[shodin11]

I'm very new to the hacking community and need information on information regarding user information and passwords. I can assume most of user information for things like websites and apps are stored in databases.  How would someone be able to view user information from a database and other things like password hashes?

[mothered]

How would someone be able to view user information from a database and other things like password hashes?

Something like this:

Spoiler:

Dedication and years decades of hard work.

[VilePyromancer]

How would someone be able to view user information from a database and other things like password hashes?

Something like this:

Spoiler:

Dedication and years decades of hard work.

Is that a website you gained admin access to through the admin login panel of the page? If so was access to the directory blocked with 404 forbidden access?

[mothered]

How would someone be able to view user information from a database and other things like password hashes?

Something like this:

Spoiler:

Dedication and years decades of hard work.

Is that a website you gained admin access to through the admin login panel of the page? If so was access to the directory blocked with 404 forbidden access?

You may be confused with how the 404 functions. It doesn't block requests, but rather a HTTP status/response code Indicating that the webpage couldn't be found on the web server.

I used a combination of Content/Boolean-Based & Union-Based SQLi to get In. The WAF kicked In prior, so I had to circumvent that to move forward.

[Cr3aTor]

To ask your question very briefly, usually you can access database information through SQLi (SQL injection). However, because people abused this in the past, nowadays there are some defensive mechanisms to prevent such attacks, some may be: WAF (Web Application Firewall), input filtering, etc (you can have a look here and here).

Anyhow, clever people find ways to bypass those mechanisms, thus getting access to sensitive information. Besides that, people who configure/code the database and the web server might screw up and have bugs in their code, therefore if you find it and exploit it you can gain access.

Even if defensive mechanisms are in place, many people don't even bother using them. So you can find a lot of websites vulnerable to SQLi.

[VilePyromancer]

I meant 403. I'm not confused. I meant to asked if the admin login portion of the website was blocked by 403 forbidden access. I'm having trouble getting into the forbidden directory so I can access admin login page. I can't seem to find any information on the subject. Maybe spoofing could work? Or maybe accessing files in another directory that would allow me to get access to the admin page? Idk.. The webserver is Microsoft ISS/8.5. I have scanned for vulnerabilities with nitko and also tried finding exploits but so far haven't been able to find what I need. I didn't know people used SQL injection attacks anymore. Must be an old site if you gained access that way. I have never had any luck with it lol. Anyways any info is much appreciated.

[Hutsom]

I'm very new to the hacking community and need information on information regarding user information and passwords. I can assume most of user information for things like websites and apps are stored in databases.  How would someone be able to view user information from a database and other things like password hashes?

In a nutshell: https://www.youtube.com/watch?v=AuPiYZr5Yfw

[mothered]

I'm very new to the hacking community and need information on information regarding user information and passwords. I can assume most of user information for things like websites and apps are stored in databases.  How would someone be able to view user information from a database and other things like password hashes?

In a nutshell: https://www.youtube.com/watch?v=AuPiYZr5Yfw

In terms of SQLi attack vectors, It barely scratches the surface.