October 22, 2015 - scmGalaxy

Limited Time Offer!

For Less Than the Cost of a Starbucks Coffee, Access All DevOpsSchool Videos on YouTube Unlimitedly.
Master DevOps, SRE, DevSecOps Skills!

Enroll Now

Best Open Source Scanning Software

by scmgalaxy KOctober 22, 2015February 27, 2021GeneralLeave a Comment

Open Source Scanning Software

Palamida
openlogic
Blackduck
fisheye

Lyca Mobile Shortcuts

by scmgalaxy KOctober 22, 2015February 27, 2021GeneralLeave a Comment

Lyca Mobile Shortcuts

To check the balance – *101# |

To check the data balance – *136#

Tagged : Lyca / Lyca Mobile / Lyca Mobile Shortcuts / Lyca Mobile USSD / Shortcuts

Mac keyboard shortcuts | Timesaving Shortcuts Mac users Should know

by scmgalaxy KOctober 22, 2015February 27, 2021ShortcutsLeave a Comment

Print Screen – MAC + SHIFT + 4

Desktop – MAC + F3

Power Off – Ctrl + Shift + Power

Tagged : keyboard / keyboard shortcuts / MAC / Mac keyboard shortcuts / Mac users / Shortcuts / Timesaving Shortcuts

SQL Injection: How to check or test for vulnerabilities

by scmgalaxy KOctober 22, 2015February 27, 2021Testing ToolsLeave a Comment

SQJ Injection

There are a number of ways of testing an application for vulnerabilities such as SQL Injection. The tests break down into three different methodologies:

Blind Injection:

MySQL example:

http://localhost/test.php?id=sleep(30)

If this SQL statement is interpreted by the database then it will take 30 seconds for the page to load.

Error Messages:

http://localhost/test.php?id='”

If error reporting is enabled and this request is vulnerable to sql injection then the following error will be produced:

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ‘”‘ at line 5

Tautology Based Injection:

http://localhost/test.php?username=’ or 1=1 /*&password=1

In this case supplying a Tautology, or a statement that is always true provides a predictable result. In this case the predictable result would be logging in the attacker with the first user in the database, which is commonly the administrator.

There are tools that automate the use of the methods above to detect SQL Injection in a web application. There are free and open source tools such as Wapiti and Skipfish that do this.

More –

http://stackoverflow.com/questions/10281349/testing-if-a-site-is-vulnerable-to-sql-injection

http://thecybersaviours.com/how-to-find-out-if-a-website-is-vulnerable-to-sql-injection

Tagged : Blind Injection / mysql / SQL injection / Tautology Based Injection / Test / vulnerabilities