[unrecognized]

sql injection in n8n endpoint.

[zippo99]

im bob but where's the flag... ),:

[AncientNull]

sql injection in n8n endpoint.

Are you talking about the auth endpoint, or the webhook in the wiki?

[samuelballsiu1]

sql injection in n8n endpoint.

I can't find the n8n endpoint, which you mentioned. Can you please be more clear?

[date202511]

Did I miss something important?

[jsvensson]

sql injection in n8n endpoint.

I can't find the n8n endpoint, which you mentioned. Can you please be more clear?

http://a668910b5514e.whiterabbit.htb/en/...h_webhooks

POST /webhook/d96af3a4-21bd-4bcb-bd34-37bfc67dfd1d HTTP/1.1
Host: 28efa8f7df.whiterabbit.htb -- this is n8n
x-gophish-signature: sha256=cf4651463d8bc629b9b411c58480af5a9968ba05fca83efa03a21b2cecd1c2dd
Accept: */*
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Content-Type: application/json
Content-Length: 81

{
  "campaign_id": 1,
  "email": "test@ex.com",
  "message": "Clicked Link"
}

i think in this POST is sqli but can't get it work - maybe somebody explain how to do it

[AncientNull]

sql injection in n8n endpoint.

I can't find the n8n endpoint, which you mentioned. Can you please be more clear?

http://a668910b5514e.whiterabbit.htb/en/...h_webhooks

POST /webhook/d96af3a4-21bd-4bcb-bd34-37bfc67dfd1d HTTP/1.1
Host: 28efa8f7df.whiterabbit.htb -- this is n8n
x-gophish-signature: sha256=cf4651463d8bc629b9b411c58480af5a9968ba05fca83efa03a21b2cecd1c2dd
Accept: */*
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Content-Type: application/json
Content-Length: 81

{
  "campaign_id": 1,
  "email": "test@ex.com",
  "message": "Clicked Link"
}

i think in this POST is sqli but can't get it work - maybe somebody explain how to do it

The email field is injectable, I was able to drop a table, just not able to get output. You need to set the gophish signature with the secret in the json. Anyone have a known valid email for the box?

[jsvensson]

sql injection in n8n endpoint.

I can't find the n8n endpoint, which you mentioned. Can you please be more clear?

http://a668910b5514e.whiterabbit.htb/en/...h_webhooks

POST /webhook/d96af3a4-21bd-4bcb-bd34-37bfc67dfd1d HTTP/1.1
Host: 28efa8f7df.whiterabbit.htb -- this is n8n
x-gophish-signature: sha256=cf4651463d8bc629b9b411c58480af5a9968ba05fca83efa03a21b2cecd1c2dd
Accept: */*
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Content-Type: application/json
Content-Length: 81

{
  "campaign_id": 1,
  "email": "test@ex.com",
  "message": "Clicked Link"
}

i think in this POST is sqli but can't get it work - maybe somebody explain how to do it

The email field is injectable, I was able to drop a table, just not able to get output. You need to set the gophish signature with the secret in the json. Anyone have a known valid email for the box?

I knew about signature, what is your payload to drop table?

[AncientNull]

sql injection in n8n endpoint.

I can't find the n8n endpoint, which you mentioned. Can you please be more clear?

http://a668910b5514e.whiterabbit.htb/en/...h_webhooks

POST /webhook/d96af3a4-21bd-4bcb-bd34-37bfc67dfd1d HTTP/1.1
Host: 28efa8f7df.whiterabbit.htb -- this is n8n
x-gophish-signature: sha256=cf4651463d8bc629b9b411c58480af5a9968ba05fca83efa03a21b2cecd1c2dd
Accept: */*
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Content-Type: application/json
Content-Length: 81

{
  "campaign_id": 1,
  "email": "test@ex.com",
  "message": "Clicked Link"
}

i think in this POST is sqli but can't get it work - maybe somebody explain how to do it

The email field is injectable, I was able to drop a table, just not able to get output. You need to set the gophish signature with the secret in the json. Anyone have a known valid email for the box?

I knew about signature, what is your payload to drop table?

I was able to drop the victims table with "test@ex.com"; DROP TABLE victims;--"
DON'T do that unless you want to restart the box. I think without a valid email we will always get "Info: User is not in database" back.

[aryphowake]

With SQLi you can extract juicy data. The signature can be calculated using sqlmap and the eval param