正在加载视频...

视频加载失败

加载此视频时出现问题。这可能是由于临时网络问题，或视频可能不可用。

SQL injection! 💉 After finding the number of columns using the NULL trick, you can take it a step further and identify which column takes which data type. Swap 'abc' into one position at a time. The one that comes back without an error is your string column, and... show more

Web Security Academy

145,812 subscribers

20,968 次观看 • 2 个月前 •via X (Twitter)

Anya Rossi• Live Now

Private livecam show

7 条评论

Cyber Defense Academy 的头像

Cyber Defense Academy2 个月前

The column-count step is only half the battle. 🔥 Being able to determine which columns accept which data types makes UNION-based SQLi much more practical during testing. Great reminder that understanding the underlying SQL behavior matters more than memorizing payloads.

Dylan Stone 🍋 的头像

Dylan Stone 🍋2 个月前

use odata or graphql

KP 的头像

KP1 个月前

The data-type check after NULLs is the part most tutorials skip. Solid demo 🔥 Labs time 😋

Jonaski 的头像

Jonaski2 个月前

Understanding how the database works with the payload is way more important than just memorizing syntax. Great point!

Google Baba 的头像

Google Baba2 个月前

🤗

Barclays Charles 的头像

Barclays Charles2 个月前

Show this to a WAF

Python Papi 的头像

Python Papi2 个月前

🤔📓 🖊️

相关视频

One method for discovering the correct amount of columns to SELECT in a SQL injection is to keep adding NULL until the error disappears. Check it out! 👇

One method for discovering the correct amount of columns to SELECT in a SQL injection is to keep adding NULL until the error disappears. Check it out! 👇

Web Security Academy

28,193 次观看 • 4 个月前

A senior data scientist on call, 24/7. That's the dream. Well, these three built it. This is Data Scout, the agent that connects to Snowflake, Notion, Slack, Github, digs into your data, and sends recurring reports automatically. Honestly, one of our most-used agents at Notion. You can build one too.

A senior data scientist on call, 24/7. That's the dream. Well, these three built it. This is Data Scout, the agent that connects to Snowflake, Notion, Slack, Github, digs into your data, and sends recurring reports automatically. Honestly, one of our most-used agents at Notion. You can build one too.

Notion

40,481 次观看 • 6 个月前

Grass Founder Andrej explains why AI labs are racing against the clock. “The work that goes into taking huge amounts of data and turning it into what you want to actually train your model on is massive, and it takes time. And time is probably the most valuable resource right now in AI.”

Grass Founder Andrej explains why AI labs are racing against the clock. “The work that goes into taking huge amounts of data and turning it into what you want to actually train your model on is massive, and it takes time. And time is probably the most valuable resource right now in AI.”

Delphi Digital

10,520 次观看 • 6 天前

You've heard of SQL injection, but have you heard of NoSQL injection? In this video, we perform a full account takeover using NoSQL injection. We use the NoSQL injection to find the admin username, and reset their password! Learn this in our FREE labs 👇

You've heard of SQL injection, but have you heard of NoSQL injection? In this video, we perform a full account takeover using NoSQL injection. We use the NoSQL injection to find the admin username, and reset their password! Learn this in our FREE labs 👇

Web Security Academy

35,015 次观看 • 2 个月前

every question in this clip is an ownership question, especially data because when everyone has access to the same intelligence, the only input that separates your business from the next one is the data you own your data is decades of decisions, customers, mistakes, and edge cases that exist nowhere else on earth that is the moat and enterprises are waking up to the fact that they've been leaking it one api call at a time my prediction is this: data ownership is going to absolutely matter in the world we're going into and whoever's building the infrastructure for it is going to have a very good decade.

every question in this clip is an ownership question, especially data because when everyone has access to the same intelligence, the only input that separates your business from the next one is the data you own your data is decades of decisions, customers, mistakes, and edge cases that exist nowhere else on earth that is the moat and enterprises are waking up to the fact that they've been leaking it one api call at a time my prediction is this: data ownership is going to absolutely matter in the world we're going into and whoever's building the infrastructure for it is going to have a very good decade.

