SQLite Blind SQL Injection - HackTheBox Cyber Apocalypse CTF
ฝัง
- เผยแพร่เมื่อ 4 ต.ค. 2024
- Moving your first steps into hacking? Start from HTB Academy: bit.ly/3vuWp08
Hungry for more hacking training? Join Hack The Box now: bit.ly/331nQCl
For more content, subscribe on Twitch! / johnhammond010
If you would like to support me, please like, comment & subscribe, and check me out on Patreon: / johnhammond010
PayPal: paypal.me/john...
E-mail: johnhammond010@gmail.com
Discord: johnhammond.or...
Twitter: / _johnhammond
GitHub: github.com/Joh...
Most of the time you get a video by an old pro that knows the answers, or somebody that edited it to appear better than they are. I personally learned far more watching you stumble your way to a solution and working through the logic. This is gold, and you earned yourself a subscriber! Keep 'em coming
Agree!!!
Could you point to one of those videos with some old pro who knows the answers? :)
@@mkevilempire John is a pro that knows the answers. However he walks through it in more depth than hitting F12 and saying "there it is! That's the vulnerable code". And then running the script he knows will exploit it and saying "there ya go". Some people are just born teachers. Tomnomnom is another person that I feel is a natural teacher. Some people got it some people don't.
Watching it gradually print out the flag was like watching a hacker scene in a movie :')
Awesome video as always! :D
// TOOD: Replace all TODO's for TOOD
TOOD! 😀
As a total noob, that was incredible to watch. Seeing you work that out logically was so helpful in showing the type of thought process it takes.
Thank you
Such a great video again! Despite me wanting to scream at you sometimes, but you noticed all of it on your own.
Well that’s pretentious
@@neui6997 haha, I guess it came across differently - I am learning way more than I would have known, but some things are easier to pick up as a viewer and/or with a different perspective, so obviously there are those "why don't you try X" moments - but I probably wouldn't get to those places on my own (last time I actually worked on offensive security was 13 years ago, in which there is a six year period in which I didn't write a single line of code in any language before I got back to a more technical role now)
I don't know about want to scream, some of us actually started shouting at the screen.
I was literaly shouting "END!" At the screen 😫
Glad to know I wasn't the only one. 🤣
He got there in the…. END
This is like magic, didn't understand a single thing but enjoyed every second of it.
The character messing up things wasn't the &,#,% or the others, it was the ' haha. You printed the message at the end of the loop so it threw the error before getting to the message (you can see the faulty char right before the exception at 27:49 when you print the char at the beginning of the loop).
It does make sense too because you surround the char you're trying with single quotes.
Anyway good video
nice eye, I wouldn't have seen that without your comment. That attention to detail looks like a skill I would like =D
@@yovelspike haha thanks, gotta catch them bugs ;)
For anyone wondering the song at the end is fearless by lost sky. Also great video like everyone else I was screaming END
Thanks! I need to get into this! At the moment I'm a SOC analyst. I've ran into your articles on Huntress Security while reading about things while I'm solving/researching events! So thank you for that. :D
good master..every video we learn.. nothing script kiddies..pure knowledges..thanks a lot for teaching us.
I really like the fact that I could follow your thought process while unpacking each section of code. The video isn't edited to show less, it just jumped twice to what was already explained and bound to happen because the statement syntax was now correct. Thanks to my friend Machiavelli for recommending this video.
Hey John, I'm a relatively new viewer (started getting your videos recommended a month ago). I wanted to share my thoughts on videos like this. For reference, I'm 27 and have delved into programming mostly as a hobby. I've never done anything like the challenges* you post about, but I'm absolutely enthralled by them
I'm a SUPER huge fan of the kind of live, mostly-uncut reverse engineering you've been doing in this video and others. I feel that you're genuinely adding something to the huge wealth of content that's out there.
Everything from the way you conduct yourself in the video, to the way you explain little details, to the way you spend time googling something real quick to figure something out, to your personality and sense of humility, is absolutely perfect. I have almost zero actual criticisms. You're extremely personable and I find it extremely easy to relate to you as a person in a video like this (as in, your train of thought is very similar to my own, and you end up having a lot of the same questions that I have). You're very good at explaining your thought process: it's always clear where you are and what you're doing, what you're about to do (mostly), and what you've done already, and it's very easy to follow and understand you.
