Skip to content

Commit f74131d

Browse files
JacobReynoldsJacobReynolds
authored
Adding SEO titles, keywords, and descriptions. (#3)
1 parent 15562f2 commit f74131d

File tree

31 files changed

+100
-75
lines changed

31 files changed

+100
-75
lines changed

‎README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,3 +18,4 @@ See [CONTRIBUTING.md](https://github.com/NetSPI/WikiJekyllTheme/blob/master/CONT
1818
- Khai Tran (@k_tr4n)
1919
- Rafael Seferyan
2020
- Scott Sutherland (@_nullbind)
21+

‎_data/injectionDescriptions.yml

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,17 @@
11
injectionDetection: Injections can be detected in a number of ways. The simplest being adding a <code>'</code> or <code>\</code> after various parameters and getting a database error returned from the web server. The sections below describe where to find and how to detect these parameters."
22
dbmsIdentification: Detecting what Database Management System (DBMS) is being used is critical in being able to further exploit an injection. Without that knowledge it would not be possible to determine what tables to query, what functions are built-in, and what detections to avoid. A successful response from the below queries identify that the selected DBMS is being used.
3-
errorBased: Error based injections are exploited through triggering errors generated by the database when invalid input is passed to it. The error messages can be used to return the full query results, or gain information on how to restructure the query for further exploitation.
3+
errorBased: Error based injections are exploited through triggering errors in the database when invalid inputs are passed to it. The error messages can be used to return the full query results, or gain information on how to restructure the query for further exploitation.
44
unionBased: Union based SQL injection allows an attacker to extract information from the database by extending the results returned by the original query. The Union operator can only be used if the original/new queries have the same structure (number and data type of columns).
55
blindBased: Blind SQL injection is one of the more advanced methods of injection. The Partial-Blind and Full-Blind methods are detailed below. Use care when performing these queries, as they can overload a server if performed through heavy automation.
66
conditionalStatements: Conditional statements are beneficial for creating complex queries and aiding in Blind Injection.
77
injectionPlacement: SQL injection is always a hassle when it isn't apparent where the injection is taking place. It is helpful to have a few ways to exploit injections in various parts of the query.
88
injectionObfuscation: Obfuscating queries aids in bypassing Web Application Firewalls (WAFs) and Intrusion Detection/Prevention Systems (IDS/IPS). Below are examples of basic query obfuscations, they may require modification before being applied to certain injections.
99
dataExfiltration: Exfiltrating data allows easier data analysis, as well as an offline copy of any compromised data. Data can be exfiltrated through files, various Layer 4 requests, and hidden techniques.
1010
dataTargeting: Being able to properly target and identify sensitive information can exponentially decrease time spent in a database. This means less time spent poking around and more time spent researching other vectors.
11-
executingOSCommands: Running an OS command is one of the primary objectives of SQL injection, this aids in getting full control of the host OS. This may happen by directly executing commands, modifying existing data to put a shell on a webpage, or exploiting hidden functionality in the database.
11+
executingOSCommands: Running OS commands is one of the primary objectives of SQL injection, this aids in getting full control of the host OS. This may happen by directly executing commands, modifying existing data to put a shell on a webpage, or exploiting hidden functionality in the database.
1212
informationGathering: It is often valuable to gather information about any testing environment; version numbers, user accounts, and databases all help in escalating vulnerabilities. Below are common methods for this.
1313
lateralMovement: Lateral movement allows a tester to gain access to different sets of functionality/data that don't explicitly require a more privileged user. Switching user accounts laterally will expose different information and could aid in compromising a more privileged user.
1414
privilegeEscalation: Certain functionalities require a privileged user and for escalating a vulnerability a privileged user is always the first step.
1515
readingAndWritingFiles: Reading and writing to files aids in data gathering as well as data exfiltration. Many methods include writing to the webroot, which enables a web shell to be executed, or allowing data to be exfiltrated over port 80/443.
16-
persistence: Gaining persistence on a system allows a semi-permanent foothold in a network. Through this foothold different vectors and exploit methods can be attempted.
16+
persistence: Gaining persistence on a system creates a semi-permanent foothold in the network, allowing prolonged exploitation time. With this extra time different vectors and exploit methods can be attempted.
17+
parameterManipulation: Manipulating parameters aids in bypassing Web Application Firewalls, Anti-Virus scanners, and allows modification of various SQL queries for unique situations.

