Gabriel

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: column_extraction, union_based_sqli

Summary

Walkthrough of the CUSTOM Web Gabriel. SQL injection task at https://2019-10-20-sqlinj.ctf.su/gabriel

Description

SQL injection task at https://2019-10-20-sqlinj.ctf.su/gabriel

Analysis

The page displays only the "name" column from the query results. The flag is in the "secret" column. We need to use UNION SELECT to extract the value from a different column.

Key observations:

• User input goes into the WHERE clause
• Only one column is displayed (name)
• The flag is stored in the secret column

Solution

Using UNION SELECT to substitute the displayed column:

' UNION SELECT secret FROM girls WHERE name='Gabriel' --

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

This payload:

1. Closes the original string with '
2. Adds UNION SELECT to select the secret column
3. Filters by name='Gabriel' to get the needed record
4. Comments out the rest of the query with --

As a result, the query returns the secret column value as if it were the name, and the flag is displayed on the page. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering column_extraction, union_based_sqli was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2019-10-20 • CUSTOM • Gabriel • Difficulty: Easy