Adeniyi.sui

13,834 次观看 • 3 个月前

Your agents can't keep up with real-time data. Especially when it's scattered across dozens of sources. Most teams waste weeks building custom connectors for every database, API, and data warehouse. Then they build ETL pipelines to sync everything. By the time your agent retrieves the data, it's already outdated. Picture this: Your Postgres database updated 5 minutes ago. Your MongoDB collection changed 2 minutes ago. Your agent is still pulling from yesterday's snapshot. This is why most production RAG systems fail. There's a better approach: MindsDB is an open-source AI platform with a federated data engine that lets you query multiple data sources in real-time using SQL - without moving any data. Here's what makes it different: ↳ Your data stays in place. No ETL pipelines or data duplication ↳ Query Postgres, MongoDB, REST APIs, and more using consistent SQL ↳ JOIN across different sources in real-time with a unified interface ↳ Works with both structured and un-structured data And here's the best part: You don't even need to write SQL. Just describe what you want in plain English, and MindsDB converts it to SQL automatically. The system does all the heavy lifting. The breakthrough for AI agents is simple: When data updates at the source, your agent gets fresh results immediately. No sync delays. No stale embeddings. No custom code for each integration. You can literally write a SQL query that joins a Postgres table with a MongoDB collection and gets live results. This is what production AI applications need but rarely get. In this video, I give you a complete walkthrough of what we just discussed and how to actually do it. Make sure you watch this till the end. I've shared the link to MindsDB's GitHub repo in the next tweet!

Your agents can't keep up with real-time data. Especially when it's scattered across dozens of sources. Most teams waste weeks building custom connectors for every database, API, and data warehouse. Then they build ETL pipelines to sync everything. By the time your agent retrieves the data, it's already outdated. Picture this: Your Postgres database updated 5 minutes ago. Your MongoDB collection changed 2 minutes ago. Your agent is still pulling from yesterday's snapshot. This is why most production RAG systems fail. There's a better approach: MindsDB is an open-source AI platform with a federated data engine that lets you query multiple data sources in real-time using SQL - without moving any data. Here's what makes it different: ↳ Your data stays in place. No ETL pipelines or data duplication ↳ Query Postgres, MongoDB, REST APIs, and more using consistent SQL ↳ JOIN across different sources in real-time with a unified interface ↳ Works with both structured and un-structured data And here's the best part: You don't even need to write SQL. Just describe what you want in plain English, and MindsDB converts it to SQL automatically. The system does all the heavy lifting. The breakthrough for AI agents is simple: When data updates at the source, your agent gets fresh results immediately. No sync delays. No stale embeddings. No custom code for each integration. You can literally write a SQL query that joins a Postgres table with a MongoDB collection and gets live results. This is what production AI applications need but rarely get. In this video, I give you a complete walkthrough of what we just discussed and how to actually do it. Make sure you watch this till the end. I've shared the link to MindsDB's GitHub repo in the next tweet!

Akshay 🚀

65,672 次观看 • 11 个月前

MCP is mind-blowing. Here is a genius setup that will earn you a promotion with your manager. I have multiple data sources: data in S3, MySQL, and local files. Using Spice (an open-source project), I can co-locate all of that data behind a single SQL endpoint and augment it using MCP. Before, accessing data was slow, and I had to make multiple requests to get anything. After using Spice, I can query the data much faster (since it's mirrored locally), and I don't have to worry about where the data is coming from. Spice acts as an MCP server, so I can connect to it from my IDE or the Claude Desktop app and have access to all the data. But even more cool than that: Spice also acts as an MCP client, so it can connect to other MCP servers. This is where things get really interesting! Watch the video. I'm querying multiple data sources from my IDE and using the Google Maps MCP server for driving directions.

MCP is mind-blowing. Here is a genius setup that will earn you a promotion with your manager. I have multiple data sources: data in S3, MySQL, and local files. Using Spice (an open-source project), I can co-locate all of that data behind a single SQL endpoint and augment it using MCP. Before, accessing data was slow, and I had to make multiple requests to get anything. After using Spice, I can query the data much faster (since it's mirrored locally), and I don't have to worry about where the data is coming from. Spice acts as an MCP server, so I can connect to it from my IDE or the Claude Desktop app and have access to all the data. But even more cool than that: Spice also acts as an MCP client, so it can connect to other MCP servers. This is where things get really interesting! Watch the video. I'm querying multiple data sources from my IDE and using the Google Maps MCP server for driving directions.

