https://blog.njerumtwaiti.com/tags/fundamentals/ Recent content in Fundamentals on Njeru Mtwaiti Hugo en Mon, 10 Feb 2025 00:00:00 +0000 https://blog.njerumtwaiti.com/posts/sql-injection-zero-to-shell/ Mon, 10 Feb 2025 00:00:00 +0000 https://blog.njerumtwaiti.com/posts/sql-injection-zero-to-shell/ <p>SQL injection is one of the oldest and most consistently exploited vulnerability classes on the web. It&rsquo;s been in the OWASP Top 10 since 2003. It keeps showing up in real engagements, bug bounty reports, and CTF challenges year after year.</p> <p>This post walks through SQL injection end-to-end — detection, manual exploitation, data extraction, and in some cases, a path to remote code execution.</p> <h2 id="how-it-works"> How It Works <a class="heading-link" href="#how-it-works"> <i class="fa-solid fa-link" aria-hidden="true" title="Link to heading"></i> <span class="sr-only">Link to heading</span> </a> </h2> <p>When a web application constructs a SQL query by directly embedding user input, an attacker can manipulate that query&rsquo;s logic.</p>