‎_data/metadata.yml

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
googleTagManagerID: GTM-M7JZ64N
2-
keywords: "netspi, sql injection, wiki, sqli, sql, injection, netspy, network security professionals, oracle, mysql, sqlserver, mssql, cheat sheet, cheat, sheet"
3-
description: This wiki's mission is to be a one stop resource for fully identifying, exploiting, and escalating SQL injection vulnerabilities across various Database Management Systems
4-
ogImageLink: https://sqlwiki.netspi.com/assets/images/facebookCard.jpg
5-
twitterImageLink: https://sqlwiki.netspi.com/assets/images/twitterCard.jpg
2+
keywords: netspi, sql injection, wiki, sqli, sql, injection, netspy, network security professionals, oracle, mysql, sqlserver, mssql, cheat sheet, cheat, sheet
3+
ogImageLink: /assets/images/facebookCard.jpg
4+
twitterImageLink: /assets/images/twitterCard.jpg
65
title: NetSPI SQL Injection Wiki

‎attackQueries/dataExfiltration/index.html

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
---
22
layout: tab
3-
4-
5-
3+
description: Exfiltrating data through SQL Injection allows easier data analysis, as well as an offline copy of any compromised data.
4+
keywords: data exfiltration, exfiltration, breach
5+
Title: Data Exfiltration | NetSPI SQL Injection Wiki
66
tabs:
77
- title: MySQL
88
shortName: mysql
@@ -13,4 +13,4 @@
1313
- title: SQL Server
1414
shortName: sqlserver
1515
fileName: sqlserver.html
16-
---
16+
---

‎attackQueries/dataTargeting/index.html

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
---
22
layout: tab
3-
4-
5-
3+
description: Being able to properly target and identify sensitive information can exponentially decrease time spent in a database.
4+
title: Data Targeting | NetSPI SQL Injection Wiki
5+
keywords: data targeting, sql injection data, breach data
66
tabs:
77
- title: MySQL
88
shortName: mysql
@@ -13,4 +13,4 @@
1313
- title: SQL Server
1414
shortName: sqlserver
1515
fileName: sqlserver.html
16-
---
16+
---

‎attackQueries/executingOSCommands/index.html

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
---
22
layout: tab
3-
4-
5-
3+
description: Running OS commands is one of the primary objectives of SQL injection, this aids in getting full control of the host OS.
4+
keywords: os command, operating system command, command injection
5+
title: OS Commands | NetSPI SQL Injection Wiki
66
tabs:
77
- title: MySQL
88
shortName: mysql

‎attackQueries/index.html

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
---
22
layout: default
3+
description: After verifying a SQL injection, all of these methods can be used to further exploit the database.
4+
title: Attack Queries | NetSPI SQL Injection Wiki
5+
keywords: attack queries
36
---
47
<h3 id="sql-injection-detection">Attack Queries</h3>
58
<p class="readableText">Once the injectable parameters and DBMS type are identified we need to attack the database. Below you will find various section to aid you in escalating privileges, exfiltrating data, and more.</p>

‎attackQueries/informationGathering/index.html

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
---
22
layout: tab
3-
4-
5-
3+
description: It is often valuable to gather information about any testing environment; version numbers, user accounts, and databases all help in escalating vulnerabilities.
4+
keywords: information gathering, information, data, gathering
5+
title: Information Gathering | NetSPI SQL Injection Wiki
66
tabs:
77
- title: MySQL
88
shortName: mysql
@@ -13,4 +13,4 @@
1313
- title: SQL Server
1414
shortName: sqlserver
1515
fileName: sqlserver.html
16-
---
16+
---

‎attackQueries/lateralMovement/index.html

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
---
22
layout: tab
3-
4-
5-
3+
description: Lateral movement allows a tester to gain access to different sets of functionality/data that don't explicitly require a more privileged user.
4+
title: Lateral Movement | NetSPI SQL Injection Wiki
5+
keywords: privilege escalation, lateral, movement, lateral movement, privilege
66
tabs:
77
- title: MySQL
88
shortName: mysql
@@ -13,4 +13,4 @@
1313
- title: SQL Server
1414
shortName: sqlserver
1515
fileName: sqlserver.html
16-
---
16+
---

‎attackQueries/parameterManipulation/index.html

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
---
22
layout: tab
3-
4-
5-
3+
description: Manipulating parameters aids in bypassing Web Application Firewalls, Anti-Virus scanners, and allows obfuscation of the injection string.
4+
keywords: parameter manipulation, obfuscation, waf, web application firewall
5+
title: Parameter Manipulation | NetSPI SQL Injection Wiki
66
tabs:
77
- title: MySQL
88
shortName: mysql
@@ -13,4 +13,4 @@
1313
- title: SQL Server
1414
shortName: sqlserver
1515
fileName: sqlserver.html
16-
---
16+
---

