Pentester Lab: From SQL injection to Shell: PostgreSQL edition

  • Name: Pentester Lab: From SQL injection to Shell: PostgreSQL edition
  • Date release: 7 Dec 2012

Please remember that VulnHub is a free community resource so we are unable to check the machines that are provided to us. Before you download, please read our FAQs sections dealing with the dangers of running unknown VMs and our suggestions for "protecting yourself and your network. If you understand the risks, please download!


(Size: 161 MB)


(Size: 164 MB)




This exercise explains how you can from a SQL injection gain access to the administration console. Then in the administration console, how you can run commands on the system. If you didn't go through From SQL injection to shell, you should start there and move to this exercise later.

What you will learn?

  • SQL injection exploitation using UNION
  • Cracking md5 hashed passwords
  • Modifying Apache behavior with .htaccess files
  • Writing a PHP webshell

  • Filename: from_sqli_to_shell_pg_edition_i386.iso
  • File size: 161 MB
  • MD5: D6C1AA6F437ED2D5C0F66CCB2BC896B0
  • SHA1: A88E1E1217D2D3743F7737BBA7C47CE68125BCC3

  • Filename: _from_sqli_to_shell_pg_edition.iso
  • File size: 164 MB
  • MD5: 0C4F0F4DA9991D3B234DA0D878B435A4
  • SHA1: 7E6532B10EE7D5237AFC249339653B7DA9A71407

  • Format: Disk Image (.ISO)
  • Operating System: Linux

  • DHCP service: Enabled
  • IP address: Automatically assign