> For the complete documentation index, see [llms.txt](https://itszaiden.gitbook.io/pentesting/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://itszaiden.gitbook.io/pentesting/writeups/dockerlabs/very-easy/injection.md).

# Injection

## 1 - Reconnaissance

We begin with a fast Nmap scan to identify open ports:

`nmap 172.17.0.2 -p- --open -sS -Pn --min-rate 5000 -T5`

**Result: ports 22 and 80 are open**

## 2 - Enumeration

Now we run a service/version detection scan, targeting only the open ports we found on the previous scan:

`nmap 172.17.0.2 -p 22,80 -sS -Pn -sCV`

**Result:**

<figure><img src="/files/WkDd1oPJD5r0wjMvOze3" alt=""><figcaption><p>(Injection) Targeted Port Scan</p></figcaption></figure>

We tried to find exploits or shellcodes using `searchsploit OpenSSH 8.9p1` and \`searchsploit Apache httpd 2.4.52 but there wasn't any. Our next step will be directory enumeration.

With the command `ffuf -w /path/to/wordlist/directory-list-2.3-medium.txt:FUZZ -u http://10.129.129.108/FUZZ` we didn't find anything useful, so we will browse the website,

<figure><img src="/files/P4zLuvWEV2ivJkL3wO58" alt=""><figcaption><p>(Injection) Web Content</p></figcaption></figure>

## 3 - Exploitation

As the machine name is `Injection` we will try a basic SQLi:

```
User: admin' or 1=1#
Password: test
```

We logged succesfully and we found potential SSH credentials:

<figure><img src="/files/lXU45I6i6YKk4FwmKCAL" alt=""><figcaption><p>(Injection) Dylan Credentials</p></figcaption></figure>

Trying them on SSH we log in successfully.

<figure><img src="/files/Jn94ZWo1abRGwSQpBWEI" alt=""><figcaption><p>(Injection) SSH Login</p></figcaption></figure>

## 4 - Summary

**Initial Access:** Performed SQL injection on the website login form to bypass authentication and recover plaintext SSH credentials, which granted direct shell access.