Bug Bounty Hunting Essentials

Bypassing security controls

There are different controls that can be implemented to avoid SQL injections attacks; the most basic and important is input validation, but sometimes the DBMS by themselves, and some software solutions, create compensatory controls. One usual control is restricting the kinds of queries that can be made by blocking characters using whitelists or blacklists.

In the following example showing the blocking single quotes, all the examples shown before would fail. But, it is possible to continue injecting the SQL statement using something like the following:

SELECT student_name, average FROM students WHERE kardex=HR(109)||CHR(97)||CHR(114)||CHR(99)||CHR(117)||CHR(115)

Here, you continue injecting the string but without ...