(12-17-2013, 02:26 AM)Sale0 Wrote: I'm taking a break from any sort of machine based exploitation. I'd like to learn SQL Injection(Blind, Time, String, Union, etc) CSRF, CRLF, PHP-Object Injection, LFD, FPD, LFI, RFI, SSI, and anything else.

So my question, what to learn first? SQL or PHP? What will be easier to learn?

(12-17-2013, 02:28 AM)Adorapuff Wrote: Usually you learn them together in one course. PHP is pretty easy and codeacademy has a really nice intro course, so I would get started there, and move on as needed.

(12-17-2013, 03:21 AM)Pens Wrote: I wouldn't waste you're time learning half this shit you mentioned. A lot of people do what you're looking to do and it just results in a lack of backend understanding. I call it abbreviation syndrome (Kids try to learn as many 'abbreviations' as possible, even if they'll never put the knowledge to use in real world application).

If I were you, I would download some open source projects (coded in a language you're comfortable with) and just start looking through them. Try to look for places where perhaps the user could use the code in other ways than intended; you'll be surprised in what you might be able to do. For example, say you see a function in a PHP script that takes user input and appends it to a SQL query string. Just thinking logically, you can conclude that giving the function SQL commands as input will result in your input being appended and commands executed. This is the right way to learn vulnerabilities (Like SQLi in this case) opposed to memorizing strings from a tutorial. If you want to exploit real world examples - audit real world projects and learn from them.

The above is how I learned the majority of what I know today. Of course, it's extremely helpful to have a mentor to bounce ideas off of and I was lucky to have a few great ones. In the end, I would say it's much more essential know how the bug works than memorizing how to exploit it.

(12-17-2013, 04:01 AM)Sale0 Wrote: But in order for me to know that, wouldn't I have to know PHP and SQL?

Aside from the exploitation part, and solely on the CODING part, what would i start off first with? PHP or SQL, what do you personally recommend?

(12-17-2013, 04:20 AM)Pens Wrote: In regards to web application security - You definitely NEED to know PHP as that's what most of the apps you'll be auditing are coded it. SQL is only used for database management therefore it's not nearly as in depth or as important as the core scripting language used for the applications themselves.

Therefore, PHP.

(12-17-2013, 11:53 PM)Crypt Wrote: Considering you want to learn SQL injection, you'll obviously want to learn SQL so that you actually know what's going on when you inject a site. But if you want to start of easy, then learn PHP.

---

Also, if you need questions with ANY of those site hacking methods, give me a PM