$result = $db->query('SELECT * FROM USERS WHERE password="'.$_GET['password'].'"');
if($result->fetchArray()) $step1=true;

$result = $db->query('SELECT * FROM USERS WHERE password=\''.$_GET['password'].'\'');
if($result->fetchArray()) $step2=true;

$result = $db->query('SELECT * FROM USERS WHERE password='.$_GET['password']);
if($result->fetchArray()) $step3=true;

This code is part of a ctf challenge I'm doing strictly for learning purposes and I'm not quite sure how to get each of these SQL statements to evaluate as true.

Some thoughts i had was doing an insert statement where the password would equal the injection statement but I'm not sure if thats a good approach. If its possibile i would like to get it without modification to the backend database.

I'm not really looking for a direct answer, but perhaps some guidance.

Appreciate the help.

EDIT: $step1, $step2 and $step3 need to all evaluate to true

  • For the first one you use double quotes, second one single quotes, third one you can use any. So something like " or 1=1, ' or 1=1, "" or 1=1 – Technidev Apr 7 '18 at 23:14
  • right, but you can only inject 1 payload. You dont submit 3 different payloads to the application. So 1 payload has to satisfy all 3 – CBaker Apr 7 '18 at 23:18

The OWASP Foundation website is a rich source for information security topics.

They have a page designated to SQL Injection Bypassing.

Your target is that you need to make sure that however the query has been constructed, the result will be a true value.

An example that was provided by OWASP was the following:

select * from table where id = 1 AND if((ascii(lower(substring((select user()),$i,1))))!=$s,1,benchmark(200000,md5(now())))

Most website's that take their data seriously have means of protecting their databases from all sorts of Injection attacks, a basic one being input sanitisation.

Reference: SQL Injection Bypassing WAF - OWASP. (2018). Owasp.org. Retrieved 8 April 2018, from https://www.owasp.org/index.php/SQL_Injection_Bypassing_WAF

| improve this answer | |
  • I don't see how that would work. I don't see where you'd escape out of the single quote (') or the double quote (") with that payload. That may work for the 3rd condition. – CBaker Apr 8 '18 at 7:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.