe tooo please

[@Cybrcom]

I've actually got a brief section on XXE in the full version of this course here: cybr.com/courses/injection-attacks-the-free-guide/ (Check out the "XML and XPATH injections" section)

[@emochain75]

brother I got this video ..Does it need to have wireless adapter for sql injection ? Cause I donot have money so that I can buy it ,,,, And my laptop dont have that ..plzz reply😪😊

[@Cybrcom]

No wireless adapter is needed for SQL injection

[@raviranjan5519]

can you teach me digital forensic

[@Cybrcom]

We're talking to a couple of potential authors who are knowledgeable in digital forensics, and are hoping that will lead to courses on that topic!

[@karthikiyer1309]

Right now you don't have 1k subs but I'm seeing ads on your video...how???

[@Cybrcom]

KZbin just announced a change to their ToS so they are now monetizing videos even if the channel isn't monetizing :(

[@Cybrcom]

From KZbin's announcement: "KZbin’s right to monetize: KZbin has the right to monetize all content on the platform and ads may appear on videos from channels not in the KZbin Partner Program."

[@rtzgf67games7]

Note to myself: 1:22:47

[@SQLxGuy]

How is it like being a good guy hacker?

[@medorrah]

I need anyone that is very good in injecting sql to come to my aid

[@god9233]

brother but like this you teaching people how to sql attack.....

[@Cybrcom]

You have to understand how attacks can be carried out in order to truly protect your assets. The hope is that more people do good things with their skillset than bad, but ultimately you don't prevent bad things from happening by limiting training. Quite the opposite!

[@belharra5756]

@@Cybrcom yes your right also i would appriciate if you could make sql injection video with the New kali Linux because many things changed like the docker download

[@Cybrcom]

@@belharra5756 here's an update on how to install Docker on the new Kali version. It's actually much simpler now! cybr.com/app-data-security-archives/how-to-set-up-the-dvwa-on-kali-with-docker/ TL;DR: sudo apt update sudo apt install -y docker.io sudo systemctl enable docker --now sudo usermod -aG docker $USER newgrp docker

[@god9233]

@@Cybrcom brother could you Pls make an updated version of sql injection on how to bypass waf

[@Cybrcom]

@@god9233 I'm actually working on one right now that will include that :-D

[@sauarbhdiwan]

For starting docker service in kali sudo /etc/init.d/docker start

[@turalkanal2113]

could you please assist me to solve this error: Failed to load R0 module D:\/VMMR0.r0: The path is not clean of leading double slashes: 'D:\/VMMR0.r0' (VERR_SUPLIB_PATH_NOT_CLEAN). Failed to load VMMR0.r0 (VERR_SUPLIB_PATH_NOT_CLEAN). Result Code: E_FAIL (0x80004005) Component: ConsoleWrap Interface: IConsole {872da645-4a9b-1727-bee2-5585105b9eed} I have been trying to solve for 3 days .

[@turalkanal2113]

when I want to start the machine

[@Cybrcom]

Did you figure this out? You might want to uninstall/reinstall

[@turalkanal2113]

@@Cybrcom I installed VB to c:/

[@GodsGreatest]

Ask Chatgpt