Zero-day Conf, İstanbul Kültür Üniversitesi 2016

2. whoami
Security Researcher @ Netsparker Ltd.
Developer @ Another Times
Writer @ Ethical Hacking “Offensive & Defensive” Book
Blog: omercitak.com
All Social Platform: @Om3rCitak

3. ping pong?

4. ping pong?

5. cross site scripting
• Reflected XSS
• DOM Based XSS
• Stored XSS

6. reflected cross site scripting

7. reflected cross site scripting

8. dom-based cross site scripting

9. stored cross site scripting

10. stored cross site scripting

11. stored cross site scripting

12. sql injection
• Union Based SQL Injection
• Blind SQL Injection
• Time Based SQL Injection

13. union based sql injection

14. login bypass

15. blind sql injection
• Ya hatalar gizlenmiş ise? (error_reporting(0))
• Ya mysql_* fonksiyonlarının başına «@» konulmuş ise?

16. blind sql injection

17. blind sql injection

18. blind sql injection

19. time-based sql injection
• Ya arka planda çıktı vermeyen bir query çalışıyor ise?
– Count Query
– Update Query
– Insert Query
– Delete Query
– Relationship Query

20. time-based sql injection

21. time-based sql injection
MySQL Server
Microsoft SQL Server
Oracle Server

22. sql injection poc
Uluslararası Af Örgütü (amnesty.org.tr)

23. sql injection poc

24. where is the güvenlik?

25. questions

26. thanks
www.omercitak.com
All Social Platform: @Om3rCitak