no pass needed
Filtered SQL injection

Description

It's all about who you know and I know 'admin'.
http://web.chal.csaw.io:5001

Solution

  • The username is reflected back into the username field (its value attribute) after failed authentication
  • By fuzzing username inputs, we can find that anything after a whitespace is removed.
  • Furthermore, 'admin' is replaced non-recursively.
We can exploit an SQL injection in the username parameter. The payload is:
1
username=adadminmin';#&password=
Copied!
This will translate to the query:
1
SELECT * FROM users WHERE username='admin';#
Copied!
The flag is flag{wh0_n3ed5_a_p4ssw0rd_anyw4y}.
Last modified 2mo ago
Copy link