Madoka

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: comment_bypass, quote_balancing

Summary

Walkthrough of the CUSTOM Web Madoka. SQL injection task at https://2019-10-20-sqlinj.ctf.su/madoka

Description

SQL injection task at https://2019-10-20-sqlinj.ctf.su/madoka

Analysis

WAF blocks standard SQL comment characters (-- and #). This means the classic approach of commenting out the rest of the query doesn't work.

Key observations:

• User input goes into the WHERE clause
• Comment characters -- and # are blocked by WAF
• Need to create valid SQL without commenting

Solution

Using quote balancing to create a syntactically correct query:

' OR '1'='1

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

This payload transforms the original query:

 sql read-only • copy allowed Copy
SELECT * FROM girls WHERE name=''

Into:

 sql read-only • copy allowed Copy
SELECT * FROM girls WHERE name='' OR '1'='1'

The key point: quotes are balanced, the query is syntactically correct without needing to comment out trailing characters. The condition '1'='1' is always true, so all records from the table are returned, including the flag. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering comment_bypass, quote_balancing was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2019-10-20 • CUSTOM • Madoka • Difficulty: Easy