Oracle SQL Injection | Database Recon

This article will elaborate how I observe specific keywords and endpoints that helps in guessing the database type without any automated fingerprinting.

Find endpoints where most likely it will be interacting with the database for this endpoint to function.

Capture and intercept the request using Burpsuite

What do you observe here that is worth googling to narrow down the attack?

Now we minimize part by part by and search with some variations to get some information about what we are dealing with.

We save this endpoint along with the product used, when new CVE is assigned with public exploit, we immediately attack it (Only if in scope)

Basic Googling: Sort/Filter by date and get the latest crawled results.

Check the complete video about where and how to inject the payloads with basic encoding.