Repository navigation

Sqli canary exfiltration - #331

Merged

kOaDT merged 25 commits into

mainfrom

sqli-canary-exfiltration

Sep 22, 2026

Merged

Sqli canary exfiltration#331
kOaDT merged 25 commits into
mainfrom
sqli-canary-exfiltration

Commits on Sep 20, 2026
- refactor: share the flags table guard and the response sanitizer
  kOaDT
  committed
  5fc797e
- feat: award the X-Forwarded-For SQLi flag on exfiltration
  kOaDT
  committed
  ac6a0c1
- feat: award the product search SQLi flag on exfiltration
  kOaDT
  committed
  f80d7e6
- feat: award the order search SQLi flag on exfiltration
  kOaDT
  committed
  17786b5
- feat: award the second-order SQLi flag on exfiltration
  kOaDT
  committed
  705f9d1
- feat: award the CSRF flag on a request a page actually fired
  kOaDT
  committed
  846d282
- fix: award the SQLi flags on genuine exfiltration only
  kOaDT
  committed
  4687221
- test: assert every canary slug names a real flag
  kOaDT
  committed
  4229de4
- docs: fix the reviews table recovery command
  kOaDT
  committed
  2125256
- fix: refuse the second-order flag for a canary carried by a review body
  kOaDT
  committed
  0facbf6
- refactor: type the canary slug constants
  kOaDT
  committed
  36e3a96
- docs: stop claiming the CSRF gate cannot be forged by hand
  kOaDT
  committed
  87b1549
- test: stop the padding oracle probe landing on valid padding by chance
  kOaDT
  committed
  e26bc80
- fix: stop handing the X-Forwarded-For flag to every localhost visitor
  kOaDT
  committed
  edcc894
- docs: refresh the SQL injection walkthrough screenshots
  kOaDT
  committed
  06cb525
- docs: show players how to read the canary slugs instead of guessing them
  kOaDT
  committed
  4e7fc52
- fix: keep the hints table out of injectable responses
  kOaDT
  committed
  e9c6710
- fix: keep the tracking sessionId out of the injected INSERT
  kOaDT
  committed
  55160f2
- feat: carry existing installs to the current schema
  kOaDT
  committed
  1cb5de3
- fix: clear the review panel error and flag between filters
  kOaDT
  committed
  18760ed
- docs: say why a missing canary only warns
  kOaDT
  committed
  1f306b9
- test: cover the ids an upgrade has to preserve
  kOaDT
  committed
  785075c
- test: earn the CSRF flag from the exploit page itself
  kOaDT
  committed
  7efe088
Commits on Sep 21, 2026
- fix: correct the CSRF gate, the recovery command and the walkthrough outputs
  kOaDT
  committed
  daea8e7
Commits on Sep 22, 2026
- fix: correct the review panel, the boot guard, the upgrade and two comments
  kOaDT
  committed
  dd883b5

Commits

Commits on Sep 20, 2026

Commits on Sep 21, 2026

Commits on Sep 22, 2026