From the course: Penetration Testing Web Apps with Kali and Burp Suite

Unlock the full course today

Join today to access over 24,900 courses taught by industry experts.

Exploiting your way into the gym

Exploiting your way into the gym

From the course: Penetration Testing Web Apps with Kali and Burp Suite

Start my 1-month free trial Buy for my team

Exploiting your way into the gym

“

- Let's take a look at this gym management system which we can download from the source code tester site Shown here. This is a standard website which runs on a lamp stack system. I've downloaded and unzipped this application. We can see this is a PHP website, and if we have a look in the database folder, we can see the setup script for it. The installation instructions require us to set up the application by importing this setup script. In addition, we need to modify the DB connect .pi script and update it with our privileged SQL user credentials. I've done this already, so let's go take a look at it. 192 dot 168 dot 1 dot 176 slash gym 1. Okay, we're asked to enter credentials. Our first exploit will be the obvious one. We'll run an SQL injection by entering the user account as quote space - Or - One equals one - Hash - And we've logged in as the administrative user. There's a slightly more advanced version of the gym…

Contents