Please ask questions ONLY in this topic.

[footyfanatic77]

I've been through the website and found out that the teachers table is vulnerable
I just need to find out the injection
A hint would be much appreciated.
Thank you.

EDITED BY FAITH

Please ask questions only in this topic.
Just to keep the forum neat, and hopefully your post more noticed.
Please help us to keep the forum clean by report trashy posts. :>
You may start a new post if you're making a tutorial. However, if the tutorials are similar, please do not make two.

I wish you best luck with this mission, and hope you enjoy it.

<3 faith.

[gm war]

one hint then with this new account i will say update.php

[pitagora]

I've been through the website and found out that the teachers table is vulnerable
I just need to find out the injection
A hint would be much appreciated.
Thank you.

I'm really stuck here. I'm sitting in front of the staff login wondering how to get in. I've check every single script for sql injections and nothing. In what script was the bug? I need a hint here. This is driving me crazy for weeks...

@gm war: there is no update.php.

[White_King]

I've been through the website and found out that the teachers table is vulnerable
I just need to find out the injection
A hint would be much appreciated.
Thank you.

I'm really stuck here. I'm sitting in front of the staff login wondering how to get in. I've check every single script for sql injections and nothing. In what script was the bug? I need a hint here. This is driving me crazy for weeks...

@gm war: there is no update.php.

Are you sure?

[footyfanatic77]

Go to the teacher table and click on a teacher then look at the url and the variable
I just don't know the injection for it any hints
thanks

[thanaa]

Is it supposed to be like that? Just listing the grade scale but no grades?

[footyfanatic77]

Same i think the grades aren't the way your supposed to get in. I'm stuck on this mission too, but I think the teacher table is vulnerable to sql injection

[Tommyboy123a]

Is there something I'm missing..? I've done this mission before but when I wrote down how to do it I just said "log in as any teacher on the s****.php page. I've tried various SQL injections and the usual inspection but no luck. A push in the right direction would be much appreciated

[raymo39]

iv logged in, to the correct area, i think
i have a browser problem
if u can help me it would be much appreciated
this seems very vague, im trying not to give spoilers

[Tommyboy123a]

You need to make the server think you are accessing the site from the "holy_teacher" browser.

the php code used is probably something like this

Code: Select all

$user_agent = $_SERVER['HTTP_USER_AGENT'];


a typical user agent looks something like "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; DimensionBrowser; .NET"
but again, you need to make it look like it was coming from "holy_teacher"

I would google "how to change user agent" if i were you, might be easier with firefox as well

[I hope the above wasn't too much of a spoiler?]