Waraxe IT Security Portal

neel · Beginner

hello everyone , i need some help on understanding a basic thing before making an exploit.Considering , you want to make a sqli exploit , you have to find first the sqli flaw. So , lets say that you find a sqli bug on x random website. So here's my question . How will you know then **what** type/software of system you are penetrating? I mean maybe is CMS / cmsqlite , phpnuke , u know these were examples .Generally how to know the software in order to put a name to your exploit..? For example : Sqli on cms , u understand what i mean Wink

Thx for your time!

waraxe · Site admin

You must look for clues - "powered by" in footer text, administration interface (try directories like admin, acp, admincp,administrator, administration, backend, etc ...),
look at html source - for example path to the website design/theme/skin can reveal software name.
If you see something in html source code, that catches your eye, then google it - usually it does help.
Try generate error messages - use alphanumeric strings instead of numbers, arrays instead of strings (search.php?what[]=test).
Error messages can reveal full path to the software components and other useful insider information.

neel · Beginner

I got it , thx @waraxe ;- )