This article explains the differences between functional and security testing, introduces common web vulnerabilities such as SQL injection, cross‑site scripting (XSS), and cross‑site request forgery (CSRF), provides concrete code examples, and offers practical tips for detecting and preventing these issues.
The article outlines several SQL injection vulnerabilities discovered in various Sequelize ORM versions, explains the underlying causes related to improper JSON path key handling for MySQL, MariaDB, Postgres, and SQLite, provides reproduction screenshots, and strongly advises upgrading to patched releases.
This article explains the dangers of XSS and SQL injection attacks, demonstrates realistic attack scenarios, and provides a comprehensive backend solution using Spring AOP, HttpMessageConverter, custom Servlet Filters, request wrappers, and ESAPI to sanitize inputs and protect web applications.
This article explains the fundamentals of injection attacks, focuses on SQL injection as part of the OWASP Top 10, classifies injection vectors by data type, submission method, and impact, and provides concrete examples and defensive measures to protect web applications.
This article explains the difference between MyBatis #{ } and ${ } placeholders, how the misuse of ${ } can cause SQL injection and incorrect IN‑clause queries, and demonstrates a safe solution using the foreach tag to handle list parameters.
This article explains the difference between MyBatis #{ } and ${ } placeholders, why using ${ } can cause SQL injection and IN‑clause errors, and how to safely resolve the issue with proper parameter handling and the foreach tag.
This article explains why database injection remains a critical security threat, illustrates how attackers exploit vulnerable web applications using manual techniques and automated tools such as sqlmap, and provides comprehensive defensive measures spanning secure coding, database hardening, web‑server configuration, WAF deployment, and log‑analysis to protect sensitive data.
This article introduces the most common web application vulnerabilities—including SQL injection, XSS, CSRF, file upload, file inclusion, clickjacking, and URL redirect—explaining how attackers exploit them and the potential impacts on websites and their users.
The article explains how attackers compromise MySQL servers, create a WARNING table with ransom instructions demanding Bitcoin, and provides concrete SQL examples and four practical defense measures—including strong authentication, disabling public access, regular backups, and application hardening—to protect databases.
This article details a high‑severity SQL injection vulnerability in Zabbix’s jsrpc.php profileIdx2 parameter that allows unauthenticated attackers to gain system privileges, outlines its impact, demonstrates testing methods with screenshots, analyzes the vulnerable code paths, and recommends mitigation steps such as upgrading, patching, and disabling the guest account.
During an external penetration test I discovered an Oracle Advanced Support service, reverse‑engineered its JavaScript endpoints, crafted GET and POST requests to create and execute named SQL statements, and ultimately extracted database version, user information, and password hashes, highlighting a critical web‑application flaw.
The article introduces major web security threats such as XSS, injection, CSRF, explains their mechanisms with examples, and presents defensive measures including input sanitization, HttpOnly cookies, web application firewalls, and encryption methods like hashing, symmetric and asymmetric cryptography.
This article chronicles the development of WCDB, WeChat’s open‑source mobile database, detailing its early challenges, performance bottlenecks, security risks, concurrency improvements, cross‑platform collaboration, and future roadmap for a more reliable and efficient data layer on iOS and Android.
This article examines WCDB’s design principles for efficient, complete, and easy-to-use client-side databases, explains the pitfalls of SQL string concatenation such as code redundancy, debugging difficulty, and injection attacks, and describes how WCDB’s WINQ abstraction and ORM layer safely encapsulate SQLite syntax to enable concise, compile-time-checked queries.
This comprehensive guide explains why database injection remains a critical security threat, illustrates real‑world attack techniques and toolchains, and provides layered defensive measures—from secure coding and DB‑proxy solutions to web‑server filtering, WAF deployment, and log‑analysis pipelines.
This article compiles 42 practical questions and answers covering information gathering, vulnerability identification, exploitation tactics, and remediation advice for web applications, databases, servers, and common security mechanisms, providing a concise reference for penetration testers and security engineers.
This article explains why SQL injection occurs in Python web development, demonstrates vulnerable code using string concatenation, shows the resulting errors, and provides two effective solutions—input escaping and MySQLdb's parameterized queries—to secure your applications.
This article explains how attackers can abuse mysqldump to embed malicious SQL that runs system commands during import, demonstrates the exploit step‑by‑step, and provides practical mitigation measures such as using --skip-comments and revoking CREATE TABLE privileges.
This article recounts a series of real‑world production incidents—including massive concurrency overloads, DDoS attacks, SQL injection breaches, and critical bugs—encountered by an internet finance platform, and shares the concrete technical fixes and lessons learned to improve system resilience.
This article explains the mechanics of SQL injection and XSS attacks, demonstrates common exploitation methods such as table‑name guessing, error‑based and union queries, shows a vulnerable authentication script, and provides practical defensive coding techniques to mitigate these threats.
This article provides a practical introduction to SQL injection, covering its fundamentals, common attack vectors such as Boolean‑based, error‑based, and UNION‑based injections, step‑by‑step exploitation examples with PHP code, and tips for constructing payloads and understanding their impact on vulnerable web applications.
The article uses a warehouse‑robot analogy to illustrate how SQL injection works, showing how mixing user‑supplied data with commands lets attackers alter database queries, and explains that parameterized queries separate code from data to prevent such vulnerabilities.
The article reviews the author’s experience with security testing, explains the severe risks of SQL injection, demonstrates vulnerable server‑side code, and provides practical remediation methods such as input sanitization, type casting, and using prepared statements with PDO.
This article explains the unauthenticated SQL injection flaw in Zabbix's JSRPC profileIdx2 parameter, details its high impact on versions 2.2.x and 3.0.0‑3.0.3, provides a step‑by‑step proof‑of‑concept exploit, and recommends upgrading to version 3.0.4 to remediate the issue.
This article explains what SQL injection is, shows vulnerable PHP code examples, and provides concrete prevention techniques—including input validation, parameterized queries, limited database privileges, error handling, and proper escaping of special characters—to protect web applications from attacks.
The article examines how HTTP header and cookie parameters can serve as SQL injection vectors, evaluates the coverage of commercial and open‑source web vulnerability scanners, demonstrates manual testing techniques, and recommends tools such as sqlmap for comprehensive security assessments.
The article uses a warehouse‑robot analogy to illustrate how mixing user‑supplied data with commands leads to SQL injection and explains that separating commands from data via parameterized queries prevents this security flaw.
The article examines why databases are frequent targets of security breaches, explains the most common SQL injection vulnerability, categorizes injection paths, methods, and examples—including manipulation, code, function‑call, and buffer‑overflow attacks—then outlines practical defense measures such as input encryption, database firewalls, and patching.
This guide outlines the fundamental concepts, mindset, and step‑by‑step skills needed for beginners to start learning hacking and information security, covering everything from basic network knowledge to legal considerations.
This article outlines the most common web application security threats—including XSS, SQL injection, CSRF, transmission hijacking, credential leaks, brute‑force attacks, and token theft—and provides practical mitigation techniques such as proper escaping, CSP, parameterized queries, CSRF tokens, HTTPS, HSTS, HPKP, encrypted password storage, two‑factor authentication, and robust token handling.
This article examines how web vulnerability scanners handle non‑traditional input vectors such as HTTP headers and cookies, demonstrates manual exploitation techniques for header‑based SQL injection, compares scanner coverage and accuracy, and offers practical guidance for developers and penetration testers.
