Tinkering in the shed.

  Shop by D4t4s3c is classiefied as easy, like most machines they are easy if you know how to do it and not so easy if you don't. If you have not seen blind SQL injection before then its not that easy! Find it Scan it So just http(80) and ssh on a high port available. User running nikto -h http://10.0.0.22 identified /shop as interesting and again running it against the /shop url point to the way forward with /shop/administrator/ The login page can be manipulated with time based SQL injection. trying different SQL options for the username  ' or sleep(5)-- and anything in th password field When executed on the server this changes the SQL query from Select something from table where user='username' AND password='password' to select something from table where user='' or sleep(5)-- everything else is commented out ! So as we cant see the results of anything what we need is a tool to automate blind SQL. https://sqlmap.org/ Install with sudo apt-get sqlmap or ...