SQL Injecting Beyond Strict Filters - Union Without Comma

00:00 - Introduction 01:57 - Showing the trick and explaining why its important to understand the methodology behind finding the technique and not just the technique itself 03:50 - Going over the Flask App 05:45 - Showing Snyk highlighting the SQL Injection, then talking a little bit about Snyk and why it is awesome. 08:00 - Running the webserver and explaining why DEBUG mode should always be disabled 09:30 - Running SQLMap to inject into the URL Parameter 11:00 - Manually discovering the SQL Injection through good enumeration, and showing a Burpsuite URL Encoding Quirk 12:50 - SQLMap showed nothing, Run SQLMap again but this time make sure it starts with a valid result to see it does find something 13:20 - Going into the code to show why exploitation is hard, I’m using Pydantic to do strict typing and input filtering 17:36 - Showing how SQLMap discovered there were 4 columns without using a comma, thanks to the ORDER BY method 18:55 - Enumerating for bad characters with FFUF