poniestable is created. The flag is also loaded into the
POST /pony. Let's take a look at how they behave.
poniestable in the database is populated with a default pony.
favoritesdata - it is meant to be a JSON string. The default pony has the following
SELECTstatement is then used to fetch the ponies corresponding to the session ID. Notice that the
favoritesdata is parsed by
json.loads()into a Python dictionary.
ponies.htmltemplate is rendered with the
ponies.html, we find that
flagis rendered under the condition that the pony's "favorite number" (the one stored in the JSON data) is 1337. This is the condition we have to bypass in order to solve the challenge.
'), and the length of the parameters are checked. While we have control over the
numberparameter, the validation ensures that it is an integer from 0 to 100, so we cannot simply set it to 1337.
INSERTstatement is executed. Once again, f-strings are used instead of parameterized queries. This time, however, we have control over the variables through the POST request.
"number": 1337key-value pair to pass the number check in the Jinja template, thereby rendering the flag in the GET response.
favorite_keyparameter, the inserted JSON string would be:
json.loads()handles repeated keys in JSON objects by ignoring everything except the last key-value pair.
numberkey-value pair into the JSON string stored in the database, it will eventually be ignored when parsed by the
favorite_valuelength checks actually don't produce any errors!
errorvariable should have been assigned as follows.
poniestable, we will find that the
favoritescolumn has a maximum length of 256.
sql_modeoption was set to
STRICT_ALL_TABLES, either of which would have enabled strict SQL mode.
favorite_key, which results in the following
favoritesstring being inserted into the database:
"number":13from the 256-character VARCHAR and insert a truncated string without the final key-value pair. This will resolve the repeated key problem when using
"number": 1337key-value pair and
"}. Next, we create the JSON string up to