Santiago

142,696 次观看 • 1 年前

In 2006, Netflix offered $1,000,000 to anyone who could improve their recommendation algorithm by 10%. Over 2,000 teams competed for three years. The team that won did not use more data. They used fewer dimensions. They found a basis - a small set of independent vectors that captured everything important about 100,000,000 movie ratings. The lead mathematician on the winning team: $2,800,000 a year. A machine learning engineer at Spotify building the same kind of system: $245,000 a year. This is MIT 18.06, Lecture 9 - Gilbert Strang. Free on YouTube. Most people think independence is obvious. Two vectors pointing in different directions. Then the definition. Independence means no combination of your vectors gives the zero vector - except the trivial one where all the coefficients are zero. That's it. That's the whole definition. But watch what it unlocks. Watch the moment Strang puts three vectors in a two-dimensional plane. He doesn't even tell you which three vectors. He just draws them. And immediately says: dependent. No question. No calculation. Why? Because three vectors in two-dimensional space means more columns than rows. More unknowns than equations. That always forces a free variable. A free variable always gives a non-zero solution to Ax = 0. And that non-zero solution is a combination of the columns that produces zero. Dependence. "Three vectors in the plane have to be dependent. That's the key fact." Then the basis. A basis is vectors that are independent and span the space. Not too few, not too many. Just right. The pivot columns of any matrix form a basis for the column space. Every other basis you can think of will have exactly the same number of vectors. Then the dimension. All bases for the same space have the same number of vectors. That number is the dimension. The rank of a matrix is the dimension of its column space. The number of free variables is the dimension of the null space. And rank plus null space dimension equals the total number of columns. "I don't take the dimension of A. I take the dimension of the column space of A. If you use those words right, it shows you've got the idea right." A data scientist at Netflix building recommendation engines: $230,000 a year. A quantitative researcher at Two Sigma finding independent factors in financial markets: $350,000 a year. A computer vision engineer at Apple using low-dimensional representations for face recognition: $260,000 a year. They all needed to know how many dimensions were really there. bookmark this and watch later - after this lecture every dataset you look at will feel like a matrix waiting to be reduced to its basis.

In 2006, Netflix offered $1,000,000 to anyone who could improve their recommendation algorithm by 10%. Over 2,000 teams competed for three years. The team that won did not use more data. They used fewer dimensions. They found a basis - a small set of independent vectors that captured everything important about 100,000,000 movie ratings. The lead mathematician on the winning team: $2,800,000 a year. A machine learning engineer at Spotify building the same kind of system: $245,000 a year. This is MIT 18.06, Lecture 9 - Gilbert Strang. Free on YouTube. Most people think independence is obvious. Two vectors pointing in different directions. Then the definition. Independence means no combination of your vectors gives the zero vector - except the trivial one where all the coefficients are zero. That's it. That's the whole definition. But watch what it unlocks. Watch the moment Strang puts three vectors in a two-dimensional plane. He doesn't even tell you which three vectors. He just draws them. And immediately says: dependent. No question. No calculation. Why? Because three vectors in two-dimensional space means more columns than rows. More unknowns than equations. That always forces a free variable. A free variable always gives a non-zero solution to Ax = 0. And that non-zero solution is a combination of the columns that produces zero. Dependence. "Three vectors in the plane have to be dependent. That's the key fact." Then the basis. A basis is vectors that are independent and span the space. Not too few, not too many. Just right. The pivot columns of any matrix form a basis for the column space. Every other basis you can think of will have exactly the same number of vectors. Then the dimension. All bases for the same space have the same number of vectors. That number is the dimension. The rank of a matrix is the dimension of its column space. The number of free variables is the dimension of the null space. And rank plus null space dimension equals the total number of columns. "I don't take the dimension of A. I take the dimension of the column space of A. If you use those words right, it shows you've got the idea right." A data scientist at Netflix building recommendation engines: $230,000 a year. A quantitative researcher at Two Sigma finding independent factors in financial markets: $350,000 a year. A computer vision engineer at Apple using low-dimensional representations for face recognition: $260,000 a year. They all needed to know how many dimensions were really there. bookmark this and watch later - after this lecture every dataset you look at will feel like a matrix waiting to be reduced to its basis.

Zyphor

14,720 次观看 • 1 个月前

One decision, one action that locks you in, is all it takes to begin turning an idea into reality. At the Time to Rise Summit, we got clear on what we truly want and the tools and strategies to get there—now it’s time to take action. What’s one step you can take today that commits you to following through on the life you desire? Don’t wait, TAKE IT NOW.