‎attackQueries/parameterManipulation/mysql.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<h3 id="parameter-manipulation">Parameter Manipulation</h3>
22

3-
<p class="injectionDescription">Manipulating parameters aids in bypassing Web Application Firewalls, Anti-Virus scanners, and allows modification of various SQL queries for unique situations.</p>
3+
<p class="injectionDescription">{{site.data.injectionDescriptions.parameterManipulation}}</p>
44

55
<table class="table table-striped table-hover">
66
<thead>

‎attackQueries/parameterManipulation/oracle.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<h3 id="parameter-manipulation">Parameter Manipulation</h3>
22

3-
<p class="injectionDescription">Manipulating parameters aids in bypassing Web Application Firewalls, Anti-Virus scanners, and allows modification of various SQL queries for unique situations.</p>
3+
<p class="injectionDescription">{{site.data.injectionDescriptions.parameterManipulation}}</p>
44

55
<table class="table table-striped table-hover">
66
<thead>

‎attackQueries/parameterManipulation/sqlserver.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<h3 id="parameter-manipulation">Parameter Manipulation</h3>
22

3-
<p class="injectionDescription">Manipulating parameters aids in bypassing Web Application Firewalls, Anti-Virus scanners, and allows modification of various SQL queries for unique situations.</p>
3+
<p class="injectionDescription">{{site.data.injectionDescriptions.parameterManipulation}}</p>
44

55
<table class="table table-striped table-hover">
66
<thead>

‎attackQueries/persistence/index.html

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
---
22
layout: tab
3+
description: Gaining persistence on a system creates a semi-permanent foothold in the network, allowing prolonged exploitation time.
4+
keywords: persistence, network, foothold
5+
title: Persistence | NetSPI SQL Injection Wiki
36
tabs:
47
- title: MySQL
58
shortName: mysql

‎attackQueries/privilegeEscalation/index.html

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
---
22
layout: tab
3+
description: Certain functionalities require a privileged user and for escalating a vulnerability a privileged user is always the first step.
4+
keywords: privilege escalation, dba, dbo, admin, administrator
5+
title: Privilege Escalation | NetSPI SQL Injection Wiki
36
tabs:
47
- title: MySQL
58
shortName: mysql

‎attackQueries/readingAndWritingFiles/index.html

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
---
22
layout: tab
3-
4-
5-
3+
description: Reading and writing to files aids in data gathering as well as data exfiltration.
4+
keywords: data gathering, reading and writing, reading, writing
5+
title: Reading and Writing Files | NetSPI SQL Injection Wiki
66
tabs:
77
- title: MySQL
88
shortName: mysql
@@ -13,4 +13,4 @@
1313
- title: SQL Server
1414
shortName: sqlserver
1515
fileName: sqlserver.html
16-
---
16+
---

‎dbmsIdentification/index.html

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,8 @@
11
---
22
layout: tab
3-
4-
3+
description: Detecting what Database Management System (DBMS) is being used is critical in being able to further exploit an injection.
4+
keywords: dbms identification, what, database, what kind
5+
title: DBMS Identification | NetSPI SQL Injection Wiki
56
tabs:
67
- title: MySQL
78
shortName: mysql

‎detection.html

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
---
22
layout: default
3+
description: SQL injections can be detected in a number of ways, use these methods to help you start your escalation path.
4+
keywords: sql injection detection, detection, blind sql injection, error based sql injection
5+
title: Detection | NetSPI SQL Injection Wiki
36
---
47
<h3 id="sql-injection-detection">SQL Injection Detection</h3>
58
<p class="injectionDescription">{{site.data.injectionDescriptions.injectionDetection}}</p>

‎index.html

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
---
22
layout: default
3+
description: A one stop resource for fully identifying, exploiting, and escalating SQL injection vulnerabilities across various Database Management Systems.
4+
title: NetSPI SQL Injection Wiki
35
---
46

57
<h2 id="header">Welcome to the NetSPI SQL Injection Wiki!</h2>

‎injectionTechniques/conditionalStatements/index.html

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
---
22
layout: tab
3-
4-
5-
3+
description: Conditional statements are beneficial for creating complex queries and aiding in Blind SQL Injection.
4+
title: Conditional Statements | NetSPI SQL Injection Wiki
5+
keywords: conditional statements, if, case, statement
66
tabs:
77
- title: MySQL
88
shortName: mysql
@@ -13,4 +13,4 @@
1313
- title: SQL Server
1414
shortName: sqlserver
1515
fileName: sqlserver.html
16-
---
16+
---

