Cyber Apocalypse Day #4: SQL injection and password cracking by @panawesome
Source: YouTube · Hack The Box · published Mar 25, 2025 · 32:47
The video summarizes a live stream session from Cyber Apocalypse 2025, focusing on a workshop by Panos on SQL injection and password cracking. The main goal is to teach beginners how to identify and exploit vulnerabilities in web applications, using a real challenge as a practical example.
Key Takeaways:
• The session introduces SQL injection on a login screen by testing with a single quote to trigger an error, revealing a vulnerability 10:06-10:34.
• Panos demonstrates using Burp Suite to intercept and analyze HTTP requests, then uses SQLmap to detect SQL injection and extract database contents 12:01-16:50.
• The database table "users" is dumped, revealing usernames and hashed passwords, with the hash identified as bcrypt 17:03-18:17.
• The password is cracked using Hashcat and a common password list (rockyou.txt), resulting in "password123" 28:16-29:24.
The event continues with daily prize draws and write-ups open to all participants, emphasizing learning over winning.
A flipper zero was awarded to the user at line number 5,694 in the entry database, with winners notified via Hack the Box email 5:03-5:19.
Sources:
- 10:06-10:34 Discussion of SQL injection on login screen and error message analysis
- 12:01-16:50 Use of Burp Suite and SQLmap to detect and exploit SQL injection
- 17:03-18:17 Database dump and identification of bcrypt hash
- 28:16-29:24 Password cracking using Hashcat and rockyou.txt wordlist
- 5:03-5:19(https://www.youtube.com/watch?
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
Heat. Heat. [Music] [Music] Hey everyone, welcome back to day three of the streams, day four of uh Cyber Apocalypse 2025. I hope everyone's been having fun. It's been a crazy competition so far. And in fact, we have some pretty awesome updates. Uh now, before I say these updates, there are still plenty of prizes up for grabs. So, uh, don't be discouraged by this. Uh, we have had, just as a fun update, we have had first through 10th place all claimed. We have had several teams complete all the challenges. That being said, and let me switch over so I can see uh, folks in chat. Hello everyone tuning in. Uh, now we still have our daily drawing for the flipper zero, which I'll be completing our daily drawing for today here in just a little bit. Uh, and then we also have our top cyber apocalypse…