webPromedium
InfraScope — Blind SQLi to RCE via User-Agent Audit Logging
hackadvisor
Task: Infrastructure monitoring platform with audit logging that inserts User-Agent header via non-parameterized SQL. Solution: Blind SQLi via User-Agent during login, escalate to admin via SQL UPDATE, exfiltrate data through audit logs, enable xp_cmdshell for RCE to read flag.
$ ls tags/ techniques/
sqlitesqlirceheader_injectionuser_agentprivilege_escalationblind_sqlimssqlxp_cmdshellexpress_jsaudit_loggingstacked_queries
sqli_via_user_agent_headermulti_row_insert_injectionprivilege_escalation_via_sql_updaterce_via_xp_cmdshelldecoy_flag_avoidance
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 120 — InfraPulse— hackadvisor
- [web][Pro]Lab 322 — NetPulse — IP Spoofing to RCE via Polling Agent API— hackadvisor
- [web][Pro]Lab 81 — InsightPulse — SQL Injection in Analytics Tracking— hackadvisor
- [web][Pro]Lab 104 — CloudOps Copilot — AI SSRF via Infrastructure Tool Abuse— hackadvisor
- [web][Pro]Lab 326 — PulseBoard — NoSQL Injection in Authentication— hackadvisor