SQLI Handbook 2019 [Red Hat Edition]

Discussion about particular books go here.
Forum rules
Please make title book name & author.
Books about computers or hacking get stickied

SQLI Handbook 2019 [Red Hat Edition]

Post by Ahmed El Melegy on Mon Sep 16, 2019 1:09 pm
([msg=99168]see SQLI Handbook 2019 [Red Hat Edition][/msg])

Download Now | SQLI Handbook 2019 [Red Hat Edition]

Book Cover

Image

All Publishing Rights Reserved

Gaza Hacker Team

2019/2020

Image

Ahmed El Melegy [ BlackRose ] – GHI Leader

Once you have this book you will put your foot on the real professional ladder full of knowledge and power in professional ways like no other

You will become an expert in injecting databases of all kinds with all the necessary tactics and methods that will help you overcome the biggest difficulties and obstacles

You will have twelve years' experience with this book at your fingertips

Red Hat Edition

Red Hat -He has the knowledge of [Ethical Cyber Security] and the experience of [Black Hacker] so all information in this book belong to this kind of knowledge and experience

About The Book

Once you have this book you will put your foot on the real professional ladder full of knowledge and power in professional ways like no other

You will become an expert in injecting databases of all kinds with all the necessary tactics and methods that will help you overcome the biggest difficulties and obstacles

You will have twelve years’ experience with this book at your fingertips

Red Hat Edition

Red Hat -He has the knowledge of [Ethical Cyber Security] and the experience of [Black Hacker] so all information in this book belong to this kind of knowledge and experience

English Edition

258 Page

29,910 Words

196,113 Characters

The Book and indexes

Image


The First Chapter [ Security and Knowledge ] will deal with many subject divided into sections as following

In Section Zero we will discuss together the answer to this question :
• Who are you and What are your tendencies | Hacker or Ethical Hacker?

In Section One will deal with the subject of self-security fully on internet

Why is this important? More people than ever before in history are going online, and with that, there are increasingly more security concerns. It’s smart and makes sense to take time to learn more cautious Web browsing habits, The neediest to be security are hackers, You understand what I mean here.

Section One Contents
To be secure in internet you need to Learn how to
• Using a VPN Service
• Using Tor
• Using a Proxy Server
• Using Free/Public WiFi

In Section Two we will get to know what is SQL Databases Injections as First Step [ Knowledge ]

Section Two Contents
• Introduction to Injection Attacks
• What Are Injection Attacks?

Types of Injection Attacks
• Code injection
• CRLF injection
• Cross-site Scripting (XSS)
• Email Header Injection
• Host Header Injection
• LDAP Injection
• OS Command Injection
• SQL Injection (SQLi)
• XPath injection

Introduction to SQL Database Injection
• What is SQL Injection (SQLi) and How to Prevent It
• How and Why Is an SQL Injection Attack Performed
• Simple SQL Injection Example
• Example of a Union-Based SQL Injection

Types of SQL Injection
• In-band SQLi (Classic SQLi)
• Error-based SQLi
• Union-based SQLi
• Inferential SQLi (Blind SQLi)
• Boolean-based (content-based) Blind SQLi
• Time-based Blind SQLi
• Out-of-band SQLi

How to Prevent an SQL Injection

Image


The Second Chapter [ How To Find SQLI Vulnerable Sites ] will deal with The best ways to detect site Have SQLI Vulnerability as following

in section one will learn how to scan custom site for sqli Vulnerability and then we will learn how to search for sqli Vulnerable sites generally manually in section two and by tools section three

Contents
• How to Test any Site For SQL Injection Vulnerability | By Tools
• Search For SQL Injection Vulnerability sites By Dorks | Manually
• Search For SQL Injection Vulnerability sites By Dorks | Automatic Mode

Image


The Therd Chapter [ Get Started ] This chapter is the final stage before hands-on how to manually and automatically inject live sites

Chapter III contents

Section One | How to get the sites parameter to Test for sqli Vulnerability

In this section we will learn together how to get sites parameter to Test for sqli Vulnerability

Contents
• Introduction
• What is a URL
• URL structure
• First: How to get the site parameter using manually
• Second: How to get the site parameter using Tools

