UHC- Union

Name: UHC- Union
Uploaded: 2021-11-23T14:19:02Z
Channel: IppSec
Description: 00:00 - Intro the best box to practice SQL Union Injections but I may be bias 01:05 - Start of nmap discovering nginx with PHP 01:50 - Doing recon on th...

IppSec · Beginner ·🔐 Cybersecurity ·4y ago

00:00 - Intro the best box to practice SQL Union Injections but I may be bias 01:05 - Start of nmap discovering nginx with PHP 01:50 - Doing recon on the website 02:45 - Starting recon in the background GoBuster/SQLMap 04:15 - Manually examining the player submission page 04:40 - Manualling testing for SQL Injection, why its important to test with a query that returns data 06:45 - Testing for union injection, then pulling up MySQL Documentation and looking at the Information_Schema database 07:45 - Testing out the Union Injection by extracting a single database name 08:20 - Showing that we can…

Watch on YouTube ↗ (saves to browser)

Chapters (18)

Intro the best box to practice SQL Union Injections but I may be bias

1:05 Start of nmap discovering nginx with PHP

1:50 Doing recon on the website

2:45 Starting recon in the background GoBuster/SQLMap

4:15 Manually examining the player submission page

4:40 Manualling testing for SQL Injection, why its important to test with a query t

6:45 Testing for union injection, then pulling up MySQL Documentation and looking a

7:45 Testing out the Union Injection by extracting a single database name

8:20 Showing that we can return more than one row with the GROUP_CONCAT function

9:00 Changing up the union to extract table and column information

10:30 Prettying up the output by setting some delimiters with GROUP_CONCAT, then ext

11:50 Submitting the flag and discovering our IP Address can now ssh into the box

12:40 Using the LOAD_FILE command to extract files from the server, discovering cred

14:00 Using SSH to access the server and then looking at how the webserver allowed o

15:45 Adding the X-FORWARDED-FOR header to our request to firewall.php and discoveri

16:25 Changing our command injection from sleep to a reverse shell

17:10 The www-data user can use sudo to run any command, using sudo to run a shell

17:30 Going over my filter to break SQLMap

Playlist

Uploads from IppSec · IppSec · 0 of 60

← Previous Next →