ProxiesFood: Unlimited Residential Proxy ◆ [#1] PURE RAT v4 // BEST HVNC RAT ◆ Private Crypter - Unique Private Stubs ◆ Spoof Call and Spoof SMS set any caller ◆
Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact
Hack Forums Hacks, Exploits, and Various Discussions Grayhat • Purple Team • Hybrid Security Website Hacking SQL Injection Attacks › Got the Username and Password but Password Incorret?

New Reply 

Got the Username and Password but Password Incorret?
No0b3rT
No0b3rT Offline
[n00b@HF:]
*
Registered
Posts:
76
Threads:
19
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jul 5, 2013 06:05 AM
So I'm kind of new to this whole SQLi thing. I would normally do it with BackTrack but I actually wanted to learn for myself lol.

So I got a vulnerable site, go to the Login Password bs and I got this

I found username and password in the table 'users' so after I did the

concat(username,0x3a,password)

it gave me this

[Image: 83f5b1b63b0244048b2979106d2869d5.png]

then I found the admin page but the password is incorrect.

So now what? lol
webspider
webspider Offline
[root@HF:]
***
HF Ub3r
Posts:
1,133
Threads:
38
Credibility:
100
Popularity:
56
βytes:
β 1,932
Game XP:
0
Jul 5, 2013 06:08 AM
The password seems to be encrypted. You would have to decrypt it to work.
No0b3rT
No0b3rT Offline
[n00b@HF:]
*
Registered
Posts:
76
Threads:
19
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jul 5, 2013 06:09 AM
(Jul 5, 2013 06:08 AM)webspider Wrote:  The password seems to be encrypted. You would have to decrypt it to work.

That's what I figured too lol.

How do I figure out which way it's encrypted? I figured it'd be MD5 but it wasn't.
N1T3ST4LK3R
Guest
 
Jul 5, 2013 06:12 AM
(Jul 5, 2013 06:09 AM)No0b3rT Wrote:  That's what I figured too lol.

How do I figure out which way it's encrypted? I figured it'd be MD5 but it wasn't.

The site you injected, what's it running?
No0b3rT
No0b3rT Offline
[n00b@HF:]
*
Registered
Posts:
76
Threads:
19
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jul 5, 2013 06:13 AM
(Jul 5, 2013 06:12 AM)N1T3ST4LK3R Wrote:  The site you I injected, what's it running?

I assume you're talking about the SQL Version?

5.1.68-cll-lve
N1T3ST4LK3R
Guest
 
Jul 5, 2013 06:21 AM
(Jul 5, 2013 06:13 AM)No0b3rT Wrote:  I assume you're talking about the SQL Version?

5.1.68-cll-lve

Then it should be SHA-1, I believe.
No0b3rT
No0b3rT Offline
[n00b@HF:]
*
Registered
Posts:
76
Threads:
19
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jul 5, 2013 06:31 AM
(Jul 5, 2013 06:21 AM)N1T3ST4LK3R Wrote:  Then it should be SHA-1, I believe.

When I go to decrypt it, it tells me not found for everything so far lol.

SHA1, MD5, NTLM
N1T3ST4LK3R
Guest
 
Jul 5, 2013 06:34 AM
(Jul 5, 2013 06:31 AM)No0b3rT Wrote:  When I go to decrypt it, it tells me not found for everything so far lol.

SHA1, MD5, NTLM

Then that particular hash hasn't been cracked yet.
No0b3rT
No0b3rT Offline
[n00b@HF:]
*
Registered
Posts:
76
Threads:
19
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jul 5, 2013 06:35 AM
(Jul 5, 2013 06:34 AM)N1T3ST4LK3R Wrote:  Then that particular hash hasn't been cracked yet.

So now what do I do? Should I just forget the site and try another?
N1T3ST4LK3R
Guest
 
Jul 5, 2013 06:40 AM
(Jul 5, 2013 06:35 AM)No0b3rT Wrote:  So now what do I do? Should I just forget the site and try another?

You could ask around the Crypto section, and see if someone will brute force it for you. Or even better, read some tuts and learn to do it yourself. (Not trying to sound mean or anything, just a suggestion. If you learn to do it yourself, you'd be better off down the road.)
Meaps
Meaps Offline
[user@HF:]
*
Registered
Posts:
238
Threads:
19
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jul 5, 2013 07:04 AM
It's encrypted OP, google to decrypt it ;)
Dеath
Dеath Offline
[closed@HF:]
Posts:
3,915
Threads:
729
DO NOT DEAL WITH THIS MEMBER
βytes:
β 0
Game XP:
0
Jul 5, 2013 09:00 AM
(Jul 5, 2013 06:05 AM)No0b3rT Wrote:  So I'm kind of new to this whole SQLi thing. I would normally do it with BackTrack but I actually wanted to learn for myself lol.

So I got a vulnerable site, go to the Login Password bs and I got this

I found username and password in the table 'users' so after I did the

concat(username,0x3a,password)

it gave me this

[Image: 83f5b1b63b0244048b2979106d2869d5.png]

then I found the admin page but the password is incorrect.

So now what? lol

Hey, so i see you needed help, can you try this pass to use with the logon?:
Code
19830713
No0b3rT
No0b3rT Offline
[n00b@HF:]
*
Registered
Posts:
76
Threads:
19
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Jul 5, 2013 11:17 AM (This post was last modified: Jul 5, 2013 11:53 AM by No0b3rT.)
(Jul 5, 2013 09:00 AM)Dеath Wrote:  Hey, so i see you needed help, can you try this pass to use with the logon?:
Code
19830713

I forgot the website now lmao.

Greeaatt

Just out of curiosity, what did you do to decode it?
Dark4Hack
Dark4Hack Offline
[n00b@HF:]
*
Registered
Posts:
11
Threads:
4
Credibility:
000
Popularity:
0
βytes:
β 0
Game XP:
0
Oct 24, 2018 02:12 PM
It's seems you are tired after trying All Methods Let's Try this one May Be It ll work For You decrypt it With Base64
krlo-s
krlo-s Offline
[user@HF:]
*
Registered
Posts:
210
Threads:
32
Credibility:
100
Popularity:
0
βytes:
β 10
Game XP:
0
Oct 24, 2018 03:38 PM
Wow, that was a rough necroposting
Next Oldest | Next Newest
New Reply