Hack The Box-Appointment

申请虚拟靶机，获取目标IP地址

Task1

What does the acronym SQL stand for?

Structured Query Language

Task2

What is one of the most common type of SQL vulnerabilities?

SQL Injection

Task3

What does PII stand for?

Personally Identifiable Information

Task4

What does the OWASP Top 10 list name the classification for this vulnerability?

查了一下

A03:2021-Injection

Task5

What service and version are running on port 80 of the target?

nmap扫一下靶机，可以看到80端口有apache服务。

Apache httpd 2.4.38 ((Debian))

Task6

What is the standard port used for the HTTPS protocol?

使用https的话应该是443.

Task7

What is one luck-based method of exploiting login pages?

暴力破解嘛！

brute-forcing

Task8

What is a folder called in web-application terminology?

Task9

What response code is given for "Not Found" errors?

404

Task10

What switch do we use with Gobuster to specify we're looking to discover directories, and not subdomains?

dir

Task11

What symbol do we use to comment out parts of the code?

Task12

Submit root flag

访问目标地址，发现是个登陆页面，构造username：admin '#,password随意，尝试登陆，成功登陆并获取flag。

原理是后台未过滤输入信息，使用单引号闭合了前面查询语句，并用#注释了后面查询语句，如下所示。

SELECT * FROM users WHERE username=‘admin'#’ AND password=‘123456’

此时只要用户名为真整个查询语句就为真，从而实现登陆绕过。

e3d0796d002a446c0e622226f42e9672

Hack The Box-Appointment相关推荐

【Hack The Box】linux练习-- SneakyMailer
HTB 学习笔记 [Hack The Box]linux练习-- SneakyMailer
Hack The Box - Access Writeup
第一次尝试Hack The Box,在难度较低的Access上,前后花了有两天的时间,汗.收获还是很大,在此记录一下,以便后阅. 首先是获取user,通过nmap扫描,可以发现目标主机开了三个端口21 ...
Hack The Box - Meta 利用Exiftool远程代码执行漏洞获取webshell，ImageMagrick命令执行漏洞横向提权，更改环境配置SUDO纵向提权
Hack The Box - Meta Hack The Box开始使用流程看这篇文章目录 Hack The Box - Meta 整体思路 1.Nmap扫描 2.Exiftool远程代码执行漏洞( ...
【Hack The Box】linux练习-- Blunder
HTB 学习笔记 [Hack The Box]linux练习-- Blunder
Hack The Box - Catch 利用let chat API查询信息，Cachet配置泄露漏洞获取ssh登录密码，apk代码注入漏洞利用获取root权限
Hack The Box-Catch Hack The Box开始使用流程看这篇文章目录 Hack The Box-Catch 整体思路 1.Nmap扫描 2.apk文件信息收集 3.lets ch ...
【Hack The Box】windows练习-- Silo
HTB 学习笔记 [Hack The Box]windows练习-- Silo
【Hack The Box】linux练习-- Ophiuchi
HTB 学习笔记 [Hack The Box]linux练习-- Ophiuchi
【Hack The Box】linux练习-- Doctor
HTB 学习笔记 [Hack The Box]linux练习-- Doctor
【Hack The Box】linux练习-- Tabby
HTB 学习笔记 [Hack The Box]linux练习-- Tabby
Hack The Box - Starting Point - TIER 0
Hack The Box - Starting Point - TIER 0 Meow TASK 1 What does the acronym VM stand for? 首字母缩略词 VM 代表什 ...