☣ About

29 thoughts on “☣ About”

1. Hi,could you please recommand some books about information security?I’m interested in this method but have no idea what to learn.Thanks!!

   Reply
2. I’m new students from ICT collage, n begin to study n intererst about PenTest, Forensic. Could you guide or give me some artikel or book.
   Thanks

   Reply
3. Hi,
   This blog is really impressive actually.
   The number of acknoledgments you have is too damn high… Congratz.

   If you can mail me the same things you mailed to the others before I would be thankful.

   I read your whitepaper about SQLi on insert/update/delete. It was really interesting but unfortunately most of the techniques seem to apply only on MySQL. Moreover, I think this is really straight forward and you should try to explain a little more what you do, and give some screenshot of what you obtain.
   For instance, the article about the linkedIn vulnerability was more comprehensible.

   Anyway, I think you should keep writing articles because you seem to have a talent in PenTest.

   Good luck for your studies.

   Reply
4. ????????QQ?297210281????????????????????????

   Reply
5. Hey bro, send me a mail I miss you lot and want to see you in a new place. Tom

   Reply
   • Hey bro! send me your email 🙂

     Reply
     • add me on jabber: yourfriend@siph0n.pw miss ya

6. hai osanda ,

   i have been read your ebook about SQLi, very interesting but i have question in one part about SQLi especially at Insert statement. what’s type payload that we can add at insert statement ??
   for example i have web (vulnerable) for security test purpose. the form is only for insert statement for example “contact us”. it have 4 field and i set one field can be injected (no filtering character). now what we can do with this hole ?? if there’s is a page that display data from “contact us” then i can do more about SQli and lookup the result of injection , but the condition is not. there is no display page result for injection. may be you know ? need explain more , thank you 🙂

   Reply
   • Hello mahendra,

     My name is Kavishka Gihan. I am not an expert in SQLi but I think I could give you some kind of an explanation that may help you.

     So first things first, if you ever find a SQLi vulnrability somewhere, most of the time it would be either a Blind SQLi or UNION based injection. Try injecting a SQLi statement with wrong syntax ( ?id=1 ‘ something-here ). If you can see an error showing up in the web page, that means you have direct SQLi but if doesn’t you may have to use blind SQLi techniques. If simply said, by making the web app sleep for 10 seconds.

     So your main question was what we could do with insert statements and what kind of payloads we can use with insert statements. With the insert statement you can insert values to a database. First you will have to check the permissions for the database you want to insert data to. (For that you can use information_schema database ). If you have write permissions you can move on.But in most modern websites insert permissions are disabled. Suppose that you have a login functionality in the website. In that case you can try to insert another user with a username and a password so that you can login to the login form (but also you can try to do SQLi in the login form too).

     [ INSERT INTO table_name (column1, column2, column3, …) VALUES (value1, value2, value3, …); ]

     That’s the kind of like the main thing we can do. And again there are many advanced exploitation techniques with SQLi. I just wanted you to know the basic injections we can do. Hope this was helpful

     If I have presented any wrong facts please let me know, because I am a learner too.You can always contact me.

     instagram — @_kavi.gihan

     Reply
7. i have been read your ebook about SQLi, very interesting but i have question in one part about SQLi especially at Insert statement. what’s type payload that we can add at insert statement ??
   for example i have web (vulnerable) for security test purpose. the form is only for insert statement for example “contact us”. it have 4 field and i set one field can be injected (no filtering character). now what we can do with this hole ?? if there’s is a page that display data from “contact us” then i can do more about SQli and lookup the result of injection , but the condition is not. there is no display page result for injection. may be you know ? need explain more , thank you 🙂

   Reply
   • Use blind injection or time based injection techniques.

     Reply
8. hey bro, can i ask, what your age today? you look young but smart. can you teach me? hehehe..

   Reply
   • Can you guess? Hopefully I’m still in my wild teens 😉

     Reply
9. Hello! I read your all posts and I was surprised because of your knowledge and your writing skils(Your posts are easy to understand. You are a good teacher to me! 🙂 ).
   I’ve been learned about XSS.
   I have a question about XSS. Would you like to response about my question?
   Could we bypass XSS filter even if we can’t use (it will remove in website), and encoding such as %lt or some unicode? (I got various fuzz date for XSS but I can’t find about this!)
   It is impossible to bypass ? 🙁
   Thank you for reading my comment. I will wait your re-comment!
   (I want to send e-mail to you but I couldn’t find it. So I left a reply here. Sorry! Probably this is not good with this category…)

   Reply
   • Hello Sunari,

     Thanks for the feedback 🙂 Nothing is impossible 😉 yes you can depending on how the filter is coded by the developer 🙂

     Reply
10. hello Osanda,
    Could you send me email to discuss some security issues with you. This is my email.
    sarah200200200@hotmail.com

    Reply
11. Hello Osanda

    Can you send me your email , if you dont mind . I have an issue to discuss with you please

    BR

    Anuradha

    Reply
12. Hi Osanda

    I am looking for a person who can be engaged CREST certified Penetration tester for one of our application

    Pls kindly contact me – Thanuj 077377745

    Reply
13. Hi brother, I’m a C#, WPF, WCF developer and hope to enter the ethical hacking field. Let me know first of all where should I get my start. I have not an idea to follow some degree or course. I want to learn this alone. Please give me support!

    Reply
14. hakyoql5kl5aauc1jezg8yltksdy4fzkw1mq

    Reply
15. godak asai aiye hacking iganaganna
    ”””;;;;;;…patan ganna thanak kiyala denavada//

    Reply
16. Impressive work. Keep it up!!!

    Reply
17. Hello,

    Thank you for your blog, amazing resources for those who are starting in the cybersecurity path.
    Could you advise me, please?

    I am deciding three courses to do exam of certifications in three cybersecurity courses in elearnSecurity PTP v5 and OSCP.

    1.The other course would be between these other courses:
    masptv2 ihrpv1 mapv1 rep dfp

    2. how match OSCE to a course in elearnsecurity? probably PTX? If it is similar to any course like PTX, If I would have to choose my investment in one, which one would you recommend me?

    Thank you

    Reply
    • I would recommend doing PTX if you wanna move forward in the pentesting field.

      Reply
18. Your Blog is totally Awesome…with lots of technical stuffs to learn

    Reply
    • Thank you ?

      Reply
19. i’m interested in ‘CTF , Reverse_Engineering, Malware Analysis ‘… Can i get your email id to gain more real-time knowledge… please!

    Reply
20. Could you assist me in learning

    Reply
21. Your BLOG is awesome,
    I like to start learning Reverse Engineering. Where can I start my learning process ?

    Reply