Site Hacking 101

T

Tomred

Junior Member

Sep 22, 2007

110

33

• Nov 28, 2007

• #21

justmeron said:

I tried to use it and like on step 2 when I put ' in both blanks it now gives me an error HTTP 500 Internal Server Error page cannot be displayed.
So you must have gotten his attention and inspired some changes.

Click to expand...

Just a quick tip, for those of you not getting these particular error messages, go to your internet settings and make sure "show friendly http error messages" is not selected.

 

T

the-perro

Newbie

Sep 28, 2007

38

36

• Nov 28, 2007

• #22

Awesome, good job Nova. Learning something new everyday

 

nicho

Regular Member

Oct 17, 2007

434

793

• Nov 28, 2007

• #23

Satya you get better each day nicho

 

frequency

BANNED

Nov 23, 2007

591

230

• Nov 30, 2007

• #24

SQL injections constantly evolving to match patches and updates. Cool post.

 

R

RabidSpatula

Newbie

Oct 28, 2007

18

20

• Nov 30, 2007

• #25

Laff, don't know about ASP but in PHP this is very easy to fix. Just strip all ' and " marks, then do proper slashing on all input. If you need single and double quotes, use htmlentities.

 

F

FitnessGeek

Registered Member

Nov 18, 2007

51

32

• Nov 30, 2007

• #26

Awesome info thanks

 

nova

BANNED

Jul 23, 2007

243

155

• Dec 8, 2007
• Thread Starter Thread Starter

• #27

RabidSpatula said:

Laff, don't know about ASP but in PHP this is very easy to fix. Just strip all ' and " marks, then do proper slashing on all input. If you need single and double quotes, use htmlentities.

Click to expand...

Some php sites have other vulnerabilities as well. You arent just limited to sql injection.. but I guess ill post that in a new tutorial.

http://tubeautomator.com/squeeze.php​