Appointment - Hack The Box // Walkthrough & Solution // Kali Linux

This box allows us to try conducting a SQL injection against a web application with a SQL database using Kali Linux.
SQL Injection is a typical method of hacking web sites that collect and store user input data using SQL Statements.
SQL injection attacks are a sort of cyber assault in which vulnerabilities in online applications that employ SQL (Structured Query Language) databases are exploited. An SQL injection attack occurs when an attacker uses malicious input to influence the SQL query that the programme is executing, enabling the attacker to access or change sensitive data contained in the database.
SQL injection attacks often involve introducing SQL code into user input areas like search boxes or login forms to fool the programme into performing undesired database instructions. An attacker, for example, may inject malicious code into a search box that obtains all user data from a database rather than only the data linked to the search query.
SQL injection attacks that are successful may cause a variety of security vulnerabilities, such as unauthorized access to sensitive data, data modification or deletion, or the ability to execute arbitrary instructions on the application's underlying server. Web developers should use best practises such as input validation and parameterized queries to avoid SQL injection attacks, and maintain their software up to current with the latest security updates.
🤓 Follow:
/ danduran.me
/ danduran.me
/ danduran-ca
/ danduran.me
/ danduran
GetCyber.me
#kalilinux #hackthebox #ethicalhacking

[@mohamedreddad2684]

i cant get to the login page after [assting the ip in adress bar it keep reloading and i tried multiple browsers

[@kams196]

I just dont understand why admin ' # to loggin. The "#" because it's a comment. But why the ' before the #

[@E-m-i-1]

In SQL injection, the single quote (') is used to close off a string in the SQL query, and the comment symbol (# or --) is used to ignore the rest of the query. Therefore bypassing the password.

[@kams196]

@@E-m-i-1 Thanks for your reponse! Any good recommendation for a video to learn recent sql injection techniques? I feel like hackthebox and tryhackme only teach old methods that has 0 relevance in 2024

[@PedroFerreira-os8ee]

how did you got on that website to login?

[@hxdrus]

Copy the target IP address and paste it into the address bar

[@Triambaka]

Same question. But thanks for raising it. Got the answer.

[@codingmakes4210]

i cant get to the login page when i paste the ip into the address bar it just keeps on reloading

[@toysarealive1]

try using a different browser

[@n6ra]

same issue here

[@kams196]

it has to be a browser on the hackthebox machine. Because the DHCP on hackthebox is different

[@jpopperman9369]

Or connect with openvpn? Add IP and domain to /etc/hosts then you can just type the URL instead of IP all the time

[@codingmakes4210]

Bro i published this a year ago. Any way i used firefox and it worked if you need help.

[@blackumar8716]

Personally identifiable information😊

[@ValentinMatiasVintar]

en español ? :(

[@Eggsec]

te ayudo en algo?