2 ms·
There is already a call to MD5 in the original query; see the first image in the article, which they apparently obtained by submitting ' as the username: https:
by tomsmeding 2y ago
There is already a call to MD5 in the original query; see the first image in the article, which they apparently obtained by submitting ' as the username: https://images.spr.so/cdn-cgi/imagedelivery/j42No7y-dcokJuNgXeA0ig/68274892-b9e5-485b-a7d5-b05ddfb57518/Untitled/w=3840,quality=90,fit=scale-down https://images.spr.so/cdn-cgi/imagedelivery/j42No7y-dcokJuNg...
- jerf 2y agoYup, and there we can see the password is just splatted in with no salt. 99%+ the password is an injection attack too, but one only needs one set of the keys to the kingdom to make the point, so the article never discusses getting in via password instead and the author may well never have checked, because it couldn't make things any worse.