hunt-sqli

Start by enumerating all input vectors including GET/POST parameters, JSON bodies, headers, and cookies. Send error-based probes like a single quote, then test boolean and time-based conditions, and confirm with sqlmap at level 3 risk 2 before attempting UNION-based extraction.

Enumerate the column count using ORDER BY increments until an error occurs, or UNION SELECT with increasing NULL values up to about 12. The correct count is when the UNION stops erroring, and you must establish it before selecting real column names.

UNION-based injection dumps data directly into reflected page output and is fast, while blind injection extracts data character-by-character through boolean or timing differences. Use UNION whenever the endpoint reflects query results and reserve blind techniques as a last resort.

Yes, MongoDB is vulnerable to operator injection using $where, $regex, $ne, and $gt operators passed through JSON bodies or PHP-style array parameters. Developers often skip input validation assuming NoSQL means no injection, as shown in the Rocket.Chat and Mongoose CVEs.

Common WAF bypasses include comment insertion like SEL/**/ECT, case variation, URL and double-URL encoding, tab or newline substitution, and injecting through headers like X-Forwarded-For or User-Agent. Chunked transfer encoding can also split payloads to evade body inspection.

Reports fail when they show only an error message without proving data extraction, timing control, or authentication bypass. You must demonstrate specific data at risk and provide a single reproducible request that a triage engineer can verify in under ten minutes.