Gabriel

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2019-10-20 | Status: Solved Techniques: column_extraction, union_based_sqli

Summary

SQL injection task at https://2019-10-20-sqlinj.ctf.su/gabriel

Gabriel — Web Kids 2.0

Description

SQL injection task at https://2019-10-20-sqlinj.ctf.su/gabriel

Analysis

The page displays only the "name" column from the query results. The flag is in the "secret" column. We need to use UNION SELECT to extract the value from a different column.

Key observations:

• User input goes into the WHERE clause
• Only one column is displayed (name)
• The flag is stored in the secret column

Solution

Using UNION SELECT to substitute the displayed column:

' UNION SELECT secret FROM girls WHERE name='Gabriel' --

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

This payload:

1. Closes the original string with '
2. Adds UNION SELECT to select the secret column
3. Filters by name='Gabriel' to get the needed record
4. Comments out the rest of the query with --

As a result, the query returns the secret column value as if it were the name, and the flag is displayed on the page. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