Session Time Based SQL Injection

 	Time Based SQL injection
 	=======================
Time Based SQL Injection is the subcategory of Blind Based SQL Injection in which when we input a Query. They are often use to extracts the data when there no other way to retrieve the data from the database while executing a query in the database which creates a time delay if the query is right depending on the time it takes to get the server response. As you can guess, this type of inference approach is particularly useful for blind injection attacks. It is basically used by using queries which results to delay of response.

We basically use the functions such as :
		sleep()
		delay()
		hibernate()

Basic syntax
		select if(expression,true,false)


Steps while performing time based injection in DVWA:

Step 1: 1 --> result
Step 2:1' --> no result
Step 3:1' - sleep(3) #
Step 4:1' - if(mid(version(),1,1)='5', sleep(3),0) #
Step 5:1' - if(mid(version(),1,1)='4', sleep(3),0) #
Step 6:1' - if(mid(version(),1,1)='3', sleep(3),0) #
Step 7:1' - if(mid(version(),1,1)='2', sleep(3),0) #
Step 8:1' - if(mid(version(),1,1)='1', sleep(3),0) #

Here mid() function is used as same as that we use substr i.e.
 mid(	string,	starting point,	length till where we want to extract)

=x=x=x=x=x=x=x=x=x==x=x=x=x=x=x=x=x=x=x=x=x=x=x=x==x=x=x=x=x=x==x=x=x=x==x=x=x==x=x=x=x==x

Arbitrary File Upload
=====================
	When the web application askes you to input or upload some kind of document, but instead the person uploads some kind of malicious file. Like darkComet.exe, b374k.php


Some shells could be found on following websites:
webshell.co
privshell.com

usefull scripts:
1.b374k.php
2.Dhanush.php
3.pouya.asp


=x=x=x=x==x=x=x=x=x=x=x=x==x=x==x=x=x=x=x==x=x=x=x=x=x=x=x=x=x=x==x=x=x=x=x=x=x=x=x=x=x==x

POST PARAMETER INJECTION
==========================
POST Parameter Injection is the attack vector when we tamper and manipulate POST Parameters and with HTTP Headers through some tools like Tamper Data, Burp Suite etc.
First we have to capture the http packets Parameters moving from a browser to a Web Server.



=x=x=x=x==x=x=x=x=x=x=x=x=x=x=x=x=x=x=x==x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x=x


Havij : An automated tool based on GUI( Graphical User Interface)

Demo...



------------------------------------------------------------------------------------------

Acunetix - Web Vulnerability Scanner
==========

Now as it requires a lot of effort in doing a VAPT in a website so in order to save time there are several tools which automate various types of scans and even generate a report .
Acunetix is one of the software which helps in doing the same.

DEMO....