search

old-38 -- SQLi (Newline)

URL: https://webhacking.kr/challenge/bonus-9/arrow-up-right

old-38-1.png
<html>
<head>
<title>Challenge 38</title>
</head>
<body>
<h1>LOG INJECTION</h1>
<form method=post action=index.php>
<input type=text name=id size=20>
<input type=submit value='Login'>
</form>
<!-- <a href=admin.php>admin page</a> -->
</body>
</html>

IMAGE

It seems like we are in an INSERT query.

The log wanted to see IP:admin and to make that happen \r -> %0D%0A is required to inject newline and then add our content:

View logs:old-38-2.png

Previousold-37 -- Router Port ForwardingNextold-39 -- SQLi (Length)

Last updated