Section Two | Manually Detect SQL Injection Vulnerability

In this section we will learn together how to detect sqli Vulnerability manually

They are ten manual methods used in this section As following
• The First Test: Using Apostrophe
• The Second Test: Using Quotation mark
• The Third Test: Using English Alphabet
• The Fourth Test: Using Single Quote / Quotation mark / English Alphabet
• The Fifth Test: add Point before the variable number and add Apostrophe after it
• The Sixth Test: add Point before and after variable number at the same time
• The Seventh Test: Add the Apostrophe before the variable number
• The Eighth Test: Delete the variable number and add the Apostrophe only
• The Ninth Test: Delete the variable number and add a slash
• The Tenth Test: Using Logical expressions

Section Three | Basic of Injecting Parameter Links [ Types of Injection < Get The Point > ]

Determine the type of injections of Parameter Links of the basics of injection science, no one should be oblivious to it as one of the key factors in the success of any injection test definitely, It is according to my classification are several types and this can be called ‘Types of Injection’ and they are as follows

Types of Injection Contents
• Type I: SQL Injection Integer Based
• Type II: SQL Injection Strings Based
• Type III: SQL Injection Closures Technic
• Type IV: D.I.V Injection
• Type V: Hidden Vulnerability

Image

The Four Chapter [ SQL Database Injection The Black Box ] will deal with all the correct steps to inject a site are from zero until the sensitive data is collected as following

The Work Plans

Contents
• First, Look For a Target
• Second, Test The Target For SQL Vulnerability
• Note: Testing for Version

Third, Find the Total Number of Columns

• Key Issue Find the Total Number of Columns

1- Another Method | Full Ask
2- Another Method | INTO+At sign
3- Another Method | PROCEDURE ANALYSE
4- Another Method | The Waf Behaviour

• Four, Find The Number Of Vulnerable Columns
• Five, Find The Table Names
• Six, Find The Column Names
• Seven, last Step Extract The uname and pass Column’s Detail
• Eight, Get The Control Panel

All Previous Steps By SQLmap Tool
SQLmap Tool Contents
• Introduction
• What is Sqlmap used for?
• What is Sqlmap tool?
• Is using Sqlmap illegal?
• SQLmap Overview
• What Java JDBC
• Why Should We Use JDBC
• Do You Know
• What is API
• Publishable Operations
• General Conditions
• This tool can test
• Clarify what queries are
• Vulnerable Urls
• Discover Databases
• Find tables in a particular database
• Get columns of a tables
• Get data from a Columns

Image

The Five Chapter [ DIOS [Dump In One Shot] Syntax Queries ] will deal with DIOS queries as following

The queries used in the previous chapter are simple queries and we will slightly expand on the queries for data extraction in quick combined commands called DIOS or extract in one command.

By Using the DIOS queries and once you place in Vulnerable column you will see magic

DIOS [Dump In One Shot] Syntax Queries Contents
• Part 1: First Inquiry [full One]
• Part II: The Second Inquiry [Benchmark One]
• Part III: Third Inquiry [MID One]
• Part IV: Fourth Inquiry [Export_set One]
• Part V: The Fifth Inquiry [Reverse One]
• Part VI: The Sixth Inquiry [Replace One]
• Part VII: Seventh Inquiry [LPAD One]
• Part VIII: The Eighth Inquiry [Make_set One]
• Part IX: The Ninth Inquiry [Complete Information DIOS]
• Part X: Tenth Inquiry [Database.Table.Column With All Recording]
• Part XI: Eleventh Inquiry [All in Full Table]

DIOS Syntax Queries | Another Miscellaneous Technicals
• First: Print Multiple Variables
• Second: Extract Data Count

DIOS Syntax Queries | Targeting Specific Database Tables
• Extract all database names on the site
• Extract all tables linked to the specified database

Image

The Sex Chapter [ Error Based Injection ] will deal with all the methods of Error Based Injection as following

Error Based Injection Contents
• The First Method: The General style
• First: Getting The Version
• Second: Getting The Database Name
• Third : Getting The Table Names
• Fourth: Getting the column names within the users table
• Fifth: Getting the final data from the columns

