Validation
Enumeration by using rustscan.
Sending request to the burpsuite and adding ' .
Result:
We can see error, so website it's probably vulnerable for SQLi.
Injection:
Checking if working:
Great, fully works.
Now we have to make a shell:
We are inside 👏
First flag 🎉
Getting root.
We can find password in config.php, this is password for root account.
Second flag:
Last updated