[null, null, {"document_url": "https://osandamalith.com/category/web-application-security/page/2/", "unformatted_src": "https://i1.wp.com/i.imgur.com/bMJxB9m.png", "src": "https://i1.wp.com/i.imgur.com/bMJxB9m.png", "formatted_filename": "bMJxB m"}, null, {"document_url": "https://osandamalith.com/category/web-application-security/page/2/", "unformatted_src": "https://msdnshared.blob.core.windows.net/media/TNBlogsFS/BlogFileStorage/blogs_technet/swi/WindowsLiveWriter/IE8XSSFilterArchitectureImplementation_7E69/pic1_thumb.png", "src": "https://msdnshared.blob.core.windows.net/media/TNBlogsFS/BlogFileStorage/blogs_technet/swi/WindowsLiveWriter/IE8XSSFilterArchitectureImplementation_7E69/pic1_thumb.png", "formatted_filename": "pic thumb"}, null, null, {"document_url": "https://osandamalith.com/category/web-application-security/page/2/", "unformatted_src": "https://www.buymeacoffee.com/assets/img/custom_images/orange_img.png", "src": "https://www.buymeacoffee.com/assets/img/custom_images/orange_img.png", "formatted_filename": "orange img", "alt_text": "Buy Me A Coffee"}, null]
Starting from MySQL 5.5 and above the default storage engine was known as the InnoDB. In MySQL versions 5.5 and above if you do a “select @@innodb_version” you can see the version of the InnoDB, which is almost same as your MySQL version. But in MySQL 5.6 and above I noticed 2 new tables by InnoDB. “innodb_index_stats” and “innodb_table_stats”. Both these tables contains the database and table names of all the newly created databases and tables.
The MySQL documentation explains these two tables as follows.

The persistent statistics feature relies on the internally managed tables in the mysql database, named innodb_table_stats and innodb_index_stats. These tables are set up automatically in all install, upgrade, and build-from-source procedures.

For injection purposes let’s take the “innodb_table_stats” table. Unfortunately InnoDB doesn’t store columns.

If you simply do “show tables in mysql” you can view this from your localhost.


D-Link DIR-615
Hardware Version: E3
Firmware Version: 5.10

The ‘apply.cgi’ file was vulnerable to Open Redirection and XSS. Inside the router many other cgi files too use this functionality in ‘apply.cgi’. For example the ‘ping_response.cgi’ file.

Open Redirection



Today one of my friends @RakeshMane10 gave me a challenge which I found pretty interesting. 

IE and Edge both uses a default XSS filter which is not powerful like the XSSAuditor(Webkit/Blink).
This is how the XSS filter is implemented. (source: https://blogs.technet.microsoft.com/srd/2008/08/19/ie-8-xss-filter-architecture-implementation/) I made some interesting SQLi challenges based on some real world experiences 🙂 Give it a shot to test your SQLi skills 😉


Thank you very much for more than 100 likes !

My friend @OsandaMalith started building a site with SQLi challenges based on the cases that he found in real life: breakthisqli.rf.gd

(@hasherezade) July 21, 2016

It’s possible to store a EXE file inside a MySQL database. You can try this out. For demonstration purposes I’m running MySQL in my localhost. I will be creating a simple database and a table big enough to store the exe file. Since we convert the exe to a hex file the content would be larger than the original exe file. I will be using ‘putty.exe’ as the binary.








 🔐Blog of Osanda