# Appointment HTB 1) what Does SQL stands for = Structured Query Language 2) which is most common attack in SQL = SQL Injection 3) What is the 2021 OWASP Top 10 classification for this vulnerability? = AO3:2021-Injection 4) what service is running on PORT 80 on target ip = Apache httpd 2.4.38 ((Debian)) nmap -T4 -sC -sV -O -p- -vv 5) standard port for HTTPS = 443 6) folder called in web termenology = Directoty 7) HTTP response code for 'NOT FOUND' = 404 8) Gobuster is one tool used to brute force directories on a webserver. What switch do we use with Gobuster to specify we're looking to discover directories, and not subdomains? = dir gobuster dir -u [http://192.168.x.x/](http://192.168.x.x/) -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 100 9) What single character can be used to comment out the rest of a line in MySQL? = # 10 If user input is not handled carefully, it could be interpreted as a comment. Use a comment to login as admin without knowing the password. What is the first word on the webpage returned? = Congratulations 11) Root flag= e3d0796d002a446c0e622226f42e9672