Exploit for VulnBoard

## https://sploitus.com/exploit?id=5C7AD37B-DA52-556A-A680-5658CD886BCC
# VulnBoard

“If you don’t know about attacks, you can’t defend yourself.” – A practice lab for web hacking that ends with just one chapter from the “KritaKitty” series.

> For those who find reading 900 pages of content boring… **Just try breaking it directly.**  
> Turn on Burp and experience what it feels like to exploit vulnerabilities through SQL injection to gain admin privileges. VulnBoard is a **intentionally vulnerable** website + basic examples, designed as a **safe hacking playground**. ---

## 🚀 Start in 30 seconds

```bash
git clone https://github.com/JimProKing/VulnBoard.git
cd VulnBoard/webhacking-bible-lab/vulnboard
pip install -r ../../requirements.txt
python app.py
```

Open a browser to http://127.0.0.1:5002. Set up **Burp Suite** (it’s the real protagonist here).

Basic accounts:
- `admin` / `admin123!@#`
- `chulsu` / `test123`

---

## 🎮 Main Challenges (HACKING_CHALLENGES.md must be read)

- **Level 1**: Exploit admin accounts using SQLi.
- **Level 2**: Extract secrets tables using UNION queries.
- **Levels 3–5**: Blind SQLi attacks, time-based SQLi attacks.
- **Bonus**: Stored XSS, IDOR, Broken Access Control, file upload, Command Injection.

The secrets table contains **flags**. Complete all of them to win. ---

## 🛠️ What’s included

| Folder           | Content                          | Description |
|-----------------|-----------------------------------|-------------|
| `vulnboard/`    | Main vulnerability blog           | Ch04–Ch11   |
| `01-basics/`    | Why websites are vulnerable          | Ch01        |
| `02-http-burp`   | HTTP + Burp – complete guide      | Ch02        |

All vulnerability codes include a comment `# VULNERABLE:`. Enjoy understanding each line while looking at the source code. ---

## ⚠️ Important notes

- This is **for learning purposes only**. If you actually deploy such attacks in a real service, you’ll get caught. Press `/reset` to reset the database. You’re allowed to experiment and break things. Use Burp Repeater like a god. ---

## 💡 Learning tips (KritaKitty style)

1. Use Burp to intercept all requests.
2. Ignore error messages (they’re meant for you).
3. Imagine what happens when you execute a query.
4. Save successful payloads in the Repeater.
5. If you’re confused, just say “Column count doesn’t match in Level 2”. I’ll help you. ---

## 📦 How to use (Windows)

```powershell
# 1. Clone the project
git clone https://github.com/JimProKing/VulnBoard.git
cd VulnBoard\webhacking-bible-lab

# 2. Install dependencies
pip install -r requirements.txt

# 3. Run VulnBoard
cd vulnboard
python app.py
```

---

## 🎉 Why this project was created

This project was created because users said they didn’t enjoy reading books and wanted to learn by creating and hacking actual websites. Instead of creating many small examples, we focused on creating a **full-fledged vulnerable website** to give you a real sense of hacking. The official example (Tomcat+JSP) is too heavy; this version uses Flask + SQLite, making it lighter and easy to run on Windows. ---

**Let’s go, get admin accounts!**

If you succeed, say “Level 1 completed”. I’ll guide you to the next level. Hacking becomes fun! 🔥

*(This project is designed for learning purposes only. Actual hacking is strictly prohibited.)*

Made with ❤️ by Grok for you.

[source-iocs-preserved url=http://127.0.0.1:5002]