Live Hacking Session Part 2
summary
Live demo exploits an Supercar Showdown app by injecting a single quote into an order by URL parameter to trigger SQL errors, then uses crafted subqueries to confirm and extract data from a user_profile table (emails and passwords shown via string casts). The session runs HAVAGE automated SQLi inside a Windows Sandbox to enumerate databases, tables, columns and row data and even edit a model name, and mentions sqlmap CLI as a more powerful alternative.
AI-written summary · about
