I’ve bypassed login page, and then got stuck on the writing web shell on the base web directory because of Errcode 13:“Permission denied” , then tried to write my web shell at the dashboard directory and again Errcode13 appeared. I need a little nudge to find the appropriate vector of my attack(probably it is directory, which I don’t know how to enumerate). Or even web shell is already exists on the webapp:) Help plz
Could anyone give me a hint about module ‘Using comments’ in SQL Injection fundamentals?
I’ve been trying in many ways, however still I am not able to login to user with id 5 in database.
‘+ 1 Login as the user with the id 5 to get the flag’
Because requirement is to login as a different user right? I am able to login as ‘tom’ or ‘admin’ however they logins are known. How to log in as a specific user when we do not have a name?
“Try to log in as the user ‘tom’. What is the flag value shown after you successfully log in?”
When i go to the Website with Firefox and use a password Payload such as ‘1’=‘1’ i get to the Admin Panel and it tells me i have successfully logged in.
but there is no Flag
So when i use the Terminal und try to connect with :
mysql -u tom -h Webside -P port -p
and enter the password which includes ‘1’=‘1’ the terminal does nothing and then sends me this Errormessage:
ERROR 2013 (HY000): Lost connection to MySQL server at ‘handshake: reading initial communication packet’, system error: 11
“Try to log in as the user ‘tom’. What is the flag value shown after you successfully log in?”
When i go to the Website with Firefox and use a password Payload such as ‘1’=‘1’ i get to the Admin Panel and it tells me i have successfully logged in.
but there is no Flag
So when i use the Terminal und try to connect with :
mysql -u tom -h Webside -P port -p
and enter the password which includes ‘1’=‘1’ the terminal does nothing and then sends me this Errormessage:
ERROR 2013 (HY000): Lost connection to MySQL server at ‘handshake: reading initial communication packet’, system error: 11
Well … i don´t really know what to do now
Facing the same problem. Please help when you find a solution
this exercise is confusing. If you use the OR injection the website responses with “login successfull”. Use the comment injection and the website responses with the flag
follow the module like try to bypass the AND id>1 with admin’)-- , if you login as admin then follow the hint, try to test OR with condition id=1 and username as user, if you login as admin, try id=5 with user as username
once you’ve bypassed the login form pay attention to the number of columns and the present working directory when attempting to get remote code execution. for the login by pass hacktricks.com should help. and one last hint… you are all alone. lol
You will discover: Password is hashed, and you will have the database structure. Try the password inside will give you nothing on login page.
Since above: You will know the only available field for you to hack is username. Try authentication bypass here, it works.
Then you’ve logged in. Now try the only input field on the web page. You should now find the column you could control. and then identify the vuln. You could either trigger an error or something else. The error message will show you, this server is MariaDB (MySQL) with PHP. And Response header told you it’s LAMP on a Ubnutu.
Now identify the column you could control and do what you’ve learned previously.
There are multiples payloads to bypass the first step, with a simple bash script you can get it, I use these payloads SQL Injection - Payloads All The Things