Challenge 2: Initial Compromise

Procedure:

Next, we need to find our initial compromise vector. Servers hosting openly accessible services, like websites and unsecured databases, are great places to start.

• Access the site hosted on the webserver you found in the previous step.
• Hint: How do you access a website on a custom port number?
• Explore the web pages available to you. What would be a good place to attempt some attacks?
• Hint: Your first goal should be to test anything that handles user input.
• Demonstrate you can run commands on the target system by running the whoami command.

Solution:

OPTION 1 (Manually)

Access the site hosted on the webserver 172.31.40.22:1013

┌──(kali㉿kali)-[~]
└─$ firefox 172.31.40.22:1013

Accesing the Apache server.

The input allows us to perform a SQL injection Attack

Accesing the passwd file.

Successful SQL Injection Attack

OPTION 2 (Using Burp Suite Community Edition)

• Intercepting the request in the Proxy Tab

• Sending the request to the Repeater Tab and testing the ls command

• Testing the whoami command

• Testing the cat /etc/passwd command

Successful SQL Injection Attack

Previous: Challenge 1 Home 🏠 Next: Challenge 3