‎injectionTechniques/index.html

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
---
22
layout: default
3+
description: The following techniques will aid in gaining first exploitation of a new SQL Injection.
4+
keywords: techniques, how-to, obfuscation, placement, conditional statements
5+
title: Injection Techniques | NetSPI SQL Injection Wiki
36
---
47
<h3 id="sql-injection-detection">Injection Techniques</h3>
58
<p class="readableText">Below are a couple techniques to aid you in exploiting various SQL injections.</p>

‎injectionTechniques/injectionPlacement/index.html

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
---
22
layout: tab
3-
4-
5-
3+
description: SQL injection is always a hassle when it isn't apparent where the injection is taking place. Here are the most common places.
4+
keywords: injection placement, placement, where
5+
title: Injection Placement | SQL Injection Wiki
66
tabs:
77
- title: MySQL
88
shortName: mysql
@@ -13,4 +13,4 @@
1313
- title: SQL Server
1414
shortName: sqlserver
1515
fileName: sqlserver.html
16-
---
16+
---

‎injectionTechniques/obfuscation/index.html

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
---
22
layout: tab
3-
4-
5-
3+
description: Obfuscating SQL Injection queries aids in bypassing Web Application Firewalls (WAFs) and Intrusion Detection/Prevention Systems (IDS/IPS).
4+
keywords: waf, ids, ips, obfuscation, query, manipulation
5+
title: Obfuscation | NetSPI SQL Injection Wiki
66
tabs:
77
- title: MySQL
88
shortName: mysql
@@ -13,4 +13,4 @@
1313
- title: SQL Server
1414
shortName: sqlserver
1515
fileName: sqlserver.html
16-
---
16+
---

‎injectionTypes/blindBased/index.html

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
---
22
layout: tab
3-
4-
5-
3+
description: Blind SQL injection is one of the more advanced methods of injection. The Partial-Blind and Full-Blind methods are detailed below.
4+
title: Blind Based Injection | NetSPI SQL Injection Wiki
5+
keywords: blind, blind based, blind-based
66
tabs:
77
- title: MySQL
88
shortName: mysql
@@ -13,4 +13,4 @@
1313
- title: SQL Server
1414
shortName: sqlserver
1515
fileName: sqlserver.html
16-
---
16+
---

‎injectionTypes/errorBased/index.html

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
---
22
layout: tab
3-
4-
5-
3+
description:Error based SQL Injections are exploited through triggering errors in the database when invalid inputs are passed to it.
4+
title: Error Based Injection | NetSPI SQL Injection Wiki
5+
keywords: error based, error-based, error
66
tabs:
77
- title: MySQL
88
shortName: mysql
@@ -13,4 +13,4 @@
1313
- title: SQL Server
1414
shortName: sqlserver
1515
fileName: sqlserver.html
16-
---
16+
---

‎injectionTypes/index.html

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
---
22
layout: default
3+
description: These sections identify the main types of SQL Injection that can be found and how to exploit certain scenarios within those injection types.
4+
title: Injection Types | NetSPI SQL Injection Wiki
5+
keywords: error, union, blind, based
36
---
47
<h3 id="sql-injection-detection">Injection Types</h3>
58
<p class="readableText">The sections below identify the main types of injections that can be found and how to exploit certain scenarios within those injection types.</p>

‎injectionTypes/unionBased/index.html

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
---
22
layout: tab
3-
4-
5-
3+
description: Union based SQL Injection allows an attacker to extract information from the database by extending the results returned by the original query.
4+
title: Union Based Injection | NetSPI SQL Injection Wiki
5+
keywords: union, union based, union-based
66
tabs:
77
- title: MySQL
88
shortName: mysql
@@ -13,4 +13,4 @@
1313
- title: SQL Server
1414
shortName: sqlserver
1515
fileName: sqlserver.html
16-
---
16+
---

‎misc/contributors.html

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
11
---
22
layout: default
3+
description: Huge amounts of thanks to all of our contributors!
4+
keywords: contributors
5+
title: Contributors | NetSPI SQL Injection Wiki
36
---
47
<h3>Special thanks to our contributors:</h3>
58
<ul>

0 commit comments

Comments
 (0)