2 ms·
> First recon step here is to run a port scan to discover if there is any service. As a result I got port 80 Overkill much? :) > There is only one user ("admi
by scrollaway 8y ago
> First recon step here is to run a port scan to discover if there is any service. As a result I got port 80
Overkill much? :)
> There is only one user ("admin", "5f4dcc3b5aa765d61d8327deb882cf99"). Is that a hash? Googled it and found the answer, yes it is: md5('password'). Now we are able to log in using admin:password or even using the sqli
Stuff like this makes me think the author accidentally went into this stuff in reverse order. The username/password combo seems almost expected to be manually bruteforceable.
Also, the whole blind-querying of strings using sleep() is awesome. Is that a common technique or did the author make it up on the spot?
- thaumasiotes 8y agoUsing sleep() is a common technique, recommended specifically to let you query data even when you aren't given output from the database. As long as you can produce an effect that you can detect, you can extract information.
- scrollaway 8y agoFigures :) TIL! Really cool seeing it in action.
- saagarjha 8y agoUsing sleep is pretty common, as it lets you "side channel" information out of a blind SQL injection.
- altharaz 8y agoBlind-querying is a common technique and is even tested by tools such as SQLMap (https://github.com/sqlmapproject/sqlmap/wiki/Usage#sql-injection-techniques-to-test-for https://github.com/sqlmapproject/sqlmap/wiki/Usage#sql-injec...). You have full details on what these requests look like here: https://www.owasp.org/index.php/Blind_SQL_Injection https://www.owasp.org/index.php/Blind_SQL_Injection