TryHackMe Advent Of Cyber Day 10 - SQL Injection

Today we escalate a SQL injection vulnerability into a RCE, and explore MS SQL Server
Advent of cyber is a yearly event run by TryHackMe, there are 24 days of cyber security challenges in December AND prizes for competing. Last year I finished every challenge soooooo, I think it’s good. If you want to compete, join using this link: tryhackme.com/r/christmas

[@Tib3rius]

Great video Katie! Nice of you and TryHackMe to point out the dangers of OR 1=1 as well 😛

[@MalwareCube]

Late comment here, but yup! 😅There was no way I was going to forget to include a warning. Props to Lesson Learned? :D

[@bughunter9766]

Welcome Queen of cybersecurity

[@playfulsteps9249]

Another great video, love how you hit all the critical points! Great job!

[@InsanexBrain]

love it!

[@reighnie2857]

Thank you!

[@ZeNex74]

subbed, glad to see someone from UK and a good teacher. hope i can learn more. ty

[@rumanhasan27]

Once Again , great Video

[@FlewTheCoop]

Recently signed up for THM. Good stuff.

[@paulbond8244]

Nice content

[@arnd12940]

cool adventure

[@howtocyberwar]

finally, some action!!@!

[@waves3576]

Sweat heart Katie ma'am!....love ❣️ from one of your tryhackme users....

[@anasriaz4937]

why is is not downloading the payload I am hosting on http server? Is there something wrong with THM or what? i am executing the correct url but nothing happens

[@InsiderPhD]

You need to do 2 queries to get the payload to work, make sure you’re not skipping the second

[@VishalSharma-nc7uy]

@@InsiderPhD its happening with me too, i followed all the instructions carefully, it shows 'file not found' when asked to download reverse.exe. Any suggestions?

[@optihack1]

this command nc -lvnp 4444 didn't do anything, I waited but it didn't work, can someone help me

[@InsiderPhD]

Refresh the page and wait a few more mins

[@user-bk8lc2ic9m]

im getting the same thing, did you fix this? ive been through this so many times i have not missed anything. Ive tried refreshing the browser but still nothing.

[@user-bk8lc2ic9m]

finally got it working, I had missed the CMD to enable xp_cmdshell TA.RG.ET.IP/giftresults.php?age='; EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE; --

[@anmolbrar3614]

Hi, I need your help can you please help me. I pain in trouble.

[@MBlessing]

Thank you, however so far your AOC has been the most difficult to follow. It’s more or less like you’re talking to yourself 😢. Maybe it’s just me.