SQL Injection

A blind SQL injection was found on id.indrive.com that allowed an attacker to retrieve information from the database by using conditional responses.

An application might carry out the same SQL query as the previous example but do it asynchronously.

Today, I’m explaining the exploitation of the error-based SQL injection via XPATH injection. This vulnerability was discovered during a private pen-test engagement.