SQL injection and password cracking by @panawesome | Hack The Box
Source: YouTube · Hack The Box · published Mar 24, 2025 · 23:46
A beginner-friendly web security challenge demonstrates SQL injection to access a database and crack a password using hash cracking tools. 0:41
Key Takeaways:
• A generic error message on the login screen masks user enumeration, a common security flaw 1:05.
• Appending a single quote to the username triggers a different error, indicating SQL injection vulnerability 3:45.
• Burp Suite intercepts HTTP requests, enabling automated SQL injection testing with SQLmap 5:02.
• SQLmap identifies a "users" table containing username, password (hashed), and ID fields 10:32.
• The password hash uses bcrypt with a salt value of 32000 18:19.
• Hashcat cracks the password using a common password wordlist, revealing "password123" 21:54.
Successful access to the admin account is achieved using the cracked credentials, illustrating fundamental attack techniques in a CTF environment. 23:10
Sources:
- 0:41 Discussion of error messages and user enumeration
- 1:05 Observation of error message behavior indicating SQL injection vulnerability
- 3:45 Manual SQL injection attempt with single quote
- 5:02 Burp Suite and SQLmap usage for automated testing
- 10:32 Database table structure and field identification
- 18:19 bcr
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Hello everyone. This is Panos from Hack the Box. This is the third day of Cyber Apocalypse and today we're here with a workshop and this is a workshop on last year's Corp Terminal Challenge. It's a very easy web challenge, but uh I think it's a nice opportunity to see some of the stuff that uh some of the tools that we use quite a lot and um learn some things in case somebody is a total beginner and to see one of the easy challenges that uh you can do. So without wasting any more time, let's start with the challenge. So as we enter the web application, the first the first thing we are greeted with is this login screen. So probably the first thing that anybody would try to do is try to see if some classic like um admin admin common combinations exist. Um and we can see that it's not the cas…