Hacking Web Servers, Web Applications, and SQL Injection
Web servers
Server-focused attacks target configuration and patching: banner grabbing, default or weak credentials, unnecessary HTTP methods (PUT/DELETE/TRACE), directory traversal, misconfigured permissions, exposed admin panels, virtual host enumeration, and known IIS/Apache/Nginx vulnerabilities. Hardening means removing sample files, disabling directory listing and unused modules, least-privilege service accounts, TLS configuration, and patch management.
Web applications
Anchor study in the OWASP Top 10: broken access control, cryptographic failures, injection, insecure design, security misconfiguration, vulnerable components, identification/authentication failures, software and data integrity failures, logging failures, and SSRF. Know the mechanisms: XSS (reflected, stored, DOM-based) executes script in a victim's browser; CSRF forces a logged-in victim's browser to send a request; IDOR exposes objects by manipulating identifiers; SSRF makes the server fetch internal resources; XXE abuses XML external entities; plus file upload, command injection, and insecure deserialization.
SQL injection
Classify by channel: in-band (error-based, UNION-based), inferential/blind (boolean, time-based), and out-of-band (DNS/HTTP exfiltration). Know the signatures: ' OR 1=1 -- tautology, UNION SELECT, stacked queries, and database-specific tricks - MySQL SLEEP(5)/LOAD_FILE/INTO OUTFILE, MSSQL WAITFOR DELAY '0:0:5' and xp_cmdshell, Oracle UTL_HTTP. The primary fix is parameterized queries/prepared statements, supported by least-privilege database accounts, input validation, and a WAF.
Traps
A WAF is a mitigation, not a fix. Escaping quotes is not sufficient protection. Blind SQLi is confirmed by response timing or boolean differences, not by error messages.
Worked example
A parameter returns no errors and no extra rows, but adding ' AND SLEEP(5)-- - delays the response by five seconds. Rule of thumb: delay proves injection - this is time-based blind SQLi, exploitable with sqlmap's --technique=T even though nothing is displayed.