SQL Injections are scary!! (hacking tutorial for beginners)

48 thoughts on “SQL Injections are scary!! (hacking tutorial for beginners)”

• Is your password for sale on the Dark Web? Find out now with Dashlane: https://www.dashlane.com/networkchuck50 (Use code networkchuck50 to get 50% off)

  Stuff from the Video
  ————————————————-
  TARGET SITE (Altoro Mutual): https://demo.testfire.net/index.jsp
  MORE practice: https://play.picoctf.org/practice/cha...
  How to protect against SQL Injection attacks: https://www.crowdstrike.com/cybersecu...

  🔥🔥Join Hackwell Academy: https://ntck.co/NCAcademy

  0:00 ⏩ Intro
  0:39 ⏩ Sponsor – Dashlane
  1:43 ⏩ How Websites work with Databases
  2:08 ⏩ What is a SQL Injection??
  2:51 ⏩ Strings in SQL Queries
  3:25 ⏩ Is a website vulnerable to SQL Injection?
  4:14 ⏩ SQL Query Logic
  4:45 ⏩ the OR SQL Injection Payload
  7:13 ⏩ the COMMENT SQL Injection Payload
  8:42 ⏩ how to protect against SQL Injections

• That. Was. So. Cool.

• ahhh feel like a real hacker now 🤣

• admin' OR '1'='1

• i like it 😀

• or just drop the table and watch the world burn

• what about how to gain admin privileges

• asshole' OR '1' = '1' —
  pwd = lushdflujkdsahf OR doesnt matter

• great 🙂

• only thing is that this kind of SQL injection is only the very basic and outdated. It could have worked on a website from early 2000's with some wonky selfwritten code

• i got in!!!!
  👍

• I dont even know how to query 🙁

• Thee challange was completed in 2 sec, I truly hope this is not a real website, I would not trust my money too be in that bank! xD

• My database is encrypted 😂😂😂

• Thanks

• 😂 nice video

• When building a website it's recommended to perform a regex user input filter to strip of any input that isn't a-z and 0-9 before posting to the server and on receiving a request in the server it's recommended to perform same regex filter before performing sql queries. This will strip off any sql injection input by the user.

• what if it is: user_name = input("write username here: ")
  pass_word = input("write password here: ")
  SELECT * FROM users WHERE username = user_name AND password= pass_word

• well explained man

• how and where do you learn all this

• why exploit your sql to internet, protect it and make only backend to go there and everything will be fine lol…

• I feel guilty now…
  I'm a college student and I… I…
  I used this information to collect academic data
  Whas it wrong?? What should I do??

• It was fun.

• This will never work since almost all db connectors use prepared statements which prevents that kind of stuff.

• great content. thank you for sharing your knowledge

• nice !

• But wait. Why is there a single quote after admin (admin' OR '1'='1') ?? Query should be ('admin'' OR '1'='1' AND ….) right ??
  THANK YOU FOR THE ANSWER !!!
  (End loved your videos !)

• How to hack projector

• hashing left the chat !!

• I even got myself a credit card. thanks man!

• Now that i know this, I wanna know how to avoid SQL injection more deeply..

• I hear someone pronounce SQL a "sequel" and I know the video is not worth my time.

• I hacked it

• I DID IT!!!! I hacked into the site! Wow. I feel so great now successfully completing my very FIRST sql injection attack. Now I know how it's done, I can protect my databases. Interesting

• I believe in most databases the first three logins would be for the admins and to prevent overlapping of usernames databases would have a form of primary key system…so we could use the comment SQL injection method alongside with inputting the primary key field as 1 it should get us in but that would require us to have inside information on the database

• I went to the website for more practise and it told me to log in. I thought that was the practise and i tried to sql inject that website without realising it just wanted me to make an account

• just did it

• I think i love u

• thats sick bro

• I'm a hack now🎉

• Mind blowing 🥳🥳🥳 what ever basic logic you put in email like

  Admin' ' OR '200-100'='100
  Etc..

• 😂😂😂rip for lazy developer

• I'll be adding hacker to my name soon😂😂😂

• That is terrifying i got in it only took 4 seconds

• i did it 😀

• This a great video but i have a few question. How would you do this if it was just a password and how do you protect against it?

• That actually worked haha
  MY FIRST HACKING EXPERIENCE. Feels good, kinda like fixing a bug in Ur program making it work just like u wanted it to 😛

• I think this would only work on a two tier DB system, but not 3 tier

Comments are closed.