picoCTF : logon (Web Exploitation)

SPOILER ALERT : Hello I’m scriptpit01 !!
This is a writeup for the picoCTF “logon”
which will end up in showing the solution to the problem.
Do not read if you don’t want to know the solution
before trying to solve it by yourself.
You can always give a shot to it by picoCTF official website here.

Challenge

Let’s Start with this logon challenge. (100 points)

Description

The factory is hiding things from all of its users. Can you login as Joe and find what they've been looking at? https://jupiter.challenges.picoctf.org/problem/44573/ (link) or http://jupiter.challenges.picoctf.org:44573

scriptpi01 : We just try to login .

Website

Solution

(Step 1)
scriptpi01 : Let’s login with this password to see what will happen.

USERNAME : Joe
PASSWORD : password

(Step 2)
scriptpi01 : Let’s try to SQL injection.

What is SQL Injection ?

SQL injection (SQLi) is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. It generally allows an attacker to view data that they are not normally able to retrieve. This might include data belonging to other users, or any other data that the application itself is able to access. In many cases, an attacker can modify or delete this data, causing persistent changes to the application’s content or behavior.

In some situations, an attacker can escalate an SQL injection attack to compromise the underlying server or other back-end infrastructure, or perform a denial-of-service attack

PortSwigger

scriptpi01 : We should try SQL Injection command.

**RECOMMAND**
USERNAME : ' or 1=1--
PASSWORD : ' or 1=1--
**RECOMMAND**
USERNAME : ' or 1=1/*
PASSWORD : ' or 1=1/*
USERNAME : ' or ' 1=1
PASSWORD : ' or ' 1=1
USERNAME : admin' or 1=1 -- -
PASSWORD : admin' or 1=1 -- -
USERNAME : admi'||'n'||substr(
PASSWORD : ,0,0)||'
USERNAME : admi'||(nullif('n',
PASSWORD : ))||'

scriptpi01 : Nothing happen again.

(Step 3)
scriptpi01 : Now i think we should to check cookies when we login.

scriptpi01 : Let’s right click >> inspect (Q) before login.

scriptpi01 : Select Storage >> Cookies >> https://jupiter.challenges.picoctf.org

scriptpi01 : We try to login again and see what happen in cookies.
scriptpi01 : Now we see something.

name : admin
value : False

scriptpi01 : It’s mean you are not admin, We will change value False = True.

name : admin
value : True

scriptpi01 : Now Refersh the website.

scriptpi01 : We got a flag here !

— — — — — — — — — — — — — — — — — — — — — — — — — — — —

Little Devil by myflix

.\
                        .\   / _\   .\
                       /_ \   ||   / _\
                        ||    ||    ||
                 ; ,     \`.__||__.'/
         |\     /( ;\_.;  `./|  __.'
         ' `.  _|_\/_;-'_ .' '||
          \ _/`       `.-\_ / ||      _
      , _ _`; ,--.   ,--. ;'_ _|,     |
      '`''\| /  ,-\ | _,-\ |/''`'  _  |
       \ .-- \__\_/ /` )_/ --. /   |  |       _
       /    .         -'  .    \ --|--|--.  .' \
      |     /             \     |  |  |   \ |---'
   .   .  -' `-..____...-' `-  .   |  |    |\  _
.'`'.__ `._      `-..-''    _.'|   |  | _  | `-'      _
 \ .--.`.  `-..__    _,..-'   L|   |    |             |
  '    \ \      _,| |,_      /_7)  |    |   _       _ |  _
        \ \    /       \ _.-'/||        | .' \     _| |  |
         \ \  /.'|   |`.__.'` ||     .--| |--- _   /| |  |
          \ `//_/     \       ||    /   | \  _ \  / | |  |
           `/ \|       |      ||   |    |  `-'  \/  | '--|      _
            `"`'.  _  .'      ||    `--'|                |   .--/
                 \ | /        ||                         '--'
                  |'|  mx     'J        Cy@ picoCTF ! ;)
               .-.|||.-.
              '----"----'