Encrypted Database
Challenge Information
Category: Web Security
Level: easy
Points: 50
description
The company hired an inexperienced developer, but he told them he hided the database and have it encrypted so the website is totally secure, can you prove that he is wrong ??
Solution
well, after we access the lab we try to find any input field to inject it but i didn't found anu input field
now , let's go to review page source code hope to find any thing
okay, now we know we have /admin endpoint let's to access on it
well ,we don't have access let's try baypass it with this bypass-403 tool install it and type this command
./baypass-403.sh our_target (name of endpoint ) //in our case name of endpoint =>admin
all of this urls lead to the same endpoint now open it to see admin page login
we don't have any credentials to login in so let's review page source code
okay we find another endpoint
target//admin/secret-database/db.json #final endpoint 
okay if you try to submit this flag you get wrong so let's try to see if it encrypted or no wit this site
now we know it's already hashed with MD5 so i'll decrypt it in this site
Last updated