Bypassing SQL Filters (picoCTF Web Gauntlet)

Academy - academy.tcm-sec.com
References:
portswigger.net/support/sql-i...
portswigger.net/web-security/...
❓Info❓
___________________________________________
Need a Pentest?: tcm-sec.com
Learn to Hack: academy.tcm-sec.com
🔹The Cyber Mentor Merch🔹
___________________________________________
teespring.com/stores/the-cybe...
📱Social Media📱
___________________________________________
Website: thecybermentor.com
Twitter: / thecybermentor
Twitch: / thecybermentor
Discord: tcm-sec.com/discord
LinkedIn: / heathadams
💸Donate💸
___________________________________________
Like the channel? Please consider supporting me on Patreon:
/ thecybermentor
Support the stream (one-time): streamlabs.com/thecybermentor
Hacker Books:
Penetration Testing: A Hands-On Introduction to Hacking: amzn.to/31GN7iX
The Hacker Playbook 3: amzn.to/34XkIY2
Hacking: The Art of Exploitation: amzn.to/2VchDyL
The Web Application Hacker's Handbook: amzn.to/30Fj21S
Real-World Bug Hunting: A Field Guide to Web Hacking: amzn.to/2V9srOe
Social Engineering: The Science of Human Hacking: amzn.to/31HAmVx
Linux Basics for Hackers: amzn.to/34WvcXP
Python Crash Course, 2nd Edition: amzn.to/30gINu0
Violent Python: amzn.to/2QoGoJn
Black Hat Python: amzn.to/2V9GpQk
My Build:
lg 32gk850g-b 32" Gaming Monitor:amzn.to/30C0qzV
darkFlash Phantom Black ATX Mid-Tower Case: amzn.to/30d1UW1
EVGA 2080TI: amzn.to/30d2lj7
MSI Z390 MotherBoard: amzn.to/30eu5TL
Intel 9700K: amzn.to/2M7hM2p
G.SKILL 32GB DDR4 RAM: amzn.to/2M638Zb
Razer Nommo Chroma Speakers: amzn.to/30bWjiK
Razer BlackWidow Chroma Keyboard: amzn.to/2V7A0or
CORSAIR Pro RBG Gaming Mouse: amzn.to/30hvg4P
Sennheiser RS 175 RF Wireless Headphones: amzn.to/31MOgpu
My Recording Equipment:
Panasonic G85 4K Camera: amzn.to/2Mk9vsf
Logitech C922x Pro Webcam: amzn.to/2LIRxAp
Aston Origin Microphone: amzn.to/2LFtNNE
Rode VideoMicro: amzn.to/309yLKH
Mackie PROFX8V2 Mixer: amzn.to/31HKOMB
Elgato Cam Link 4K: amzn.to/2QlicYx
Elgate Stream Deck: amzn.to/2OlchA5
*We are a participant in the Amazon Services LLC Associates Program, an affiliate advertising program designed to provide a means for us to earn fees by linking to Amazon.com and affiliated sites.

[@TCMSecurityAcademy]

I hope you enjoyed this video! If so, please consider dropping a like and subscribing.

[@jacobebrock]

I do not do enough practice in SQL... This is mind BLOWING to me. You have taught me more than I have been able to google search in years in this video.

[@michaelgirma6161]

the first 3 stages teach a good lesson. "A defender needs to cover all the flaws to succeed, while an attacker only needs 1."

[@kingmekrillinme4831]

Please do some more of these! This alone helped me greatly and i have studied lots of places and it went over my head until meow!

[@kartibok001]

What a great way to walk through the process - thank you :)

[@abhishekdebnath2084]

Very methodical way of explaination. Awsome

[@princepatwari365]

Great videos sir, you really help me a lot in my journey..... Thank you

[@borisvukcevic1454]

Thanks for the great video's and thanks for todays lecture for our class. It was great and very informative.

[@Tobi_Jones]

great, please do more of these

[@salonigupta3760]

You are great!!! It seems so easy to learn from you...

[@victormorga325]

really cool video, great tricks! I would be stuck in the 4th round

[@mehkpentester5824]

That really nice, Thank You.

[@ajeetdev]

Really you are great and teaching in easy way is awesome. Really you are my best mentor. Lots of love from india ❤️

[@poroshahmed9451]

Just wow... Thanks for this

[@koloxd3]

Nice video, great explanation :) Thank You

[@Aarun3096]

As Always... Thanks for your Information on the SQL Bybass CTF..

[@rodricbr]

awesome, really helped me!

[@yoshi5113]

Terimakasih ilmunya.. love from your udemy student here...😁

[@sohanmanju]

I used to think who's Nursultan on discord and why is he going live on Twitch and uploading videos too often. Today I clicked it and realised it was actually TCM

[@Joshua1_7sc]

That was very helpful

[@ksboi29]

Great information

[@xB-yg2iw]

This challenge is quite new from the pico Mini 2020 that run through october, probably the main reason the solves are lower

[@ankurraj193]

Awesome!

[@putubisa9842]

Thank you for share this bro

[@chuongnguyenphuc4803]

thank you so much

[@vbhacker]

So you could use adm | | ‘in’ ; in all the steps and it would work

[@vpnonline5897]

Pls upload more videos for sql injection

[@ayodub]

I have a question about the challenge where they ban the usage of 'admin' and you have to concatenate the string. I thought that if you use authentication bypass it usually doesn't matter what you type the username as, and that the username doesn't even need to necessarily exist. For example: adsfgr' OR 1=1 -- would have the same result as: admin' OR 1=1 -- Why is it required that the user, in this case 'admin' actually exists?

[@ayodub]

Do many of these not work in PostgreSQL? I'm using a training platform with postgresql backend which has almost no filters, and the first 3 solutions: admin'; -- and admin'; don't seem to work for me, I don't really understand why.

[@isinduwickramasekara9786]

I watched half of the stream

[@cem6247]

Hey Adams, In order to understand SQL injection should I learn SQL ? Is there any course you recommend on it?

[@snoppgubbe2310]

how would the actual admin log in if admin is filtered?

[@nockandfire1360]

#Notificationsquad

[@cableraju9702]

Waiting for OSINT 😢

[@ayushgoyal8591]

How can we use union without knowing the no. of columns ??pls explain

[@DigitalTrendzy2023]

hey the challenge is still not over

[@uaman11]

bro how do you know this

[@beetlenut6980]

Ayy I'm early

[@DigitalTrendzy2023]

admin';-- in this ; is for what in this statement

[@shaikjilani8242]

TRY A VIDEO ON BEST LAPTOP CONFIGURATIONS NEDDED TO START HACKING

[@shaikjilani8242]

@@thaddaeusaramaic2680 I AM SO POOR BRO THAT'S WHY I AM ASKING ABOUT LAPTOP

[@micahrobinson7024]

Great system, you cannot use your username to login

[@AP-qs2zf]

nothing works

[@cem6247]

anyone knows the best course for SQL injection ?

[@NicolastheThird-h6m]

Just learn some basic mysql . There are some great videos in youtube . Understanding the syntax of sql will help you a lot .

[@ashiqrahman3299]

First

[@error_6062]

Good for you

[@Alfonso013]

how come double dash ' -- ' become comment? comment is !-- right??

[@NicolastheThird-h6m]

Thats for html . For sql its -- .For mysql its /**/ . (Html is a markup language)