HackTheBox - MonitorsThree
Source: YouTube · IppSec · published Jan 18, 2025 · 49:15
BLUF: This video demonstrates a manual SQL injection attack on a "Forgot Password" feature using error-based extraction to bypass blind injection limitations, leading to database credential theft and unauthorized access to a Cacti monitoring instance 0:00.
Key Takeaways:
• The target machine features a "Forgot Password" functionality vulnerable to SQL injection, where standard union-based injection is ineffective due to lack of output reflection 0:05.
• Instead of relying on slow boolean-based blind injection tools like SQLMap, the attacker exploits reflected error messages to perform error-based SQL injection 0:15.
• By crafting specific SQL queries that trigger errors containing desired data, the attacker can extract all password hashes from the database efficiently 0:30.
• The extracted credentials allow the attacker to log into a Cacti instance, which serves as a network monitoring tool, further compromising the system 0:35.
This walkthrough highlights the importance of manually testing for error-based SQLi in blind injection scenarios to accelerate exploitation and gain deeper system access.
Sources:
- 0:00 Introduction to the Hack The Box machine "Monitors 3" and the initial SQL injection vulnerability.
- 0:15 Explanation of why blind injection is slow and the decision to use manual error-based injection.
- 0:30 Demonstration of using error messages to extract database hashes.
- 0:35 Accessing the Cacti instance using the stolen credentials.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
what's going on YouTube this is IPC and today we'll be doing monitors 3 from hack the box which starts off with an SQL injection that forgot password feature of the website but since the field doesn't reflect any data back to the user Union injection isn't really going to be beneficial here I think most people just use SQL map which will default the Boolean injection which is relatively slow and you don't learn that much by just throwing SQL map at it so we'll be doing it manually but taking advantage of the fact that it reflects the error messages back to you so we can use error injection to craft a SQL query that will put the data we want in an error message after doing this we can extract all the hashes from the database get some credentials and log into a cacti instance which enables u…