So I am currently on the the last part of the SQL Injection Fundamentals module and I have been trying multiple ways to solve it.
As I understand it, my goal is to write a web shell into the base web directory so I can get RCE to find the flag in the root directory. However, I get permission denied whenever I try to write my php shell to the default web directory location: var/www/html. This makes me think that there must be other web directory locations which I should try. Also, I am able to write my php shell to other locations such as /var/lib/mysql or /tmp, but I don’t know how to make the server read the shell using that approach.
Some hints would be very much appreciated!
Update: I just got help solving it by user Nucrea. The solution to the problem exists in the url after first SQL Injection into the page.
Hi Guys, can anyone please guide me, how to get past the logon page?
Hey , dont overthink much on this one.
Remember which are the ways to inject through the username and try em out !
I tried every single payload possibility but it doesn’t work. The page just reloads and shows “Incorrect credentials” under the login form.
Can someone help me, pls?
I’ve bypassed login page, and then got stuck on the writing web shell on the base web directory because of Errcode 13:“Permission denied” , then tried to write my web shell at the dashboard directory and again Errcode13 appeared. I need a little nudge to find the appropriate vector of my attack(probably it is directory, which I don’t know how to enumerate). Or even web shell is already exists on the webapp:) Help plz
Could anyone give me a hint about module ‘Using comments’ in SQL Injection fundamentals?
I’ve been trying in many ways, however still I am not able to login to user with id 5 in database.
‘+ 1 Login as the user with the id 5 to get the flag’
Because requirement is to login as a different user right? I am able to login as ‘tom’ or ‘admin’ however they logins are known. How to log in as a specific user when we do not have a name?
“Try to log in as the user ‘tom’. What is the flag value shown after you successfully log in?”
When i go to the Website with Firefox and use a password Payload such as ‘1’=‘1’ i get to the Admin Panel and it tells me i have successfully logged in.
but there is no Flag
So when i use the Terminal und try to connect with :
mysql -u tom -h Webside -P port -p
and enter the password which includes ‘1’=‘1’ the terminal does nothing and then sends me this Errormessage:
ERROR 2013 (HY000): Lost connection to MySQL server at ‘handshake: reading initial communication packet’, system error: 11