📝 Final Report & Lessons Learned
1. Executive Summary
Appointment is a Tier 1 machine in the HTB Starting Point path. It focuses on web application security, specifically SQL Injection (SQLi) in login forms. The machine demonstrates how simple input validation failures can lead to complete authentication bypass.
2. Key Takeaways
- Technical takeaways: SQL Injection is a powerful tool for bypassing authorization. Even a single quote (
') and a comment character (#or--) can be enough to compromise a login portal. - Strategic takeaways: Web applications are often the weakest point in an external network perimeter. Always test input fields.
3. Remediation
- Use Prepared Statements (Parameterized Queries): This is the primary defense against SQLi. It ensures that user input is never interpreted as part of the SQL command.
- Input Validation & Sanitization: Implement strict rules for what characters are allowed in input fields.
- Least Privilege: Ensure the database user used by the web application has limited permissions.
4. Skills Gained
- Basic SQL Injection (SQLi)
- Authentication Bypass Techniques
- Using Rustscan for fast port discovery
- Analyzing HTTP request/response in browser dev tools
Operations