H2 - Java SQL database
Official page: https://www.h2database.com/html/main.html
Access
You can indicate a jina la database lisilopo in order to create a new database without valid credentials (bila uthibitisho):
Or if you know that for example a mysql inafanya kazi and you know the jina la database and the credentials for that database, you can just access it:
Trick from box Hawk of HTB.
RCE
Having access to communicate with the H2 database check this exploit to get RCE on it: https://gist.github.com/h4ckninja/22b8e2d2f4c29e94121718a43ba97eed
H2 SQL Injection to RCE
In this post a payload is explained to get RCE kupitia database ya H2 abusing a SQL Injection.
Last updated