Statistics

44 Sites

197 Challs

Top 10 Players

Last 20 Activities

Online within 1d

WeChall->Challenges->Challenge: Training: MySQL II

SQL injection Go to the Training: MySQL II challenge

Some enlightenment requiredDouble query

flaps

Global Rank: 3248

Totalscore: 6836

Posts: 3

Thanks: 3

UpVotes: 2

Registered: 10y 306d

Last Seen: 10y 299d

The User is Offline

SQL injection
Jan 05, 2016 - 14:11:49 (10y 300d) Google/translate1Thank You!0Good Post!1Bad Post! link

I get stuck.

Sensitive is login authentication, so i try to bypass it writing:
CENSORED
or
CENSORED
but the only message I get is wrong password.

Can anybody give me a hint what I'm doing wrong ?

Last edited by dloser - Jan 05, 2016 - 14:59:17

dloser

Global Rank: 2

Totalscore: 747640

Posts: 441

Thanks: 501

UpVotes: 478

Registered: 17y 96d

The User is Offline

RE: SQL injection
Jan 05, 2016 - 15:00:02 (10y 300d) Google/translate1Thank You!1Good Post!0Bad Post! link

You are ignoring the crucial part of this challenge: the password check.

flaps

Global Rank: 3248

Totalscore: 6836

Posts: 3

Thanks: 3

UpVotes: 2

Registered: 10y 306d

Last Seen: 10y 299d

The User is Offline

RE: SQL injection
Jan 05, 2016 - 15:37:37 (10y 300d) Google/translate1Thank You!1Good Post!0Bad Post! link

First of all thanks for hint and quick response.

I tried to end SQL command by -- - or -- or %00 and then comment rest of PHP function with multiline comment /*
Injection looks like:

CENSORED

But still getting message about wrong password.

Last edited by dloser - Jan 05, 2016 - 15:42:13

dloser

Global Rank: 2

Totalscore: 747640

Posts: 441

Thanks: 501

UpVotes: 478

Registered: 17y 96d

The User is Offline

RE: SQL injection
Jan 05, 2016 - 15:48:02 (10y 300d) Google/translate1Thank You!0Good Post!1Bad Post! link

You cannot comment out PHP code like that. (And if you could, it still wouldn't work.)

B.t.w.: Don't include the injections you are trying in your posts. It could spoil it for others.

Redknee, silenttrack, n0tHappy, nonfungiblesecurity, quangntenemy, TheHiveMind, Z, balicocat, Ge0, arraez, jcquinterov, hophuocthinh, alfamen2, burhanudinn123, Ben_Dover, stephanduran89, braddie0, fpombal, csuquvq have subscribed to this thread and receive emails on new posts.
1 people are watching the thread at the moment.
This thread has been viewed 10652 times.