Is your password for sale on the Dark Web? Find out now with Dashlane: https://www.dashlane.com/networkchuck50 (Use code networkchuck50 to get 50% off) In this video, we’re learning one of the oldest, yet most dangerous Hacking Techniques out there, SQL Injection. Despite SQL Injections being over 20 years old, they still rank number 3 on the OWASP Top 10 List….why? Even fortune 500 companies are still vulnerable to these attacks!! So, in this video, NetworkChuck will show you how to run an SQL Injection attack. Running a basic SQL Injection attack is pretty easy but will often become more complex with trickier targets. Stuff from the Video --------------------------------------------------- TARGET SITE (Altoro Mutual): https://demo.testfire.net/index.jsp MORE practice: https://play.picoctf.org/practice/challenge/304?page=1&search=sqli How to protect against SQL Injection attacks: https://www.crowdstrike.com/cybersecurity-101/sql-injection/ 🔥🔥Join Hackwell Academy: https://ntck.co/NCAcademy **Sponsored by Dashlane SUPPORT NETWORKCHUCK --------------------------------------------------- ➡️NetworkChuck membership: https://ntck.co/Premium ☕☕ COFFEE and MERCH: https://ntck.co/coffee Check out my new channel: https://ntck.co/ncclips 🆘🆘NEED HELP?? Join the Discord Server: https://discord.gg/networkchuck STUDY WITH ME on Twitch: https://bit.ly/nc_twitch READY TO LEARN?? --------------------------------------------------- -Learn Python: https://bit.ly/3rzZjzz -Get your CCNA: https://bit.ly/nc-ccna FOLLOW ME EVERYWHERE --------------------------------------------------- Instagram: https://www.instagram.com/networkchuck/ Twitter: https://twitter.com/networkchuck Facebook: https://www.facebook.com/NetworkChuck/ Join the Discord server: http://bit.ly/nc-discord 0:00 ⏩ Intro 0:39 ⏩ Sponsor - Dashlane 1:43 ⏩ How Websites work with Databases 2:08 ⏩ What is a SQL Injection?? 2:51 ⏩ Strings in SQL Queries 3:25 ⏩ Is a website vulnerable to SQL Injection? 4:14 ⏩ SQL Query Logic 4:45 ⏩ the OR SQL Injection Payload 7:13 ⏩ the COMMENT SQL Injection Payload 8:42 ⏩ how to protect against SQL Injections AFFILIATES & REFERRALS --------------------------------------------------- (GEAR I USE...STUFF I RECOMMEND) My network gear: https://geni.us/L6wyIUj Amazon Affiliate Store: https://www.amazon.com/shop/networkchuck Buy a Raspberry Pi: https://geni.us/aBeqAL Do you want to know how I draw on the screen?? Go to https://ntck.co/EpicPen and use code NetworkChuck to get 20% off!! #sqlinjection #owasptop10 #sqli
ADVERTISEMENT
I know the website was made vulnarable on purpose but I feel like a legend right now 😂
As a computer science engineer I really thank you for your work here on youtube. Your ability to make people understand cyber security is unique, passionate and wonderful. Thank you from the bottom of my heart. - An 🇮🇹 engineer
We just covered this in class. This was explained SO WELL.
For the bonus question, it is possible to login without knowing the username by using the following input: ' or 1=1-- This query returns the first user in the database as validation for the username field, because 1 does in fact equal 1, while ignoring the request for a password due to the comment at the end.
When I started watching your videos I was a security guard making about $13/hr. Last year I became the lead help desk tech at my community hospital and made over $60k. I only have some community college credits and the A+ cert. IT has changed my life!! I highly recommend this field. Now I'm working on the Sec+ and getting ready for Tier 2 opportunities. Thank you for the inspiration over the years! cheers ☕
Is your password for sale on the Dark Web? Find out now with Dashlane: /networkchuck50 (Use code networkchuck50 to get 50% off) Stuff from the Video ------------------------------------------------- TARGET SITE (Altoro Mutual): /index.jsp MORE practice: /practice/cha... How to protect against SQL Injection attacks: /cybersecu... 🔥🔥Join Hackwell Academy: /NCAcademy 0:00 ⏩ Intro 0:39 ⏩ Sponsor - Dashlane 1:43 ⏩ How Websites work with Databases 2:08 ⏩ What is a SQL Injection?? 2:51 ⏩ Strings in SQL Queries 3:25 ⏩ Is a website vulnerable to SQL Injection? 4:14 ⏩ SQL Query Logic 4:45 ⏩ the OR SQL Injection Payload 7:13 ⏩ the COMMENT SQL Injection Payload 8:42 ⏩ how to protect against SQL Injections
As a computer science student all of your videos have been really helpful. But this one came just at the right time cause im doing a database class right now and learning about SQL.
That visual on the sql query REALLY helped me understand these concept. I cant thank you enough for this
Congratulations on your efforts to combat scammers, Adrian Ruthnik. Protecting the public from fraudsters is a noble endeavor, and your work deserves high praise.
6:23 "Well dang it, it didnt work. But why?" *Vsauce Music intensifies*
A moment of silence to the chemists that thought SQL was a chemical substance
As a Maldivian living in the UK, I despise these scammers. It warms my heart to see efforts like Adrian Ruthnik's. Keep up the excellent work.
An entire college course in 10 minutes 🤭
Adrian Ruthnik, your clarity in explaining complex topics and managing multiple aspects of the process is truly exceptional. Your work is nothing short of outstanding.
I've built a ton of login systems with php/sql. I had to learn the hard way that it was not so easy. You explained it in a way that just take 10 minutes of a starting backend programmer to review his code. There are plenty of ways to prevent this all from happening..you just have to know where to start. Thank you for the explanation!
*I tried that website and now serving 12 years in fed*
The way you explain IT stuff is breathtaking
The efficiency of Adrian Ruthnik is next level. Managing walkthroughs from various angles with such clarity is remarkable. Making complex topics easy to understand is really something. Awesome work!
Loved the way of your explanation. Never show an exception message on the UI that will help the user to guess next steps. Rest of all the precautions must be taken care.
I love the way that you explained this. I'm retired now but was a software engineer and was always getting the "deer in the headlights" look from other developers when I'd warn about SQL injection.