Cyber-Range

Electrical Engineer → Ethical Hacker | Cybersecurity from a beginner's POV | Web Pentesting · Kali Linux · Labs 🇳🇬 | Real labs & real struggles ⚡

[Cyber-Range @HackWithCriz]

I entered cybersecurity without knowing why.
No roadmap. No mentor. Just a love for challenges and an Electrical Engineering degree.
Here's how confusion nearly made me quit and what finally gave me direction 🧵

[Cyber-Range @HackWithCriz]

Just wrapped a UNION-based SQL injection lab on @PortSwigger's Web Academy — extracted usernames & passwords from a hidden table by:
1️⃣ Finding the right column count
2️⃣ Identifying visible columns
3️⃣ UNION-ing in the target data

[Cyber-Range @HackWithCriz]

Correct order:
1. Nail down the column count with NULLs first (null,null,null-- )
2. THEN test which position accepts a string

'UNION SELECT null,'qB3Ko7',null-- worked once I stopped skipping step 1.

Slow and steady > guessing. #infosec #SQLi #WebSecurityAcademy #eJPT

[Cyber-Range @HackWithCriz]

Working through PortSwigger's SQL injection labs today — UNION attack, finding a column that accepts text.

Rookie move: tried shoving my string into every column before confirming the column count was even right. Wasted a few requests.

[Cyber-Range @HackWithCriz]

UNION-based SQLi needs 2 things to work:
1️⃣ Same number of columns in both queries
2️⃣ Compatible data types per column
Miss either → DB throws an error, no data returned.
#InfoSec #EthicalHacking #SQLInjection #AppSec #HackWithCriz

[Cyber-Range @HackWithCriz]

Today's lab: SQL Injection subverting app logic 🔓
Core idea: you're not stealing data directly. You're tricking the app into running its query differently doing something the dev never intended.

[Cyber-Range @HackWithCriz]

Classic auth bypass:
Username: Administrator'--
The -- comments out everything after it (like the password check). Now a valid username alone gets you in. No password needed. 😳

[Cyber-Range @HackWithCriz]

@_JohnHammond You always have been cool 😎

[Cyber-Range @HackWithCriz]

@tryhackme I will just focus on my career path immediately instead of learning everything all at once

[Cyber-Range @HackWithCriz]

@HSC_Consult Congratulations 🎉

[Cyber-Range @HackWithCriz]

@narglesargles @Dinosn Thank you.

[Cyber-Range @HackWithCriz]

@thetalisman_Oi @_chrisdunne @Dinosn Sure done

[Cyber-Range @HackWithCriz]

@narglesargles @Dinosn Recommendations? I have webgoat, juiceshop and dvwa

[Cyber-Range @HackWithCriz]

@_chrisdunne @Dinosn Burp suite is straightforward 😀 thank you for your time I appreciate it.

[Cyber-Range @HackWithCriz]

@_chrisdunne @Dinosn Burp suite. I haven't tried OWASP Zap yet.

[Cyber-Range @HackWithCriz]

@narglesargles @Dinosn I have my lab set up already. Are you on Web Pentesting?

[Cyber-Range @HackWithCriz]

@_chrisdunne @Dinosn I have also setup my lab too just working on OWASP Top 10 since I'm currently on web pentesting

[Cyber-Range @HackWithCriz]

@_chrisdunne @Dinosn I'm using Portswigger at the moment, I will try others you listed thank you

[Cyber-Range @HackWithCriz]

@offsecrunner Oh that's great. FB

[Cyber-Range @HackWithCriz]

@abdool_hameed_ @segoslavia @_DeejustDee @jay_hunts You are on web pentesting?