Appointment (Tier 1)
Last updated
Was this helpful?
Last updated
Was this helpful?
Tier -> 1
Difficult -> Very Easy
OS -> Linux
Tags -> Databases / Apache / MariaDB / PHP / SQL / Reconnaissance / SQL Injection
With some research, I started answering the first questions
Answer: Structured Query Language
Anwer: SQL Injection
Answer: A03:2021 Injection
I continued doing an exhaustive scan on the open port to know about the services running
With that and some research, I answered the next questions
Answer: Apache httpd 2.4.38 ((Debian))
Answer: 443
Answer: Directory
Answer: 404
Answer: dir
Answer: #
As I found an HTTP service running on port 80, I went to the browser to explore the content being deployed. I found a simple login page and tried to log in with default credentials but it didn't work
So looking for another way to get through this, I tried doing some basic SQL Injection tests assuming that was the way the credentials were being validated. After some tries, I found out that by using the username admin'# and providing any password (a basic test for SQLi in PHP-based pages), I gained access, and a message with the flag was displayed
With this, I answered the last question
Answer: Congratulations
And finally, I got the root flag and pwned the machine
Answer: e3d0796d002a446c0e622226f42e9672
Then, I did an initial scan using
To learn more about the HTTP protocol you can go
To learn more about Authentication bypass via SQLi, you can go