One decision, one action that locks you in, is all it takes to begin turning an idea into reality. At the Time to Rise Summit, we got clear on what we truly want and the tools and strategies to get there—now it’s time to take action. What’s one step you can take today that commits you to following through on the life you desire? Don’t wait, TAKE IT NOW.

Tony Robbins

17,661 次观看 • 8 个月前

Did you know that Facebook made $134.9 billion in 2023 from selling your data? Our society has come to the point where we accepted an unfair model in which privacy is being exploited and data gifted to big tech that is selling it for billions. We intend to break the norm of how data is shared on the internet because it is outdated and unfair. You should be empowered with more control and monetization models for your data!

Did you know that Facebook made $134.9 billion in 2023 from selling your data? Our society has come to the point where we accepted an unfair model in which privacy is being exploited and data gifted to big tech that is selling it for billions. We intend to break the norm of how data is shared on the internet because it is outdated and unfair. You should be empowered with more control and monetization models for your data!

Solana ID 🪷

30,466 次观看 • 2 年前

One of these two is a Man and the other is a woman, can you identify which is which? 👀

One of these two is a Man and the other is a woman, can you identify which is which? 👀

GIDI

3,156,974 次观看 • 2 年前

CSS Trick 🖼️ You could take the resize trick from last week and use it to create one of those sliding image components 👀 CSS only, JavaScript to enhance later 🤓 Put an image in each panel and make them position: absolute. They can use a container query unit for their size 🫶 img { position: absolute; width: 100cqi; // Make them the container width 🤙 } .panel:last-of-type img { right: 0; } The rest of the trick from last week was using display:grid with grid-template-columns. Then we have a resizable element inside the first column 😎 .panels{ display: grid; grid-template-columns: auto 1fr; 👈 } .resizer{ max-width: 100cqi; overflow: hidden; resize: horizontal; 👈 } Where does JavaScript come in? To progressively enhance the thing with keyboard controls ✨ Not 100% sure of the pattern for that though. Feels like it should be a button that you can toggle into resize mode and then use left/right to resize 🤔 Anyways, CodePen.IO link below! 👇

CSS Trick 🖼️ You could take the resize trick from last week and use it to create one of those sliding image components 👀 CSS only, JavaScript to enhance later 🤓 Put an image in each panel and make them position: absolute. They can use a container query unit for their size 🫶 img { position: absolute; width: 100cqi; // Make them the container width 🤙 } .panel:last-of-type img { right: 0; } The rest of the trick from last week was using display:grid with grid-template-columns. Then we have a resizable element inside the first column 😎 .panels{ display: grid; grid-template-columns: auto 1fr; 👈 } .resizer{ max-width: 100cqi; overflow: hidden; resize: horizontal; 👈 } Where does JavaScript come in? To progressively enhance the thing with keyboard controls ✨ Not 100% sure of the pattern for that though. Feels like it should be a button that you can toggle into resize mode and then use left/right to resize 🤔 Anyways, CodePen.IO link below! 👇

jhey ʕ•ᴥ•ʔ

111,404 次观看 • 3 年前

Jedd Fisch told the press today how important it is to track data during a football practice. At the University of Washington they track more than most. Once you have the data it becomes a matter of using it to make better decisions and that's where AI makes a difference.

Jedd Fisch told the press today how important it is to track data during a football practice. At the University of Washington they track more than most. Once you have the data it becomes a matter of using it to make better decisions and that's where AI makes a difference.

Thad Wells

46,406 次观看 • 2 个月前

"None of them is mine" That's why we open-sourced the alternatives: - OpenMuse - OpenBot - OpenDots Same shape as Muse, Grok Bot and Dots, but MIT-licensed and running on infra you control. Each of your three bets goes away: 1. your data: you choose where it lives 2. your model: bring your own, swap it when a better one ships (via AG-UI protocol) 3. your product: change any feature you want And they're not just repos you throw at developers. OpenMuse deploys to Render in one click and runs on iOS, Android and web They're all built on CopilotKit🪁 Intelligence, which takes them to production: persistent threads, memory, Automatic Learning, and Slack and Teams channels, in our cloud or yours. Getting a key for that is free.

