Local file inclusion (LFI) is normally known to be used to extract the contents of different files of the server the site is hosted on. This includes files like passwd, hosts, etc. But have you ever thought about how you could take this to another level? A level where you can initialize reverse shell, get a browser shell on the server (c99, b374k, etc).
Well, this is what I am going to explain in this post 🙂 So let’s no waste any more time, and let’s get hacking instead! (more…)
This is my second SQL injection challenge. Just like the first one I am not going to spoil any details about it because that would just ruin all the fun 🙂
Get hacking by going to the challenge, or you can go to the challenge list.
Have fun!
I was supposed to wait for a couple of days with posting this, but I see in the logs that the only requests coming in now is from the blog post written by the guy who first solved this.
About a week ago I wrote an sql injection challenge that was posted on a couple of forums, #vulnhub (freenode) and on Twitter. After several days of people destroying my server with sqlmap, Havij, iMacro and sql ninja a solution was provided, but not by one of the tool users 🙂 This was solved using the good old manual approach. So now that the challenge has been solved, I decided to publish the source, and a few different solutions to this challenge.
If you want to give it a go, you can find the challenge here.
This challenge was a great proof that manual > tools! 😀
First, I want to congratulate DiabloHorn who was the first one to complete the challenge. He also wrote a “how-to” post explaining how he solved my challenge. You can read his post here.
Ok, so here I am with just another security related blog. The reason why I made this was because I needed a place to post information about a challenge I’ve had running for close to a week now.
The challenge finally was solved yesterday by some awesome people over at #vulnhub on freenode, and in a couple of days I will post the full details around this challenge including source code.
I’m just another hobby hacker who loves web application hacking following the ethical guide lines. I hang around with some really skilled people, and I like to pretend I’m as good as them 🙂 My favorite vulnerability is SQL injections, but I also know how to exploit the other web application vulnerabilities as well 🙂
I’m not a guru in anything of this, but I know a couple of tricks 🙂
I guess that’s pretty much it for now!
Have a nice day
– Happy hacking
Rogue Coder 