Posted in Hackthissite.org

HTS-Realistic Mission 4

Fischer’s Animal Products – Realistic Mission 4

The Mission

blurbRM4

Someone has asked you to retrieve the email addresses from the mailing list.

https://www.hackthissite.org/playlevel/4/

This is what you are faced with when opening the link in the mission blurb

websiteRM4

Nothing special here. No point in playing around with the mailing list. Clicking on any other link will have the same outcome, however, for this exercise, we’ll click on ‘Fur Coats!’

furcoatsRM4

I’m sure the coats are nice and warm, so lets check out the link.

https://www.hackthissite.org/missions/realistic/4/products.php?category=1

Originally I wasted a lot of time on this challenge. A UNION SELECT statement is needed to pull the email addresses you need as they are stored in another database from the current products. By adding the statement to the end of the URL you will find what you are looking for.

https://www.hackthissite.org/missions/realistic/4/products.php?category=1 UNION ALL SELECT NULL, *, NULL, NULL FROM email

I tried several versions of this statement and didn’t get anywhere. I spent a long time on this one. You should see this screen when you successfully enter the above statement.

SQLiRM4

Copy the emails into a txt file and use the HTS private message function to send the list to ‘SaveTheWhales’ Only after you do this part, will you complete the challenge.

 

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s