Beginner php programmer or how to start earning money. Instructions for using jSQL Injection - a multifunctional tool for searching and exploiting SQL injections in Kali Linux Companies inurl img php id

Any search for vulnerabilities on web resources begins with reconnaissance and information collection.
Intelligence can be either active - brute force of files and directories of the site, running vulnerability scanners, manually browsing the site, or passive - searching for information in different search engines. Sometimes it happens that a vulnerability becomes known even before opening the first page of the site.

How is this possible?
Search robots, constantly roaming the Internet, in addition to information useful to the average user, often record things that can be used by attackers to attack a web resource. For example, script errors and files with sensitive information (from configuration files and logs to files with authentication data and database backups).
From the point of view of a search robot, an error message about executing an sql query is plain text, inseparable, for example, from the description of products on the page. If suddenly a search robot came across a file with the .sql extension, which for some reason ended up in the site’s working folder, then it will be perceived as part of the site’s content and will also be indexed (including, possibly, the passwords specified in it).

Such information can be found by knowing strong, often unique, keywords that help separate “vulnerable pages” from pages that do not contain vulnerabilities.
A huge database of special queries using keywords (so-called dorks) exists on exploit-db.com and is known as the Google Hack Database.

Why google?
Dorks are primarily targeted at Google for two reasons:
− the most flexible syntax of keywords (shown in Table 1) and special characters (shown in Table 2);
− the Google index is still more complete than that of other search engines;

Table 1 - Main Google keywords