Short post, high signal-to-noise. If you're using Burp Suite for web security testing, there are two extensions we install on every fresh Burp installation before doing anything else. Both are free, both are in the official BApp Store, both take about thirty seconds to install, and both will save you hours the first time you need them.

Wiki reference: Burp Suite/Extensions.

How To Install BApp Store Extensions

For anyone who hasn't installed a Burp extension before:

1. In Burp, go to Extensions → BApp Store
2. Search for the extension name
3. Click "Install"
4. Wait for it to appear in the Installed tab …

Part 5 of our PortSwigger Web Security Academy series. This is the meaty one. We already covered blind SQLi with conditional responses, where the page renders differently depending on the truth of an injected boolean. This post covers what to do when the page doesn't render differently - but you can still smuggle information out by deliberately causing SQL errors.

The example is PortSwigger's Lab 12, which is Oracle-flavored. Full notes: SQL Injection/Blind.

The Six Steps

The full attack has six steps:

1. Prove the parameter is injectable
2. Fingerprint the database
3. Confirm a users table exists
4. Confirm the administrator user exists …

Part 4 of our PortSwigger Web Security Academy series. This one covers blind SQL injection with conditional responses, which is the easier of the two blind SQLi flavors we work through in this series.

Wiki notes: SQL Injection/Blind.

The Setup

Some SQL injection vulnerabilities never give you a direct channel back for the query results. The application runs a SQL query with your input, but the response doesn't render the result or leak database errors. The canonical example is a cookie tracking ID: the ID gets used in a SQL query on every request, but the query output is …

Part 3 of our PortSwigger Web Security Academy series. Part 2 sketched the four SQL injection shapes at a bird's-eye view. This post drills into one of them: the UNION attack. It is one of the most useful shapes to understand because it converts a small SQLi foothold into an "I can read anything in the database" primitive.

Wiki reference: SQL Injection/UNION Attack.

The Idea

Say a page runs

SELECT name, description FROM products WHERE category = 'Gifts'

The columns you can see in the response are name and description, because that is what the query is selecting. UNION lets …

This is part 2 of our series on working through the PortSwigger Web Security Academy. This one covers SQL injection at a bird's-eye view - the four main attack shapes that show up over and over, with the smallest possible example of each. Later posts will drill into specific attack types.

Full notes on our wiki: SQL Injection.

What SQL Injection Is

SQL injection is a web security bug that lets attackers execute their own SQL against your database, by taking advantage of user inputs that are not sanitized before being pasted into a SQL query.

The reason it is worth …

This post is part 1 of a series. We spent a chunk of May and June 2023 working through the PortSwigger Web Security Academy labs, mostly the SQL injection track, and taking notes on our wiki as we went. This post is the setup - what the Academy is, why we picked it, and how it fits together. The posts that follow will cover the specific techniques.

What the Academy Is

PortSwigger makes Burp Suite, which is the standard tool for web application security testing. They also run a free online academy at portswigger.net/web-security, which consists of written lessons …

A quick post that details a useful operation: copying LetsEncrypt certificates from one machine to another.

(We also cover our use case: setting up certificates for private VPN networks that use public DNS entries.)

HTTPS, SSL Certificates, and LetsEncrypt

As a bit of background, the whole reason this is necessary, the whole reason we are dealing with the hassle of setting up SSL certificates, is to enable end-to-end encrypted connections to a server.

For example …

• Introduction

  • What Does Stunnel Do?
  • How Does Stunnel Work?

• Setting Up an Stunnel Server

  • Charlesreid1.com Resources for Stunnel Servers

• Setting Up an Stunnel Client

• Example Protocols

• Stunnel with Docker

• Troubleshooting Stunnel Connections

• References

Introduction

What Does Stunnel Do?

Stunnel is a tool for creating SSL tunnels between a client and a server.

Creating SSL connections is a general task that is very useful. In particular, any packet of any protocol can always be wrapped in an additional SSL layer, with packets embedded within packets, so this means you can wrap arbitrary traffic protocols in SSL using Stunnel.

Stunnel requires …