本文涵盖了SQL的基本概念，如SQL注入是常见的安全漏洞类型，以及PII（Personally Identifiable Information）的重要性。还提到了OWASP Top 10中关于注入的分类，并指出端口80上运行的服务为Apache httpd 2.4.38。HTTPS协议的标准端口是443，而暴力破解是一种针对登录页面的运气型攻击方法。在Web应用中，目录被称为webdirectory，404错误表示“未找到”。Gobuster用于发现目录而非子域名时使用的参数是`-dir`。代码注释通常使用`#`符号。文章最后提到了一个SQL注入的通用密码尝试。
What does the acronym SQL stand for?
Structured Query Language
What is one of the most common type of SQL vulnerabilities?
SQL injection
What does PII stand for?
personally identifiable information
What does the OWASP Top 10 list name the classification for this vulnerability?
A03:2021-Injection
What service and version are running on port 80 of the target?
Apache httpd 2.4.38 ((Debian))
What is the standard port used for the HTTPS protocol?
443
What is one luck-based method of exploiting login pages?
brute-forcing
What is a folder called in web-application terminology?
web directory
What response code is given for "Not Found" errors?
404
What switch do we use with Gobuster to specify we're looking to discover directories, and not subdomains?
dir
What symbol do we use to comment out parts of the code?
#
Submit root flag
万能密码： admin' or '1' = '1
扫一扫
1079
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
