1

I am just getting into CTF and Hacking in general. I am very confused as to why this worked when I added an apostrophe to the end it reveals the flag. I have Burp Community Edition suite going and I have HTTP live headers.

I am just not trying understanding how adding http://example.com/page/edit/2' gives the flag while http://example.com/page/edit/2 is a normal page. I'd appreciate any information

As Seen Here

Flag Revealed

Using Burp, the only difference I see in the requests is

With the ' it shows

GET /page/edit/2 HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:70.0) Gecko/20100101 Firefox/70.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0

And without, it shows

GET /page/edit/2' HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:70.0) Gecko/20100101 Firefox/70.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1

So it appears the only difference is the Cache-Control HTTP Header, is that right?

Cache-Control: max-age=0

And from HTTP Live Headers

http://example.com/page/edit/2'    
Host: example.com    
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:70.0) Gecko/20100101 Firefox/70.0    
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8    
Accept-Language: en-US,en;q=0.5    
Accept-Encoding: gzip, deflate    
Upgrade-Insecure-Requests: 1    
Connection: keep-alive    
GET: HTTP/1.1 200 OK    
Server: nginx/1.14.0 (Ubuntu)    
Date: Mon, 09 Sep 2019 16:18:40 GMT    
Content-Type: text/html; charset=utf-8    
Connection: close    
Content-Length: 76
  • 3
    That's not the result of any obvious vulnerability that I am aware of. Since this is a CTF, the answer may simply be "Because that is how the CTF was made". That's not necessarily a crazy thing to do, since sometimes developers also do very strange things that result in very strange bugs. Is the source code available for this particular challenge? That would make it much easier to get you a clear answer. – Conor Mancone Sep 9 at 16:43
  • Look at the html source.Its probably dom based – Vipul Nair Sep 9 at 18:27
  • Maybe you shouldn't give the answer to the CTF ? – Deunis Sep 10 at 7:55
0

It looks like a possible SQL Injection. ' is used to limit strings in SQL, hence with your ' you delimit it.

It seems like the FLAG string was not properly escaped, so the flag gets returned when you add the character delimiter.

It's a common technique for people testing SQLi vulnerabilities. Web CTF has a lot of guessing in it, so be prepared to keep guessing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.