--- title: "#sql-injection articles | Hashnode" description: "Explore 56 articles tagged #sql-injection on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/sql-injection" --- Tag # #sql-injection 56 posts · 4 followers [Hareeshwar N K](https://hashnode.com/@H4x0rGh0st) · [Oct 30](https://hashnode.com/posts/when-the-database-talks-back-blind-sqli-data-exfiltration-over-dns/6ae41ee471b5a8dbb4e7f2f0) ### [When the Database Talks Back: Blind SQLi Data Exfiltration Over DNS](https://hareeshwarnk.hashnode.dev/when-the-database-talks-back-blind-sqli-data-exfiltration-over-dns?utm_source=hashnode&utm_medium=feed) A PortSwigger Practitioner lab where a quoted string literal blocked my first payload, and rebuilding the concatenation at SQL level turned the admin password into a DNS label. 6 min read · [hareeshwarnk.hashnode.dev](https://hareeshwarnk.hashnode.dev/when-the-database-talks-back-blind-sqli-data-exfiltration-over-dns?utm_source=hashnode&utm_medium=feed) [404 Founders](https://hashnode.com/@404-founders) · [Oct 29](https://hashnode.com/posts/oracle-ebs-cve-2026-101767-tcf-servlet-rce/6ae358c4e76a8381d87fe36a) ### [Oracle EBS CVE-2026-101767: Unauthenticated SQL Injection That Chains to RCE](https://404-founders.com/blog/oracle-ebs-cve-2026-101767-tcf-servlet-rce?utm_source=hashnode&utm_medium=feed) CVE-2026-101767 chains SQL injection through Oracle EBS TCF servlet to OS command execution. Probing started one day after the October 2026 CPU patch. 5 min read · [404-founders.com](https://404-founders.com/blog/oracle-ebs-cve-2026-101767-tcf-servlet-rce?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Oct 12](https://hashnode.com/posts/tryhackme-plottedtms-writeup/6acce2b1df63bf7d3af1baa0) ### [TryHackMe: PlottedTMS Writeup](https://exploitnotes.hashnode.dev/tryhackme-plottedtms-writeup?utm_source=hashnode&utm_medium=feed) Explore the TryHackMe Plotted room walkthrough covering SQL injection, PHP web shell upload,cron-based privilege escalation, and doas misconfiguration 8 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/tryhackme-plottedtms-writeup?utm_source=hashnode&utm_medium=feed) [Ciphemic academia](https://hashnode.com/@ciphemicacademia) · [Oct 13](https://hashnode.com/posts/sql-injection-vs-xss-vs-csrf-1-million-users-in-20-hours-and-a-400-000-fine/6acd8dff748cb8132c432949) ### [SQL Injection vs. XSS vs. CSRF: 1 Million Users in 20 Hours and a £400,000 Fine](https://ciphemicacademia.hashnode.dev/sql-injection-vs-xss-vs-csrf-1-million-users-in-20-hours-and-a-400-000-fine?utm_source=hashnode&utm_medium=feed) A worm hit 1 million users in 20 hours. A breach drew a record fine. Three web attacks, and who each one fools. 15 min read · [ciphemicacademia.hashnode.dev](https://ciphemicacademia.hashnode.dev/sql-injection-vs-xss-vs-csrf-1-million-users-in-20-hours-and-a-400-000-fine?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Oct 12](https://hashnode.com/posts/tryhackme-gallery-writeup/6acce4c9df3ff43cd5520a9b) ### [TryHackMe: Gallery Writeup](https://exploitnotes.hashnode.dev/tryhackme-gallery-writeup?utm_source=hashnode&utm_medium=feed) Explore the TryHackMe Gallery walkthrough covering SQL injection, PHP webshell upload, leaked credentials, sudo misconfiguration, and nano privilege. 7 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/tryhackme-gallery-writeup?utm_source=hashnode&utm_medium=feed) [Trust Boundary](https://hashnode.com/@trustboundarystudio) · [Oct 12](https://hashnode.com/posts/ai-agents-broke-into-27-online-shops-for-25-a-company/6acc760403e72758d7981bfd) ### [AI agents broke into 27 online shops for $25 a company](https://trustboundarystudio.hashnode.dev/ai-agents-broke-into-27-online-shops-for-25-a-company?utm_source=hashnode&utm_medium=feed) AI agents broke into 27 online shops for $25 a company 12 min read · [trustboundarystudio.hashnode.dev](https://trustboundarystudio.hashnode.dev/ai-agents-broke-into-27-online-shops-for-25-a-company?utm_source=hashnode&utm_medium=feed) [Iliya](https://hashnode.com/@callmeiliya) · [Sep 29](https://hashnode.com/posts/intigriti-september-2026-challenge-critter-gallery/6abb2c79f437abd9cbfc05b8) ### [Intigriti September 2026 Challenge, Critter Gallery](https://blog.iliyadindar.site/intigriti-september-2026-challenge-critter-gallery?utm_source=hashnode&utm_medium=feed) A blank 200 error page, a one-column UNION, and a base64 parameter that hid it all. 8 min read · [blog.iliyadindar.site](https://blog.iliyadindar.site/intigriti-september-2026-challenge-critter-gallery?utm_source=hashnode&utm_medium=feed) [404 Founders](https://hashnode.com/@404-founders) · [Sep 28](https://hashnode.com/posts/roundcube-cve-2026-48842-pre-auth-sql-injection-exploited/6aba5125a40c8a99898c81fe) ### [Roundcube CVE-2026-48842: Pre-Auth SQL Injection Exploitation Reported](https://404-founders.com/blog/roundcube-cve-2026-48842-pre-auth-sql-injection-exploited?utm_source=hashnode&utm_medium=feed) The optional virtuser\_query plugin is affected. Roundcube fixed the flaw in 1.6.16 and 1.7.1. 2 min read · [404-founders.com](https://404-founders.com/blog/roundcube-cve-2026-48842-pre-auth-sql-injection-exploited?utm_source=hashnode&utm_medium=feed) [Yogeshwar Peela](https://hashnode.com/@exploitnotes) · [Sep 10](https://hashnode.com/posts/tryhackme-olympus-writeup/6aa27ae3a238c961e5e2b2b7) ### [TryHackMe - Olympus Writeup](https://exploitnotes.hashnode.dev/tryhackme-olympus-writeup?utm_source=hashnode&utm_medium=feed) Olympus TryHackMe writeup covering Victor CMS SQL injection, credential cracking, file upload RCE, SUID abuse, SSH access, and root shell. 10 min read · [exploitnotes.hashnode.dev](https://exploitnotes.hashnode.dev/tryhackme-olympus-writeup?utm_source=hashnode&utm_medium=feed) [ZeroProtocol](https://hashnode.com/@zeroprotocol) · [Aug 13](https://hashnode.com/posts/common-web-application-technologies/6a7e0e84bc892488c6743968) ### [Common Web Application Technologies](https://webpentestingdeepdive.hashnode.dev/common-web-application-technologies?utm_source=hashnode&utm_medium=feed) Learn how Java, ASP.NET, PHP, Rails, SQL, XML, and SOAP work in web applications and where security weaknesses can appear during web pentesting. 7 min read · [webpentestingdeepdive.hashnode.dev](https://webpentestingdeepdive.hashnode.dev/common-web-application-technologies?utm_source=hashnode&utm_medium=feed)