"None of them is mine" That's why we open-sourced the alternatives: - OpenMuse - OpenBot - OpenDots Same shape as Muse, Grok Bot and Dots, but MIT-licensed and running on infra you control. Each of your three bets goes away: 1. your data: you choose where it lives 2. your model: bring your own, swap it when a better one ships (via AG-UI protocol) 3. your product: change any feature you want And they're not just repos you throw at developers. OpenMuse deploys to Render in one click and runs on iOS, Android and web They're all built on CopilotKit🪁 Intelligence, which takes them to production: persistent threads, memory, Automatic Learning, and Slack and Teams channels, in our cloud or yours. Getting a key for that is free.

Atai Barkai

14,376 次观看 • 25 天前

you gave your team a monthly number and everyone wrote it down you had priced one meter of four the figure came off the token column, because that is the column with a page, and the three that are not on that page do not care what you told anyone a threshold multiplier, a cache that misses without a key, and tool calls at five dollars a thousand none of it moves while your usage stays flat, all of it moves the moment a conversation gets long you are not going to be wrong by a percentage you will be wrong by a factor, in front of the people who wrote the number down

you gave your team a monthly number and everyone wrote it down you had priced one meter of four the figure came off the token column, because that is the column with a page, and the three that are not on that page do not care what you told anyone a threshold multiplier, a cache that misses without a key, and tool calls at five dollars a thousand none of it moves while your usage stays flat, all of it moves the moment a conversation gets long you are not going to be wrong by a percentage you will be wrong by a factor, in front of the people who wrote the number down

Lagosaur

21,734 次观看 • 1 个月前

That free USB charger at the airport can steal your phone. Swap the plug for a device that pulls data instead of power and plugging in hands over everything, including wallet access. Carry your own charger and a data blocker. 'Juice jacking' is real.

That free USB charger at the airport can steal your phone. Swap the plug for a device that pulls data instead of power and plugging in hands over everything, including wallet access. Carry your own charger and a data blocker. 'Juice jacking' is real.

Jake Claver, QFOP

54,694 次观看 • 3 个月前

The next time you make an error or any type of mistake during competition, use this simple 3 step Reset Routine to quickly bounce back. Step 1: Before the game, draw a reset button under your hat. You can also draw it on your wrist tape, on your glove or wherever you’d like to. Step 2: After an error, take off your hat and take a deep breath while pressing the reset button. This will help you gain control and stop any downward spiral from starting. Step 3: Take control of your self-talk by repeating “hit the next ball to me, I will make this play”. This may be the most important part of it all. Know that it’s all about having a routine to go to, not if, but WHEN adversity comes your way. So, the next time you inevitably fall short of your expectations, utilize this Reset Routine and you’ll be ready to make the next play.

The next time you make an error or any type of mistake during competition, use this simple 3 step Reset Routine to quickly bounce back. Step 1: Before the game, draw a reset button under your hat. You can also draw it on your wrist tape, on your glove or wherever you’d like to. Step 2: After an error, take off your hat and take a deep breath while pressing the reset button. This will help you gain control and stop any downward spiral from starting. Step 3: Take control of your self-talk by repeating “hit the next ball to me, I will make this play”. This may be the most important part of it all. Know that it’s all about having a routine to go to, not if, but WHEN adversity comes your way. So, the next time you inevitably fall short of your expectations, utilize this Reset Routine and you’ll be ready to make the next play.

Brandon Guyer - Major League Mindset

113,643 次观看 • 2 年前

Without ever leaving Databricks, you can search the web and pull live, structured data into your tables in plain english by using Genie to call Nimble. Step 1: Search the web and structure the data ⬇️

Without ever leaving Databricks, you can search the web and pull live, structured data into your tables in plain english by using Genie to call Nimble. Step 1: Search the web and structure the data ⬇️

Nimble

51,119 次观看 • 4 个月前

The cool thing about local-first web apps is you don't have to choose anymore, which was one of the goals for Thymer: real-time collaboration, E2EE sync, and web access, while your data also lives locally and the app works offline. That means tools like Claude (or local LLMs) can get fast access to your workspace data. There's already an MCP plugin and here's a quick prototype where Claude Code talks directly to offline workspace data stored in the browser DB.

The cool thing about local-first web apps is you don't have to choose anymore, which was one of the goals for Thymer: real-time collaboration, E2EE sync, and web access, while your data also lives locally and the app works offline. That means tools like Claude (or local LLMs) can get fast access to your workspace data. There's already an MCP plugin and here's a quick prototype where Claude Code talks directly to offline workspace data stored in the browser DB.

Wim Cools

31,293 次观看 • 9 个月前