hacktricks/network-services-pentesting/pentesting-web/h2-java-sql-database.md
carlospolop f0e09e3f54 social
2023-03-06 00:16:20 +01:00

3.7 KiB

H2 - Java SQL database

HackTricks in 🐦 Twitter 🐦 - 🎙️ Twitch Wed - 18.30(UTC) 🎙️ - 🎥 Youtube 🎥

Official page: https://www.h2database.com/html/main.html

Tricks

You can indicate a non-existent name a of database in order to create a new database without valid credentials (unauthenticated):

Or if you know that for example a mysql is running and you know the database name and the credentials for that database, you can just access it:

Tricks from box Hawk of HTB.

Unauthenticated RCE

You can find the exploit here https://gist.github.com/h4ckninja/22b8e2d2f4c29e94121718a43ba97eed

HackTricks in 🐦 Twitter 🐦 - 🎙️ Twitch Wed - 18.30(UTC) 🎙️ - 🎥 Youtube 🎥