diff --git a/Prompt Injection/README.md b/Prompt Injection/README.md index 72d072c..368a288 100644 --- a/Prompt Injection/README.md +++ b/Prompt Injection/README.md @@ -62,6 +62,7 @@ Prompt injections can be used in various applications of NLP models. For instance, if you're using a language model to generate a story and you want the story to be about a dragon, you might inject a prompt like "Once upon a time, there was a dragon..." This prompt guides the model to generate a story that includes a dragon. + ### Potential Misuse In the context of security, "prompt injection" could refer to a type of attack where an attacker manipulates the input to a system (the "prompt") in order to cause the system to behave in a way that benefits the attacker. This could involve, for example, injecting malicious code or commands into user input fields on a website. @@ -121,4 +122,5 @@ Indirect Prompt Injection use the memory features of an LLM. - [You shall not pass: the spells behind Gandalf - Max Mathys and Václav Volhejn - 2 Jun, 2023](https://www.lakera.ai/insights/who-is-gandalf) - [Brex's Prompt Engineering Guide](https://github.com/brexhq/prompt-engineering) - [Demystifying RCE Vulnerabilities in LLM-Integrated Apps - Tong Liu, Zizhuang Deng, Guozhu Meng, Yuekang Li, Kai Chen](https://browse.arxiv.org/pdf/2309.02926.pdf) -- [ChatGPT: Hacking Memories with Prompt Injection - wunderwuzzi - May 22, 2024](https://embracethered.com/blog/posts/2024/chatgpt-hacking-memories/) \ No newline at end of file +- [ChatGPT: Hacking Memories with Prompt Injection - wunderwuzzi - May 22, 2024](https://embracethered.com/blog/posts/2024/chatgpt-hacking-memories/) +- [LLM Hacker's Handbook - Forces Unseen](https://doublespeak.chat/#/handbook) \ No newline at end of file diff --git a/SQL Injection/README.md b/SQL Injection/README.md index 28756b7..193911a 100644 --- a/SQL Injection/README.md +++ b/SQL Injection/README.md @@ -33,6 +33,7 @@ Attempting to manipulate SQL queries may have goals including: * [Using Chrome cookie and a Proxy](#using-chrome-cookie-and-a-proxy) * [Using suffix to tamper the injection](#using-suffix-to-tamper-the-injection) * [General tamper option and tamper's list](#general-tamper-option-and-tampers-list) + * [Reduce Requests Number](#reduce-requests-number) * [SQLmap without SQL injection](#sqlmap-without-sql-injection) * [Authentication bypass](#authentication-bypass) * [Authentication Bypass (Raw MD5 SHA1)](#authentication-bypass-raw-md5-sha1) @@ -288,7 +289,17 @@ tamper=name_of_the_tamper |varnish.py | Append a HTTP header 'X-originating-IP' | |versionedkeywords.py | Encloses each non-function keyword with versioned MySQL comment | |versionedmorekeywords.py | Encloses each keyword with versioned MySQL comment | -|xforwardedfor.py | Append a fake HTTP header 'X-Forwarded-For'| +|xforwardedfor.py | Append a fake HTTP header 'X-Forwarded-For' | + + +### Reduce Requests Number + +`--test-filter` is helpful when you want to focus on specific types of SQL injection techniques or payloads. Instead of testing the full range of payloads that SQLMap has, you can limit it to those that match a certain pattern, making the process more efficient, especially on large or slow web applications. + +```ps1 +sqlmap -u "https://lab_host/filter?category=demo" -p category --test-filter="Generic UNION query (NULL)" +``` + ### SQLmap without SQL injection