Thanks

test7"="test7" AND (select sleep(10)) AND " 
trying stacked payload

Thanks

(October 24, 2022, 02:37 PM)Hacker2222 Wrote:

(October 24, 2022, 02:32 PM)HTBContestant Wrote: For web: The admin account already exists, but when I try to log in, I get a server error.
Also, in the frontend/dashboard multiple other things are shown if you are logged in as admin, for example {{flag}}. And yea, the MySQL credentials are in the code, too, so if you could connect to it, that might help to get the admin hash. The flag is stored in a config, which is read in routes.py when accessing /dashboard. So in short, we just need to login as admin by getting their password or token.

exploit is prob injecting another sql query to modify admin pass. 

something like 
new_user", "new_hash"); UPDATE users SET password="hash" where username="admin"-- -

or something

"error":{"message":["2014","Commands out of sync; you can't run this command now"],"type":"ProgrammingError"}

(October 24, 2022, 01:50 PM)Hacker2222 Wrote: plz discuss here


reversing challenge:
thanks @HTBContestant

thx ypuuu <3

(October 24, 2022, 01:50 PM)Hacker2222 Wrote: plz discuss here


reversing challenge:
thanks @HTBContestant

thx

anyone got web?

No, got the sqli but still a big question mark ?

(October 24, 2022, 07:13 PM)lifetimelearner Wrote: No, got the sqli but still a big question mark ?

I think we need to take the username and password and forge a JWT token. But with out the key my guess it is pretty useless. The key is 50 characters long in hex, it would take forever to brute force it. I could be completely wrong though.

(October 24, 2022, 07:15 PM)deathfrom Wrote:

(October 24, 2022, 07:13 PM)lifetimelearner Wrote: No, got the sqli but still a big question mark ?

I think we need to take the username and password and forge a JWT token. But with out the key my guess it is pretty useless. The key is 50 characters long in hex, it would take forever to brute force it. I could be completely wrong though.

Yeah, i dont think going with jwt is wise tho, we dont even know the password.