http://www.hackingzone.org/sql/ its a SQL injection game , so it just trains ppl to sql inject nothing more , if anybody have a good DETAILED tutorial about SQL injection , i would appreciate it , thnx

Sorry for just posting a google link, but this search came up with a lot of good resources...

http://www.google.com/search?q=SQL%20Injec...=utf-8&oe=utf-8

Remember guys/gals- Please do little searching before you post, this could have easily been a "Hey all, look what i found!" post, instead of it being a "Where do i find this..." post...

oh, and thanks for the wargame link- these can be fun (and sometimes even informative ) .

-have a great day!

I wouldn't exactly call this a tutorial, more of a training device. It requires appache (win32 is fine), TomCat and the Jave SDK 5.0 or better

http://www.owasp.org/development/webgoat

About WebGoat

Web application security is difficult to learn and practice. Very few people have full blown web applications like online book stores or online banks that can be used to search for vulnerabilities. In addition, security professionals frequently need to test tools against a known vulnerable platform to ensure they perform as advertised.

All of this needs to happen in a safe and legal environment; we believe you should never attempt to find vulnerabilities without permission, even if your intentions are good.

WebGoat is based on the concept of teaching a user a real world lesson and then asking the user to demonstrate their understanding by exploiting a real vulnerability on the local system. The system is even clever enough to provide hints and show the user cookies, parameters and the underlying Java code if they choose. Examples of lessons include SQL injection to a fake credit card database, where the user creates the attack and steals the credit card numbers.

Current lessons include;

Cross Site Scripting
SQL Injection
Thread Safety
Hidden Form Field Manipulation
Parameter Manipulation
Weak Session Cookies
Fail Open Authentication
Dangers of HTML Comments

thnx alot guys for ur help

Pretty Cool site...

kinda like those hackit wargames fun in spare timelol

webgoat is so neat i cant wait for the next version...

this forum has a lot of tutorials in it as well

10q all!

Yeah, that wargame is pretty cool, I know the person who runs it - I'm sure he appreciates the publicisation of it, thanks.

Please guys, we're trying to weed out the crap here - search google first. We're not magical you know. Searching for "sql injection paper" will return great results; what makes you think we can do better than that?

Also Comsec has written a basic tutorial on SQL injection - read that first to get the ideas before progressing onto the more complex stuff.


-Shaun.

funny for sure