Madoka

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2019-10-20 | Status: Solved Techniques: comment_bypass, quote_balancing

Summary

SQL injection task at https://2019-10-20-sqlinj.ctf.su/madoka

Madoka — Web Kids 2.0

Description

SQL injection task at https://2019-10-20-sqlinj.ctf.su/madoka

Analysis

WAF blocks standard SQL comment characters (-- and #). This means the classic approach of commenting out the rest of the query doesn't work.

Key observations:

• User input goes into the WHERE clause
• Comment characters -- and # are blocked by WAF
• Need to create valid SQL without commenting

Solution

Using quote balancing to create a syntactically correct query:

' OR '1'='1

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

This payload transforms the original query:

 sql read-only • copy allowed Copy
SELECT * FROM girls WHERE name=''

Into:

 sql read-only • copy allowed Copy
SELECT * FROM girls WHERE name='' OR '1'='1'

The key point: quotes are balanced, the query is syntactically correct without needing to comment out trailing characters. The condition '1'='1' is always true, so all records from the table are returned, including the flag. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