HTB ROOMS

Sequel

Piyush Shende — Thu, 26 Mar 2026 09:58:42 GMT

in scan what is port number of Mysql = 3306

nmap - T4 -sV -sC -O -p- -vv

nmap -T4 -p 3306 -sC -sV -vv

what community developed the sql version we find in scan = mariadb
When using the MySQL command line client, what switch do we need to use in order to specify a login username? = -u
Which username allows us to log into this MariaDB instance without providing a password? = root

mysql -h 10.129.46.191 -u root --skip-ssl

In SQL, what symbol can we use to specify within the query that we want to display everything inside a table? = *
In SQL, what symbol do we need to end each query with? = ;
There are three databases in this MySQL instance that are common across all MySQL instances. What is the name of the fourth that's unique to this host? = htb

Appointment HTB

Piyush Shende — Thu, 26 Mar 2026 08:42:18 GMT

what Does SQL stands for = Structured Query Language
which is most common attack in SQL = SQL Injection
What is the 2021 OWASP Top 10 classification for this vulnerability? = AO3:2021-Injection
what service is running on PORT 80 on target ip = Apache httpd 2.4.38 ((Debian))

nmap -T4 -sC -sV -O -p- -vv

standard port for HTTPS = 443
folder called in web termenology = Directoty
HTTP response code for 'NOT FOUND' = 404
Gobuster is one tool used to brute force directories on a webserver. What switch do we use with Gobuster to specify we're looking to discover directories, and not subdomains? = dir

gobuster dir -u http://192.168.x.x/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -t 100

What single character can be used to comment out the rest of a line in MySQL? = #

10 If user input is not handled carefully, it could be interpreted as a comment. Use a comment to login as admin without knowing the password. What is the first word on the webpage returned? = Congratulations

Root flag= e3d0796d002a446c0e622226f42e9672

Redeemer

Piyush Shende — Wed, 25 Mar 2026 17:08:16 GMT

which TCP port is open on machine = 6379

nmap -T4 -sC -sV -O -p-

2 service running that port = redis

Type of database REDIS have = in-memory database
which cli REDIS use = redis-cli
flag used with redis cli to specify hostname = -h

redis-cli -h redis15.localnet.org -p 6390 PING
PONG

Once connected to a Redis server, which command is used to obtain the information and statistics about the Redis server? = info
version of REDIS server on target machine = 5.0.7
command use to select desired database in REDIS = 4

connect with REDIS CLI

redis-cli -h 
select 0
keys *

how to get flag

get flag

Dancing HTB

Piyush Shende — Wed, 25 Mar 2026 16:28:19 GMT

what Does SMB stands for = server message block
port number of SMB = 445
service name of port 445 on tagret IP = microsoft-ds?
What is the 'flag' or 'switch' that we can use with the smbclient utility to 'list' the available shares on Dancing?
flag to list smb shares = -L { smbclient -L }
share name which can open without password = Workshares

# to connect with smb shell = smbclient \\\\IP\\share

command to download file from SMB shell = get

FAWN

Piyush Shende — Wed, 25 Mar 2026 16:05:10 GMT

what does FTP stands for = file transfer protocol
whst is port numbr of FTP = 21
Extension of FTP protocol which provide serurity = SFTP
Command use to send ICMP cho request = ping
FTP version from target ip = nmap -T4 -O -sC -sV -Pn -vv
OS we got while NMAP scan = UNIX
command to display FTP client help menu = ftp -h
username used to FTp when login without having account = anonymous {hint= When your name is not known, you are...}
response code when we get successfully login in FTP = 230
command to list = ls

command to download file from ftp server to local machine = get

Meow

Piyush Shende — Wed, 25 Mar 2026 15:41:01 GMT

Nmap Scan

nmap -O -sV -sC -p-

we got telnet port open and we have hint that we can login ass root withouth pasword

telnet portnumber

and get the flag