Published by: The Cyber Security Review Reading Time: 7 minutes Introduction: What is "inurl:pk id 1"? If you have spent any time exploring the darker corners of web security, penetration testing, or even casual browsing on tech forums, you may have come across a peculiar search string: inurl:pk id 1 .
The attacker uses a tool like sqlmap or manually crafts a payload to extract data: ?pk=1 UNION SELECT username, password FROM admin_users&id=1
The server returns: "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version..." Bingo. The attacker now knows the site uses MySQL and is vulnerable to injection.
The attacker tries to break the query by typing in the browser: https://www.example-shop.com/view.php?pk=1'&id=1