How to Test and Exploit SQL Injections in URL Rewrite Rules - Cybrary

First of all, what is URL rewrite?You've likely seen sites with this schema in URLs: everyone knows how to test for SQL injection in this situation --->' or and 2.5=2.5 or and 3.4=3.5and etc.But, in URL rewrites, this UR will become ,{id is hidden and the parameter 1 is used in url}For testing SQL injection in these kind of URLs, we just use our payloads as before, but after the parameter :' or and 3.6=3.6 and 3.6=3.77and etc.The results would be the same as a normal post parameter.For  testing SQL injection with SQLMAP, we just use a star in the format. For instance:sqlmap -u "*" --random-agent --level 5 --risk 3 --dbsorsqlmap -u "*/1" --random-agent --level 5 --risk 3 --dbsFor injecting in the content parameter, the star sign shows sqlmap where to inject payloads. Happy Hacking

Start learning with Cybrary

Create a free account

Related Posts

All Blogs