The second method: Cutting The Value of The Parameter
• First: Getting The Version
• Second : Getting The Table Names
• Third: Getting the column names within the users table
• Fourth: Getting the final data from the columns

Appendix Number One Of The Chapter: Error Based at a Second
• First: Getting The Version
• Second : Getting The Table Names
• Third: Getting the column names within the users table
• Fourth: Getting the final data from the columns

Appendix Number Two Of The Chapter : Non-Geometric Error Based Techniques
• First: Getting The Version
• Second : Getting The Table Names
• Third: Getting the column names within the users table
• Fourth: Getting the final data from the columns

Appendix Number Three Of The Chapter : Procedure Analyse With (XPATH) To Dump All Data In One Shot
• 1- get version
• 2- get Tables
• 3- Dump all columns In One Shot
• 4- get Data

Appendix Number Four Of The Chapter : BIGINT Overflow Error Based SQL Injection
• 1-Test For Version.
• 2-Getting table names.
• 3-Getting column names.
• 4-Retrieving Data.

Appendix Number Five Of The Chapter : Error Based SQL Injection Using EXP/ BIGINT [ Dump In One Shot ]
• 1-Error Based SQL Injection Using EXP.
• 2-BIGINT Overflow Error Based SQL Injection.

Image

The Seven Chapter [ The Popular SQL Injection WAF Bypassing ] will deal with SQLI WAF Bypassing Method as following

Chapter Contents
• What is a Web Application Firewall (WAF)?
• Testing For WAF If Exist
• Basics Of SQLI WAF Bypassing
• CPP-SQL-FUZZER [fuzz Union Based & tables]
• New Version Of WAF Bypassing Stuff

Security solutions to overcome most of the famous protections

Stage Contents
• [1] Error: 1271 – Illegal mix of collations for operation ‘UNION’
• [2] Error: Fatal Error Occurred
• [3] Error: 307 Temporary Redirect
• [4] Error: 400 Bad Request
• [5] Error: 409 Conflict | BIND technique
• [6] Error: 404 Not Found
• [7] Error: boolean given in
• [8] Error: Sucuri WebSite Firewall – CloudProxy – Access Denied
• [9] Error: The used SELECT statements have a different number of columns
• [10] Error : Query failed: Unknown column ‘1’ in ‘order clause’
• [11] Error : Fetching take long time or The connection was reset
• [12] Error : Operand should contain 1 column(s)
• [13] Error : Subquery returns more than 1 row
• [14] Error : multiple queries
• [15] Error : Error: (1054) Unknown column ‘xxx’ in ‘field list’
• [16] Error : 418 Unused
• [17] Error : ERROR 502 – BAD GATEWAY
• [18] Error : Fatal error: Maximum execution time of 30 seconds exceeded
• [19] Error : 412 Precondition Failed
• [20] Error : 412 Error Your request got filtered out due to possible security issues
• [21] Error : The page cannot be displayed because an internal server error has occurred
• [22] Error : Column only accepts numbers | New Technic
• [23] Error : Can’t Extract Column Number With Order By | New Technic
• [24] Error : Solve the problem of the digital values during injection of the asp page | New Technic
• [25] Error : Can’t Extract Column Number With Order By

Image

The Eight Chapter [ Injection of Miscellaneous Databases ] will deal with Many Miscellaneous Databases And explain how to inject it

Injection of Miscellaneous Databases Contents
• Part I: Injection of Postgre database Using Union Based
• Part II:Injection of Postgres By Error Based Using Nextval
• Part III: Sybase Database Injection
• Part IV: Oracle Database Injection
• Part V: Oracle Databases Blind injection using DBMS_PIPE.RECEIVE MESSAGE
• Part VI: Firebird databases injection
• Part VII: MS-SQL(Microsoft Server SQL) Injection


Download The Book

Price $ 10

https://payhip.com/b/hjMp

50% discount for 15 days as book promotion

Discount coupon number : HY9DXEC84D

Regards
Ahmed El Melegy
New User
New User
 
Posts: 2
Joined: Mon Sep 16, 2019 12:57 pm
Blog: View Blog (0)


Return to Books

Who is online

Users browsing this forum: No registered users and 0 guests