From the course: Ethical Hacking: SQL Injection

Unlock the full course today

Join today to access over 24,600 courses taught by industry experts.

Navigating a complex injection

Navigating a complex injection

From the course: Ethical Hacking: SQL Injection

Start my 1-month free trial Buy for my team

Navigating a complex injection

“

- [Instructor] I'm connected to the Hack the Box testing lab, and we'll do a scan of the server on 10.10.10.31. This is the Charon server, and if you want to feel a hands-on with this, you'll need to be in the Hack The Box lab. Connecting to the site shows what looks like a food-focused website, with a blog. There's no particular areas of interest on the site, but when we carry out our reconnaissance, we find there's a number of additional pages including the CMS data login page. Let's go and take a look at that, /cmsdata/login.php. We've got a login page here. I won't go through the whole process. But it turns out that this page isn't susceptible to SQL injection. Next, we'll go to the forgot password page. Okay, now we can start to test the page. First, let's see what it does with a random email, a@b.com. Okay. That gives an email not found, which we'd expect. Now let's try something we know will have an error,…

Contents