Return to forum

NetworkSniffer · October 24, 2022 at 3:37 PM

thax bro

nirs · October 24, 2022 at 3:38 PM

(October 24, 2022, 03:34 PM)killerbee Wrote:
(October 24, 2022, 03:25 PM)deathfrom Wrote:
(October 24, 2022, 03:21 PM)killerbee Wrote:
(October 24, 2022, 03:15 PM)deathfrom Wrote: This works:
sqlmap -r tmp.txt --dbs --dbms=MySQL -v 3 --batch -D horror_feeds -T users --dump

where I can do this?

In your terminal. Capture a request when you register

terminal of the browser right?
sorry for my infinite dumbness I didn't got it lol

download sqlmap and innstall python3, then run python3 sqlmap from cmd (winndows+R cmd)

scurnes · October 24, 2022 at 3:43 PM

(October 24, 2022, 03:34 PM)killerbee Wrote:
(October 24, 2022, 03:25 PM)deathfrom Wrote:
(October 24, 2022, 03:21 PM)killerbee Wrote:
(October 24, 2022, 03:15 PM)deathfrom Wrote: This works:
sqlmap -r tmp.txt --dbs --dbms=MySQL -v 3 --batch -D horror_feeds -T users --dump

where I can do this?

In your terminal. Capture a request when you register

terminal of the browser right?
sorry for my infinite dumbness I didn't got it lol

sqlmap is a dedicated python3 tool.
On arch and debian based distros you can install it using your packet manager, it will be available as a terminal command. Another option is downloading it and using with python.

bozonas · October 24, 2022 at 3:53 PM

Thanks

Onirique · October 24, 2022 at 3:57 PM

thanks

karhu · October 24, 2022 at 4:00 PM

Reverse and Forensics were pretty simple Just working on Web now. SQLi is returning a bunch of bcrpyt hashes, but JtR isn't cracking them.

QuQuK · October 24, 2022 at 4:01 PM

(October 24, 2022, 01:50 PM)Hacker2222 Wrote: plz discuss here

reversing challenge:
thanks @HTBContestant

ty

deathfrom · October 24, 2022 at 4:04 PM

(October 24, 2022, 04:00 PM)karhu Wrote: Reverse and Forensics were pretty simple Just working on Web now. SQLi is returning a bunch of bcrpyt hashes, but JtR isn't cracking them.

I am not sure what that value is for the admin account. It doesn't look like a hash and it is not a valid password either

elliotal53 · October 24, 2022 at 4:05 PM

(October 24, 2022, 01:50 PM)Hacker2222 Wrote: plz discuss here

reversing challenge:
thanks @HTBContestant
g

g

karhu · October 24, 2022 at 4:11 PM

(October 24, 2022, 04:04 PM)deathfrom Wrote:
(October 24, 2022, 04:00 PM)karhu Wrote: Reverse and Forensics were pretty simple Just working on Web now. SQLi is returning a bunch of bcrpyt hashes, but JtR isn't cracking them.

I am not sure what that value is for the admin account. It doesn't look like a hash and it is not a valid password either

Yeah, my sqlmap returned ~300 hashes. JtR hasn't cracked any of them. Not sure where to go from here.