Pentester Lab: From SQL injection to Shell

  • Name: Pentester Lab: From SQL injection to Shell
  • Date release: 13 Sep 2012

Please remember that VulnHub is a free community resource so we are unable to check the machines that are provided to us. Before you download, please read our FAQs sections dealing with the dangers of running unknown VMs and our suggestions for "protecting yourself and your network. If you understand the risks, please download!


(Size: 169 MB)


(Size: 172 MB)




This exercise explains how you can from a SQL injection gain access to the administration console. Then in the administration console, how you can run commands on the system.

What you will learn?

  • SQL injection exploitation using UNION
  • Cracking md5 hashed passwords
  • Writing a PHP webshell

  • Filename: from_sqli_to_shell_i386.iso
  • File size: 169 MB
  • MD5: 9221158D81B826034B3B8E3D3FC8EC68
  • SHA1: F1BE03CACE56F7951AC5A91BF43353289BE90813

  • Filename: _from_sqli_to_shell.iso
  • File size: 172 MB
  • MD5: F40B5E5CD6842155552788C83E9F69B5
  • SHA1: 50C9F870F070FDFEAEACB45A8CA6E2824B411D2E

  • Format: Disk Image (.ISO)
  • Operating System: Linux

  • DHCP service: Enabled
  • IP address: Automatically assign