Skip to content

Latest commit

 

History

History
92 lines (58 loc) · 3.64 KB

README.md

File metadata and controls

92 lines (58 loc) · 3.64 KB
Raw

Web Gauntlet 2

Write-up author: jon-brandy

DESCRIPTION:

If the flag is not displayed after completing this challenge, try clearing your cookies. 
Cookies set by other challenges may prevent the flag from displaying properly.

This website looks familiar... Log in as admin Site: http://mercury.picoctf.net:57359/ Filter: http://mercury.picoctf.net:57359/filter.php

HINTS:

  1. I tried to make it a little bit less contrived since the mini competition.
  2. Each filter is separated by a space. Spaces are not filtered.
  3. There is only 1 round this time, when you beat it the flag will be in filter.php.
  4. There is a length component now.
  5. sqlite

STEPS:

  1. First, open the website -> http://mercury.picoctf.net:57359/.
  2. Try to input the user as admin and password as admin, then click sign in.

image

  1. It said filtered.

image

  1. Now try to open the http://mercury.picoctf.net:57359/filter.php.

image

  1. We can conclude that the website does filter few entities.
  2. Next, let's try to input the unfiltered word, in this case i tried to input user as username and pass as password.

image

  1. It said not admin. Means we must use the username as admin but we need to bypass it.

image

  1. Since concatenation is not prohibited, then the easiest bypass is to use || for concatenation at the username. Now input ad'||'min as username and pass as password.
  2. It still gave us a response -> not admin.

image

  1. Now let's remodel this query:

image

  1. Change the query to this:
SELECT username, password FROM users WHERE username='ad'||'min'||substr(' AND password=',0,0)||''
  1. Based from the query, we fill the username as ad'||'min'||substr( and the password as ,0,0)||'.

image

image

  1. Now open the filter.php file. Finally we got the flag!

image

ALTERNATE SOLUTIONS (USING SQLite)

  1. If you want to use sqlite, for username still using concatenation -> ad'||'min. For the password you can use the SQLite logical property -> IS NOT.

image

  1. Now input the username as ad'||'min and the password as a' IS NOT 'b.

image

image

REFERENCES:

SQLite CheatSheet

https://www.tutorialspoint.com/sqlite/sqlite_operators.htm

FLAG

picoCTF{0n3_m0r3_t1m3_d5a91d8c2ae4ce567c2e8b8453305565}