The live element is phenomenal, and I'm genuinely looking forward to future content from you. Thank you for taking the time to make these videos!
* I'm talking about any of the live stuff you do. Challenges, malware analysis, etc. They're all gold.
WOW that logic. also that gradually printing the flag amazed me. wow bro
Super awesome! I really enjoy palling around with you on challenges. I'm learning a lot about the critical thinking of try, fail, try something else instead of getting bogged down in an endless loop of my own making. Thanks a bunch John!
This was super freaking interesting. Blind injection is quite a weird one to me and couldn't wrap my head around some of the reading I've done, this opened my eyes to the possibilities of blind injection and what can be done, thank you very much
Wow! This is one of the most amazing videos that I've ever seen.
Definitely gives more knowledge than throwing it at sqlmap.
John makes every hard question human-doable :-). it was really fun. I really struggled at this one
The END JOHN, the END!
That's what I figured out from the challenge...
Great to watch someone being able to script this. :D I literally had to semi-brute the table and the flag using BurpSuite Intruder because I horribly suck at automating stuff like that. Took me 45 Minutes to get it done.
I learn a lot wtchig your videos, you're really good, i'm you're sub now, amazing work John!!
Idk why but this was fun to watch. A lot of aha moments for me. Thanks man
Same here, I'm loving your channel so far✌
Lovely timing. Needed this after a stressful day! Great video
While watching this video, with my limited knowledge of sql injection I was wondering if it would be a lot easier to just stick a semicolon into that order by input to allow you to end that sql statement and start a new one, enabling you to put in whatever you want… but I did eventually realize the code running the sql query is outputting whatever is returned by the FIRST statement, so any sql you could run after that first statement would *probably* be useless if the end goal is to leak data. (however would still be useful if your end goal was to destroy data or something like that)
Man watching that flag coming thru almost was like magic ❤️
Keep them coming these are great! Good job
Thank you John, very encouraging.
Hi John sir big fan new in your channel !
Nice video! Learned alot watching you
Very nice ...Dumps-Up!
This was a fun problem. Solved it using the BurpSuite during the challenge... then got ashamed and went back and made a nice python script. Aliencamp was another fun emoji challenge :)
need look some more into blind sqli... but always a blast !
Love these code review challenges
Thats cooooooool 🔥🔥
Hello sir your videos rellay helpfull for beginner
Great bro.
now it's time to learn how to make a blind injection with less requests 🙈 well done.
Considering how the flags are structured he could check vowels first then constants by their commonality in words, but other then that you risk missing a character
Great video, but you should apply threading for the final part, much faster work
That was great, thank you so much!
Gotta love the moment where I'm yelling "END....ENDD...END...it needs an END" at my screen. I know for a fact if someone were to record me coding there would be probably 5x as many instances of me freaking out over what went wrong when it's just some silly syntax error i forgot to copy from the documentation lmao.
impressive
loving the vidz man
Awesome !!
That was dope!
Love this 👍
Great video i had a good time. Thx
Great video!!
you're the man....
I love your content bro.👍
good video
Hi , we need a live session , also love from india
so cool
Your brain. Your damn brain. KUDOS!!!
A MA ZI NG
as usual 👏🤣👌🏽👍🏿👏
Good Luck bro
More Rick and Morty please! Oh wait, wrong guy
Wow bro this was cool
😻
You are awesome
бРАВО, Маэстро!
Awesome
Push!
21:37, how long was the break? :) awesome work tho mister! really great stuff!
Cool
you could have also done it with a time based subselect ;D
❤️
Where’s printable car in your python script used ???
How does python knows hay I should print only these char ???
why does your sublime text instantly update to executable?
Where to learn ctf and htb
i BLAME YOU for The Sleepless Nights, lol jpjp,watching ur videos lol
The END, John. THE END.
That's it, that's the comment.
Anyone tell me wht all the programming Lang I need to know for hack the box and anyone tell where to learn hacking
Hi Sir Help Me i want to know best book to learn reverse engineering from zero to advance..... Plzz help
Thanks
Hilson thapa Bernhardt
I NEED MALWARE VIDEOS
subtitle?
alocate object types to object class?🙂👻
Any biafran here?
in the real world you dont have all the code to look at
guy says hes a hacker expert doesnt even know case statements, damn must be pro walk thru then do the hack.... lol
Great video!!!